@cat-factory/integrations 0.155.1 → 0.155.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -40,7 +40,23 @@ export declare class KubernetesApiClient {
|
|
|
40
40
|
* caller maps status codes (404/409/…) to its own semantics.
|
|
41
41
|
*/
|
|
42
42
|
fetch(method: string, url: string, body: unknown, timeoutMs: number, contentType?: string): Promise<Response>;
|
|
43
|
-
|
|
43
|
+
/**
|
|
44
|
+
* The transport a custom-CA / insecure-skip config needs: an undici `Agent` carrying the TLS
|
|
45
|
+
* options AND the `fetch` that dispatches through it. Undefined when the config needs neither,
|
|
46
|
+
* in which case the caller uses the global `fetch` and undici is never loaded at all.
|
|
47
|
+
*
|
|
48
|
+
* **The two come from ONE undici instance, and that is the whole point of this method.** Node's
|
|
49
|
+
* global `fetch` is implemented by the undici BUNDLED INTO NODE, and the request handler it
|
|
50
|
+
* builds is that copy's internal shape; passing it a dispatcher from the userland `undici`
|
|
51
|
+
* package makes one undici validate the other's handler. undici 8 dropped the legacy handler
|
|
52
|
+
* interface that Node's bundled undici 7 still emits, so every apiserver call with a CA or a
|
|
53
|
+
* skip-verify configured died before a socket was opened, as `fetch failed: invalid
|
|
54
|
+
* onRequestStart method (UND_ERR_INVALID_ARG)`. That is indistinguishable, on a connect form,
|
|
55
|
+
* from a cluster that is not answering, and it is exactly the config a k3s box needs, so k3s
|
|
56
|
+
* could not be connected at all. undici's own `fetch` builds the handler its own `Agent`
|
|
57
|
+
* expects, so the pair cannot drift again on either side's next major.
|
|
58
|
+
*/
|
|
59
|
+
private tlsTransport;
|
|
44
60
|
}
|
|
45
61
|
/** Read a response body defensively, length-capped, for error messages. */
|
|
46
62
|
export declare function safeText(res: Response): Promise<string>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"KubernetesApiClient.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;
|
|
1
|
+
{"version":3,"file":"KubernetesApiClient.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAsBzD,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IATjC,YACmB,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,cAAc;IAC9C,4EAA4E;IAC3D,QAAQ,GAAE,MAA6B;IACxD;;;OAGG;IACc,aAAa,CAAC,EAAE,uBAAuB,YAAA,EACtD;IAEJ;;;;;;OAMG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,QAAQ,CAAC,CA6CnB;IAED;;;;;;;;;;;;;;;OAeG;YACW,YAAY;CAkB3B;AAyCD,2EAA2E;AAC3E,wBAAsB,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAM7D"}
|
|
@@ -65,35 +65,75 @@ export class KubernetesApiClient {
|
|
|
65
65
|
body: payload,
|
|
66
66
|
signal: AbortSignal.timeout(timeoutMs),
|
|
67
67
|
};
|
|
68
|
-
const
|
|
69
|
-
if (
|
|
70
|
-
|
|
71
|
-
|
|
68
|
+
const tls = await this.tlsTransport();
|
|
69
|
+
if (!tls)
|
|
70
|
+
return fetch(url, init);
|
|
71
|
+
init.dispatcher = tls.dispatcher;
|
|
72
|
+
return tls.fetch(url, init);
|
|
72
73
|
}
|
|
73
|
-
|
|
74
|
+
/**
|
|
75
|
+
* The transport a custom-CA / insecure-skip config needs: an undici `Agent` carrying the TLS
|
|
76
|
+
* options AND the `fetch` that dispatches through it. Undefined when the config needs neither,
|
|
77
|
+
* in which case the caller uses the global `fetch` and undici is never loaded at all.
|
|
78
|
+
*
|
|
79
|
+
* **The two come from ONE undici instance, and that is the whole point of this method.** Node's
|
|
80
|
+
* global `fetch` is implemented by the undici BUNDLED INTO NODE, and the request handler it
|
|
81
|
+
* builds is that copy's internal shape; passing it a dispatcher from the userland `undici`
|
|
82
|
+
* package makes one undici validate the other's handler. undici 8 dropped the legacy handler
|
|
83
|
+
* interface that Node's bundled undici 7 still emits, so every apiserver call with a CA or a
|
|
84
|
+
* skip-verify configured died before a socket was opened, as `fetch failed: invalid
|
|
85
|
+
* onRequestStart method (UND_ERR_INVALID_ARG)`. That is indistinguishable, on a connect form,
|
|
86
|
+
* from a cluster that is not answering, and it is exactly the config a k3s box needs, so k3s
|
|
87
|
+
* could not be connected at all. undici's own `fetch` builds the handler its own `Agent`
|
|
88
|
+
* expects, so the pair cannot drift again on either side's next major.
