@firestartr/cli 1.59.0-snapshot-15 → 1.59.0-snapshot-17

package/build/index.js

@@ -357922,6 +357922,42 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
             },
             additionalProperties: false,
         },
+        GithubRules: {
+            $id: 'firestartr.dev://common/FirestartrGithubRules',
+            type: 'object',
+            properties: {
+                path: { type: 'string' },
+                owners: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrOwnerRef',
+                    },
+                },
+            },
+            required: ['path', 'owners'],
+            additionalProperties: false,
+        },
+        GithubSync: {
+            $id: 'firestartr.dev://common/FirestartrGithubSync',
+            type: 'object',
+            properties: {
+                enabled: { type: 'boolean' },
+                period: {
+                    type: 'string',
+                    pattern: '^[0-9]+[smhd]$',
+                },
+                policy: { type: 'string' },
+                schedule: { type: 'string' },
+                schedule_timezone: { type: 'string' },
+            },
+            additionalProperties: false,
+            required: ['enabled'],
+        },
+        TfStateKey: {
+            $id: 'firestartr.dev://common/TerraformStateKey',
+            type: 'string',
+            pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12,}$',
+        },
     },
 });
 
@@ -357957,6 +357993,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubTeamClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                 },
@@ -357988,6 +358025,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubUserClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                 },
@@ -358033,6 +358071,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubComponentClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                     required: ['owner'],
@@ -358122,6 +358161,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://terraform/TerraformProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['terraform'],
                         },
                     },
@@ -358159,6 +358199,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://argocd/ArgoCDProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['argocd'],
                         },
                     },
@@ -358195,6 +358236,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://secrets/ExternalSecretsProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['external_secrets'],
                         },
                     },
@@ -358234,6 +358276,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubOrgWebhookClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                     required: ['owner'],
@@ -358258,6 +358301,15 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
                         privacy: {
                             type: 'string',
                             enum: ['closed', 'secret'],
@@ -358269,6 +358321,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
                     },
+                    additionalProperties: false,
                     required: ['org', 'privacy'],
                 },
             ],
@@ -358293,6 +358346,15 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
                         role: {
                             type: 'string',
                             enum: ['admin', 'member'],
@@ -358301,6 +358363,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
                     },
+                    additionalProperties: false,
                     required: ['org', 'role'],
                 },
             ],
@@ -358331,14 +358394,125 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             type: 'string',
                             description: 'The github repo name',
                         },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         orgPermissions: {
                             type: 'string',
                             description: 'The level of org Permission',
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
+                        technology: {
+                            type: 'object',
+                            properties: {
+                                stack: { type: 'string' },
+                                version: { type: 'string' },
+                            },
+                            additionalProperties: false,
+                            required: ['stack', 'version'],
+                        },
+                        defaultBranch: {
+                            type: 'string',
+                        },
+                        branchStrategy: {
+                            type: 'object',
+                            description: 'A branch strategy for a claim',
+                            properties: {
+                                name: {
+                                    type: 'string',
+                                },
+                                defaultBranch: {
+                                    type: 'string',
+                                },
+                            },
+                            additionalProperties: false,
+                            required: ['name'],
+                        },
+                        additionalBranches: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    name: { type: 'string' },
+                                    orphan: { type: 'boolean' },
+                                },
+                                additionalProperties: false,
+                                required: ['name', 'orphan'],
+                            },
+                        },
+                        actions: {
+                            type: 'object',
+                            description: 'Actions configuration',
+                            properties: {
+                                oidc: {
+                                    type: 'object',
+                                    properties: {
+                                        useDefault: { type: 'boolean' },
+                                        includeClaimKeys: {
+                                            type: 'array',
+                                            items: { type: 'string' },
+                                        },
+                                    },
+                                    additionalProperties: false,
