Trying to get the hang of the relationships between k8s and kx - I don't see how kx can set the context for the cluster in the kubeconfig things should be applied to, is the intention that I set up k8s.Provider first to lock down the context and then pass that as a provider: argument to kx?

Yes. So for example if I want to use the kx library to create a secret, I'd do the following:

const provider = new k8s.Provider("provider", {
  kubeconfig: config.kubeconfig,
});

const mySecret = new kx.Secret("mySecret", {
  metadata: { namespace: "mynamespace" },
  stringData: { key: "secretdata" },
}, { provider });

excellent - that seems very reasonable 🙂

We do like being reasonable 🙂