DigitalOcean

Installs doctl (DigitalOcean CLI) and configures shell aliases and functions.

What it does

• Auto-installs and updates doctl to the latest GitHub release
• Bash tab completion for doctl
• Keeps account/context selection per-shell (DIGITALOCEAN_CONTEXT) so terminals never collide, see Per-shell isolation
• Saves auto-renewing kubeconfigs (exec credentials doctl refreshes on demand) instead of static tokens that expire after 7 days, see Kubeconfig credentials
• Flags a missing or revoked context token when you activate an account with do-account, pointing you at do-authenticate
• Shell aliases and functions for common operations

Aliases

Alias	Command	Description
digitalocean	do-account	Show current DigitalOcean account
do-projects	doctl projects list	List DigitalOcean projects

Functions

Function	Description
do-account	Show current account info (warns on expired credentials) or switch to a named context
do-authenticate	Re-authenticate and reinitialise a named doctl context
do-kubernetes	List Kubernetes clusters in the current account
do-kubeconfig	Save an auto-renewing kubeconfig for a cluster to ~/.kube/configs/<cluster>.yaml (--activate also switches the current shell to it)

Per-shell isolation

Account selection lives in the DIGITALOCEAN_CONTEXT environment variable scoped to the current shell, never in the context key of the shared ~/.config/doctl/config.yaml. do-account exports DIGITALOCEAN_CONTEXT rather than running doctl auth switch, so picking a context in one terminal cannot change which account another terminal acts on.

Because selection is env-var driven, every terminal holds its own DigitalOcean account. You can run several sessions at once, each pointed at a different team or context, including a coding agent like Claude Code, with no shared doctl state for them to fight over. The starship prompt reads the same DIGITALOCEAN_CONTEXT and shows the context (🌊 <context>), so each shell visibly shows the account it is on. This is the per-shell context isolation concept applied to DigitalOcean.

Kubeconfig credentials

do-kubeconfig writes an exec credential rather than a static token. kubectl runs doctl to fetch a fresh token whenever the old one expires, so a saved kubeconfig keeps working indefinitely. This avoids the the server has asked for the client to provide credentials errors you get from doctl kubernetes cluster kubeconfig show, whose baked-in token expires after 7 days.

The command bakes the shell's DIGITALOCEAN_CONTEXT into the kubeconfig's exec.env, so the saved config keeps authenticating as the account that created it, the same way the googlecloud role pins its GKE configs to an account.

The exec credential still relies on the underlying doctl context being valid. If its API token is revoked, do-account <context> flags it when you activate the account so you can re-run do-authenticate <context> before a kubectl call fails.