+                                },
+                            },
+                            additionalProperties: false,
+                            required: ['oidc'],
+                        },
                         archiveOnDestroy: {
                             type: 'boolean',
                             description: 'whether this repo should be archived when the claim is deleted',
                         },
+                        allowMergeCommit: {
+                            type: 'boolean',
+                        },
+                        allowSquashMerge: {
+                            type: 'boolean',
+                        },
+                        allowRebaseMerge: {
+                            type: 'boolean',
+                        },
+                        allowAutoMerge: {
+                            type: 'boolean',
+                        },
+                        deleteBranchOnMerge: {
+                            type: 'boolean',
+                        },
+                        autoInit: {
+                            type: 'boolean',
+                        },
+                        allowUpdateBranch: {
+                            type: 'boolean',
+                        },
+                        hasIssues: {
+                            type: 'boolean',
+                        },
+                        hasWiki: {
+                            type: 'boolean',
+                        },
+                        pages: {
+                            type: 'object',
+                            properties: {
+                                cname: { type: 'string' },
+                                source: {
+                                    type: 'object',
+                                    properties: {
+                                        branch: { type: 'string' },
+                                        path: { type: 'string' },
+                                    },
+                                    additionalProperties: false,
+                                },
+                            },
+                            additionalProperties: false,
+                        },
+                        additionalRules: {
+                            type: 'array',
+                            items: {
+                                $ref: 'firestartr.dev://common/FirestartrGithubRules',
+                            },
+                        },
                         visibility: {
                             type: 'string',
                             enum: ['private', 'public', 'internal'],
@@ -358367,8 +358541,14 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                 pattern: '^[a-z0-9][a-z0-9-]*$',
                             },
                         },
+                        overrides: {
+                            type: 'object',
+                            properties: {},
+                            additionalProperties: true,
+                        },
                     },
-                    required: ['visibility', 'org'],
+                    additionalProperties: false,
+                    required: ['visibility', 'org', 'branchStrategy'],
                 },
             ],
         },
@@ -358390,6 +358570,12 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         orgName: {
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
@@ -358420,9 +358606,11 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     },
                                 },
                             },
+                            additionalProperties: false,
                             required: ['url', 'contentType', 'events', 'secretRef'],
                         },
                     },
+                    additionalProperties: false,
                     required: ['orgName', 'webhook'],
                 },
             ],
@@ -358626,6 +358814,9 @@ const GithubSchemas = [
                         name: {
                             type: 'string',
                         },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         source: {
                             type: 'string',
                             enum: ['remote', 'inline', 'Remote', 'Inline'],
@@ -358717,6 +358908,7 @@ const GithubSchemas = [
                             additionalProperties: false,
                         },
                     },
+                    additionalProperties: false,
                     required: ['values', 'context', 'source', 'name'],
                 },
             ],
@@ -358849,6 +359041,7 @@ const ArgoCDSchemas = [argocd_schema];
                     enum: ['SecretStore', 'ClusterSecretStore'],
                 },
             },
+            additionalProperties: false,
             required: ['name'],
         },
         ExternalSecretsSection: {
@@ -358884,6 +359077,9 @@ const ArgoCDSchemas = [argocd_schema];
                     template: { type: 'object' },
                     secretName: { type: 'string' },
                     refreshInterval: { type: 'string' },
+                    updatePolicy: { type: 'string' },
+                    deletionPolicy: { type: 'string' },
+                    conversionStrategy: { type: 'string' },
                     generator: {
                         type: 'object',
                         properties: {
@@ -358906,19 +359102,15 @@ const ArgoCDSchemas = [argocd_schema];
                                     'Grafana',
                                 ],
                             },
-                            apiVersion: {
-                                type: 'string',
-                            },
-                            conversionStrategy: {
-                                type: 'string',
-                            },
-                            outputKey: {
-                                type: 'string',
-                            },
+                            apiVersion: { type: 'string' },
+                            conversionStrategy: { type: 'string' },
+                            outputKey: { type: 'string' },
                         },
+                        additionalProperties: false,
                         required: ['name'],
                     },
                 },
+                additionalProperties: false,
                 required: ['secretName', 'generator'],
             },
         },
@@ -366185,6 +366377,8 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
 
 
 