|
|
89
|
+
*/
|
|
90
|
+
async tlsTransport() {
|
|
74
91
|
if (!this.config.caCertPem && !this.config.insecureSkipTlsVerify)
|
|
75
92
|
return undefined;
|
|
93
|
+
const undici = await loadUndici();
|
|
76
94
|
const key = `${this.config.insecureSkipTlsVerify ? 'insecure' : 'verify'}:${this.config.caCertPem ?? ''}`;
|
|
77
|
-
|
|
78
|
-
if (
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
95
|
+
let dispatcher = tlsDispatcherCache.get(key);
|
|
96
|
+
if (!dispatcher) {
|
|
97
|
+
dispatcher = new undici.Agent({
|
|
98
|
+
connect: {
|
|
99
|
+
ca: this.config.caCertPem,
|
|
100
|
+
rejectUnauthorized: !this.config.insecureSkipTlsVerify,
|
|
101
|
+
},
|
|
102
|
+
});
|
|
103
|
+
tlsDispatcherCache.set(key, dispatcher);
|
|
85
104
|
}
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
105
|
+
return { fetch: undici.fetch, dispatcher };
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
/**
|
|
109
|
+
* Load the userland `undici`, or throw a failure that names what could not be done and carries
|
|
110
|
+
* WHY as its `cause`.
|
|
111
|
+
*
|
|
112
|
+
* The specifier is a variable so a bundler cannot statically resolve it: the Worker build must not
|
|
113
|
+
* pull `undici` in, and no Worker reaches this line anyway, because the Cloudflare facade sets
|
|
114
|
+
* `customTlsSupported: false` and a custom-TLS config is refused before it becomes a client.
|
|
115
|
+
* Nothing memoises the import because the module loader already does: this is a cache lookup after
|
|
116
|
+
* the first call.
|
|
117
|
+
*
|
|
118
|
+
* **The failure is reported, never guessed at.** `undici` is a runtime dependency of this package,
|
|
119
|
+
* so on Node a load failure means a broken or pruned install; the message this replaced asserted
|
|
120
|
+
* instead that the runtime was not Node, which is the one explanation that is almost always wrong
|
|
121
|
+
* when an operator reads it. The load error rides along as `cause`, so
|
|
122
|
+
* `describeConnectionFailure` renders it (scrubbed) into the detail the connect form shows.
|
|
123
|
+
*/
|
|
124
|
+
async function loadUndici() {
|
|
125
|
+
const moduleName = 'undici';
|
|
126
|
+
try {
|
|
127
|
+
return (await import(moduleName));
|
|
128
|
+
}
|
|
129
|
+
catch (error) {
|
|
130
|
+
throw new Error(
|
|
131
|
+
// No trailing period: this message is read with the cause appended to it, which is where
|
|
132
|
+
// `describeConnectionFailure` joins the chain with a colon.
|
|
133
|
+
"Kubernetes custom CA / insecure TLS needs the 'undici' package, which this deployment could not load", { cause: error });
|
|
94
134
|
}
|
|
95
135
|
}
|
|
96
|
-
/** Module-scoped undici Agent cache, keyed by the CA/insecure pair (see
|
|
136
|
+
/** Module-scoped undici Agent cache, keyed by the CA/insecure pair (see tlsTransport). */
|
|
97
137
|
const tlsDispatcherCache = new Map();
|
|
98
138
|
/** Read a response body defensively, length-capped, for error messages. */
|
|
99
139
|
export async function safeText(res) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"KubernetesApiClient.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesApiClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;
|
|
1
|
+
{"version":3,"file":"KubernetesApiClient.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesApiClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAiC5D,MAAM,OAAO,mBAAmB;IAEX,MAAM;IACN,aAAa;IAEb,QAAQ;IAKR,aAAa;IAThC,YACmB,MAA8B,EAC9B,aAA6B;IAC9C,4EAA4E;IAC3D,QAAQ,GAAW,oBAAoB;IACxD;;;OAGG;IACc,aAAuC;sBARvC,MAAM;6BACN,aAAa;wBAEb,QAAQ;6BAKR,aAAa;IAC7B,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CACT,MAAc,EACd,GAAW,EACX,IAAa,EACb,SAAiB,EACjB,WAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE;YAC5B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAA;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,uFAAuF;QACvF,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAA;QAClD,IAAI,OAAO,IAAI,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CACvB,yCAAyC,IAAI,CAAC,QAAQ,qCAAqC;gBACzF,sFAAsF;gBACtF,gGAAgG,EAClG,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAC/C,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,OAA2B,CAAA;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAChE,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,IAAI,kBAAkB,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAA2C;YACnD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;QAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,YAAY;QAGxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAA;QAClF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;QACzG,IAAI,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;gBAC5B,OAAO,EAAE;oBACP,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBACzB,kBAAkB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;iBACvD;aACF,CAAC,CAAA;YACF,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAA;IAC5C,CAAC;CACF;AAQD;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAiB,CAAA;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK;QACb,yFAAyF;QACzF,4DAA4D;QAC5D,sGAAsG,EACtG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmB,CAAA;AAErD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAa;IAC1C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cat-factory/integrations",
|
|
3
|
-
"version": "0.155.
|
|
3
|
+
"version": "0.155.2",
|
|
4
4
|
"description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -26,13 +26,13 @@
|
|
|
26
26
|
"dependencies": {
|
|
27
27
|
"ai": "^7.0.58",
|
|
28
28
|
"p-map": "^7.0.6",
|
|
29
|
+
"undici": "^8.10.0",
|
|
29
30
|
"yaml": "^2.9.0",
|
|
30
31
|
"@cat-factory/contracts": "0.292.1",
|
|
31
32
|
"@cat-factory/kernel": "0.285.2"
|
|
32
33
|
},
|
|
33
34
|
"devDependencies": {
|
|
34
35
|
"typescript": "7.0.2",
|
|
35
|
-
"undici": "^8.10.0",
|
|
36
36
|
"valibot": "^1.4.2",
|
|
37
37
|
"vitest": "^4.1.10",
|
|
38
38
|
"@cat-factory/caching": "0.18.39"
|