+
+
 /*
  * Function called when rendering from the importer class.
  *
@@ -366198,6 +366392,17 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
  *
  */
 async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.catalog', crOutputDir = '/tmp/.resources') {
+    // Apply claim defaults (same as runRenderer path does via loadClaim/patchClaim)
+    try {
+        const defaults = loadClaimDefaults();
+        for (const renderClaim of Object.values(rClaims)) {
+            renderClaim.claim = loader_patchClaim(renderClaim.claim, defaults);
+            validateClaim(renderClaim.claim);
+        }
+    }
+    catch (e) {
+        cdk8s_renderer_src_logger.warn(`Could not apply claim defaults: ${e.message}`);
+    }
     // type: is the kind of the claim
     // value: is the imported-ref (the name in Github, can be with special characters, spaces, etc)
     const fSolver = (type, value) => {
@@ -366782,7 +366987,7 @@ class MemberGithubDecanter extends GithubDecanter {
         this.claim = {
             kind: this.claimKind,
             version: this.VERSION(),
-            name: this.data.memberDetails.login,
+            name: this.data.memberDetails.login.toLowerCase(),
             profile: {
                 displayName: this.data.memberDetails.login,
                 email: this.data.memberDetails.email
@@ -366839,10 +367044,26 @@ MemberCollectionGithubDecanter.collectionKind = 'gh-members';
 applyCollectionMixins(MemberCollectionGithubDecanter);
 /* harmony default export */ const github_member_collection = (MemberCollectionGithubDecanter);
 
+;// CONCATENATED MODULE: ../importer/src/utils/nomicon.ts
+function transformRepoName(repoName) {
+    // Convert to lowercase
+    let transformedName = repoName.toLowerCase();
+    const specialCharsRegex = /[._]/g;
+    if (specialCharsRegex.test(transformedName)) {
+        transformedName = transformedName.replace(/[._]/g, '');
+        // we add a random 2 letter suffix
+        return (transformedName + '-imp-' + Math.random().toString(36).substring(2, 4));
+    }
+    else {
+        return transformedName;
+    }
+}
+
 ;// CONCATENATED MODULE: ../importer/src/decanter/gh/github_repo.ts
 
 
 
+
 const TYPE_MAP = {
     User: 'user',
     Team: 'group',
@@ -366860,7 +367081,7 @@ class RepoGithubDecanter extends GithubDecanter {
             version: this.VERSION(),
             type: 'service',
             lifecycle: 'production',
-            name: this.data.repoDetails.name,
+            name: transformRepoName(this.data.repoDetails.name),
         };
     }
     __decantProviders() {
@@ -366922,7 +367143,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideMaintainers = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'maintain')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamMaintainers = this.data.teamsAndMembers.teams
             .filter((team) => team.role === 'maintain')
@@ -366947,7 +367168,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideAdmins = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'admin')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamAdmins = this.data.teamsAndMembers.teams
             .filter((team) => team.role === 'admin')
@@ -366956,13 +367177,6 @@ class RepoGithubDecanter extends GithubDecanter {
         });
         const admins = directAdmins.concat(outsideAdmins).concat(teamAdmins);
         const overrides = {};
-        if (admins && admins.length > 0) {
-            this.__patchClaim({
-                op: 'add',
-                value: admins[0],
-                path: '/owner',
-            });
-        }
         if (admins && admins.length > 1) {
             overrides['additionalAdmins'] = [];
             for (let i = 1; i < admins.length; i++) {
@@ -366982,7 +367196,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideWriters = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'push')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamWriters = this.data.teamsAndMembers.teams
             .filter((team) => ['push', 'write'].includes(team.role))
@@ -367006,7 +367220,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideReaders = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'pull')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamReaders = this.data.teamsAndMembers.teams
             .filter((team) => ['pull', 'read'].includes(team.role))
@@ -367689,6 +367903,25 @@ function definitions_getPluralFromKind(kind) {
     const plural = Object.keys(kindPluralMap).find((key) => kindPluralMap[key] === kind);
     return plural;
 }
+const DAY_SECONDS = 24 * 60 * 60;
+const TIMEOUTS = {
+    // expressed in seconds
+    RENAMED: DAY_SECONDS,
+    UPDATED: DAY_SECONDS,
+    CREATED: DAY_SECONDS,
+    RETRY: 120 * 60,
+    MARKED_TO_DELETION: DAY_SECONDS,
+    SYNC: DAY_SECONDS,
+    NOTHING: 10,
+};
+function getTimeoutForOperation(operation) {
+    if (operation in TIMEOUTS) {
+        return TIMEOUTS[operation];
+    }
+    else {
+        throw new Error(`getTimeoutForOperation: Unknown operation: ${operation}`);
+    }
+}
 
 ;// CONCATENATED MODULE: ../operator/src/pr-annotation.ts
 
@@ -369200,6 +369433,19 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
         itemPath: () => informer_itemPath(pluralKind, workItem.item),
         error: () => retryCtl.errorReconciling(informer_itemPath(pluralKind, workItem.item)),
         success: () => retryCtl.successReconciling(informer_itemPath(pluralKind, workItem.item)),
+        recommendedTimeout: () => {
+            const customTimeoutAnnotation = catalog_common.generic.getFirestartrAnnotation('test-custom-timeout');
+            let customTimeout = null;
+            if ('annotations' in workItem.item.metadata &&
+                customTimeoutAnnotation in workItem.item.metadata.annotations &&
+                !isNaN(parseInt(workItem.item.metadata.annotations[customTimeoutAnnotation]))) {
+                customTimeout = parseInt(workItem.item.metadata.annotations[customTimeoutAnnotation]);
+            }
+            else {
+                customTimeout = getTimeoutForOperation(workItem.operation);
+            }
+            return customTimeout;
+        },
         needsBlocking: (item, operation) => {
             if (kindsWithDependants.indexOf(item.kind) === -1) {
                 return false;
@@ -370052,16 +370298,6 @@ function getQueueMetrics() {
 //   "FirestartrGithubRepositoryFeature": 1,
 //   "FirestartrTerraformWorkspacePlan": 1,
 // }
-const TIMEOUTS = {
-    // expressed in seconds
-    RENAMED: 30 * 60,
-    UPDATED: 60 * 60,
-    CREATED: 60 * 60,
-    RETRY: 60 * 60,
-    MARKED_TO_DELETION: 60 * 60,
-    SYNC: 60 * 60,
-    NOTHING: 10,
-};
 let INIT = false;
 /**
  * Pushes a WorkItem to the queue
@@ -370099,27 +370335,12 @@ async function processItem_loop() {
         if (w) {
             const logMessage = `${new Date().toISOString()} : Processing OPERATION: ${w.operation} ITEM: ${w.item.kind}/${w.item.metadata.name}`;
             catalog_common.io.writeLogFile('process_item', logMessage);
-            const timeout = createTimeout(w);
             operator_src_logger.info(`The processor is currently handling a '${w.operation}' operation for item '${w.item.kind}/${w.item.metadata.name}' in namespace '${w.item.metadata.namespace}'. The current work status is '${w.workStatus}'.`);
             await runWorkItem(w);
-            clearTimeout(timeout);
         }
         await processItem_wait();
     }
 }
-/**
- * Creates a timeout for a workItem
- *
- *
- **/
-function createTimeout(w) {
-    return setTimeout(() => {
-        //throw new Error('Timeout on workitem ' + w);
-        console.error('Timeout on workitem %O', w);
-        operator_src_logger.error(`The processor timed out while handling a '${w.operation}' operation for item '${w.item.kind}/${w.item.metadata.name}' in namespace '${w.item.metadata.namespace}'. The current work status is '${w.workStatus}'.`);
-        process.exit(1);
-    }, TIMEOUTS[w.operation] * 1000);
-}
 /**
  * Sorts the queue based on the operation type
  * @param {WorkItem[]} queue - store of WorkItems
@@ -373108,11 +373329,82 @@ class TFPlanItemVersion extends TFPlanItem {
 
 /* harmony default export */ const terraform_provisioner_src_logger = (catalog_common.logger);
 
+;// CONCATENATED MODULE: ../terraform_provisioner/src/process_handler.ts
+
+const GRACE_PERIOD = 60 * 2; // 2 min
+const HARD_RESET_PERIOD = 10; // 10 sec
+function processHandler(processToHandle, ctl, onTimedOut) {
+    let gracefulResetId;
+    let hardResetId;
+    let callerNotified = false;
+    let timedOut = false;
+    const safeKill = (signal) => {
+        try {
+            const sent = processToHandle.kill(signal);
+            if (!sent) {
+                throw new Error(`Failed to send signal ${signal} to the process`);
+            }
+        }
+        catch (error) {
+            terraform_provisioner_src_logger.error(`FATAL: timeout signal ${signal} could not be delivered to the process: ${error}`);
+            if (!callerNotified) {
+                ctl.processKilled(false);
+                callerNotified = true;
+            }
+        }
+    };
+    const terminateId = setTimeout(() => {
+        // we take control of the process
+        onTimedOut();
+        timedOut = true;
+        // send sigInt
+        terraform_provisioner_src_logger.error(`Terraform process has not exited after initial timeout of ${ctl.hardTimeout} seconds, sending SIGINT...`);
+        safeKill('SIGINT');
+        // grace period
+        gracefulResetId = setTimeout(() => {
+            terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGINT grace period of ${GRACE_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD} seconds), sending SIGTERM...`);
+            safeKill('SIGTERM');
+            // hard reset period
+            hardResetId = setTimeout(() => {
+                terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGTERM hard reset period of ${HARD_RESET_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD + HARD_RESET_PERIOD} seconds), sending SIGKILL...`);
+                safeKill('SIGKILL');
+                setTimeout(() => {
+                    // we send if the process was killed or not to the caller
+                    if (!callerNotified) {
+                        ctl.processKilled(processToHandle.killed);
+                        callerNotified = true;
+                    }
+                }, 10 * 1000);
+            }, HARD_RESET_PERIOD * 1000);
+        }, GRACE_PERIOD * 1000);
+    }, ctl.hardTimeout * 1000);
+    processToHandle.on('exit', () => {
+        // the process has exited
+        // let's clear all the timeouts
+        if (terminateId) {
+            clearTimeout(terminateId);
+        }
+        if (gracefulResetId) {
+            clearTimeout(gracefulResetId);
+        }
+        if (hardResetId) {
+            clearTimeout(hardResetId);
+        }
+        // we inform the caller
+        // if the process exited and the timeout control has kicked-off
+        if (!callerNotified && timedOut) {
+            ctl.processKilled(true);
+            callerNotified = true;
+        }
+    });
+}
+
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/utils.ts
 
 
 
 
+
 async function utils_validate(path, secrets) {
     return await tfExec(path, ['validate'], secrets);
 }
@@ -373122,28 +373414,28 @@ async function init(path, secrets, stream) {
 async function initFromModule(path, source, secrets, stream) {
     return tfExec(path, ['init', `-from-module=${source}`], secrets, [], stream);
 }
-async function plan(path, secrets, format, args = ['plan'], stream) {
+async function plan(path, secrets, format, args = ['plan'], stream, ctl) {
     terraform_provisioner_src_logger.info(`Running terraform plan with ${format} in path ${path}`);
-    const plan = await tfExec(path, args.concat(format === 'json' ? ['-json'] : []), secrets, ['-input=false'], stream);
+    const plan = await tfExec(path, args.concat(format === 'json' ? ['-json'] : []), secrets, ['-input=false'], stream, ctl);
     if (format === 'json') {
         const tfPlan = planGet(plan);
         return tfPlan;
     }
     return plan;
 }
-async function apply(path, secrets, stream) {
+async function apply(path, secrets, stream, ctl) {
     terraform_provisioner_src_logger.debug(`Running terraform apply in path ${path}`);
-    return await tfExec(path, ['apply', '-auto-approve'], secrets, ['-input=false'], stream);
+    return await tfExec(path, ['apply', '-auto-approve'], secrets, ['-input=false'], stream, ctl);
 }
-async function destroy(path, secrets, stream) {
+async function destroy(path, secrets, stream, ctl) {
     terraform_provisioner_src_logger.debug(`Running terraform destroy in path ${path}`);
-    return await tfExec(path, ['destroy', '-auto-approve'], secrets, ['-input=false'], stream);
+    return await tfExec(path, ['destroy', '-auto-approve'], secrets, ['-input=false'], stream, ctl);
 }
 async function output(path, secrets) {
     terraform_provisioner_src_logger.debug(`Running terraform output in path ${path}`);
     return await tfExec(path, ['output', '-json'], secrets, []);
 }
-async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream) {
+async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream, ctl) {
     return new Promise((ok, ko) => {
         const tfProcess = (0,external_child_process_.spawn)('tofu', args.concat(extraArgs), {
             cwd: path,
@@ -373153,6 +373445,7 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
         let flagStdoutEnd = false;
         let flagStderrEnd = false;
         let outputErrors = '';
+        let processTimeout = false;
         tfProcess.stdout.on('data', (log) => {
             const line = catalog_common.io.stripAnsi(log.toString());
             output += line;
@@ -373173,12 +373466,21 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
         });
         tfProcess.on('exit', async (code) => {
             let retryCount = 0;
-            while ((!flagStdoutEnd && !flagStderrEnd) || retryCount < 10) {
+            while (!flagStdoutEnd && !flagStderrEnd && retryCount < 10) {
                 retryCount++;
                 await catalog_common.generic.sleep(500);
             }
+            // this process has been killed/terminated
+            // by timeout (not in our control)
+            if (processTimeout) {
+                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
+                ko(catalog_common.generic.buildCommandExecutionError([output, outputErrors, '\n<PROCESS TIMEOUT>'].join(''), catalog_common.generic.normalizeExitCode(code), args.concat(extraArgs), {
+                    errorName: 'TerraformCommandError',
+                    label: 'Terraform command',
+                }));
+                return;
+            }
             if (code !== 0) {
-                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${output + outputErrors}`);
                 terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
                 ko(catalog_common.generic.buildCommandExecutionError([output, outputErrors].join(''), catalog_common.generic.normalizeExitCode(code), args.concat(extraArgs), {
                     errorName: 'TerraformCommandError',
@@ -373190,6 +373492,13 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
                 ok(output);
             }
         });
+        if (ctl) {
+            void processHandler(tfProcess, ctl, () => {
+                // callback to be called by the process handler
+                // we set on our flag to avoid sending our own messages
+                processTimeout = true;
+            });
+        }
     });
 }
 async function configureGit(ghToken) {
@@ -373678,6 +373987,15 @@ class project_tf_TFProjectManager {
         }
         this.secrets = ctx.secrets;
     }
+    set ctl(ctl) {
+        this._ctl = ctl;
+    }
+    get ctl() {
+        return this._ctl;
+    }
+    getOutput() {
+        return this.tfOutput;
+    }
     setStreamCallbacks(fnData, fnEnd, reopen = true) {
         if (reopen || !this.stream)
             this.stream = new external_stream_.PassThrough();
@@ -373686,9 +374004,6 @@ class project_tf_TFProjectManager {
         });
         this.stream.on('end', fnEnd);
     }
-    getOutput() {
-        return this.tfOutput;
-    }
     async build() {
         await this.mainTfWriter.render();
         this.mainTfWriter.writeToTerraformProject(external_path_.join(this.projectPath, 'firestartr-main.tf'));
@@ -373715,7 +374030,7 @@ class project_tf_TFProjectManager {
         await this.__init();
         if (format === 'json')
             this.tfOutput = null;
-        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373723,17 +374038,17 @@ class project_tf_TFProjectManager {
         await this.__init();
         if (format === 'json')
             this.tfOutput = null;
-        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan', '-destroy'], this.stream);
+        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan', '-destroy'], this.stream, this.ctl);
     }
     async apply() {
         await this.__init();
-        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
     async destroy() {
         await this.__init();
-        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373845,6 +374160,12 @@ class TFProjectManagerRemote {
         }
         this.tfVarsJsonWriter = new WriterTfVarsJson(ctx.values, ctx.references);
     }
+    set ctl(ctl) {
+        this._ctl = ctl;
+    }
+    get ctl() {
+        return this._ctl;
+    }
     getOutput() {
         return this.tfOutput;
     }
@@ -373893,23 +374214,23 @@ insteadOf = https://github.com`);
     async plan(format) {
         await this.__init();
         if (format === 'json') {
-            this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+            this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         }
         else {
-            this.tfOutput += await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+            this.tfOutput += await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         }
         if (this.stream)
             this.stream.end();
     }
     async apply() {
         await this.__init();
-        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
     async destroy() {
         await this.__init();
-        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373958,7 +374279,7 @@ async function run() {
     await execCommand(command, tfProject);
 }
 // Programatic API
-async function runTerraformProvisioner(context, command = 'init', streaming) {
+async function runTerraformProvisioner(context, command = 'init', streaming, ctl) {
     terraform_provisioner_src_logger.info(`Running command ${command} on a ${context.type} project`);
     validateContext(context);
     let tfProject = {};
@@ -373971,6 +374292,9 @@ async function runTerraformProvisioner(context, command = 'init', streaming) {
     if (streaming) {
         tfProject.setStreamCallbacks(streaming.fnData, streaming.fnEnd);
     }
+    if (ctl) {
+        tfProject.ctl = ctl;
+    }
     const output = await execCommand(command, tfProject);
     return output;
 }
@@ -374215,7 +374539,17 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
         if (item.metadata.annotations['firestartr.dev/last-state-pr'] || false) {
             await addPlanStatusCheck(item.metadata.annotations['firestartr.dev/last-state-pr'], 'Terraform plan in progress...');
         }
-        const tfPlan = await runTerraformProvisioner(context, planType);
+        const tfPlan = await runTerraformProvisioner(context, planType, null, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         if (tfPlan.summary.hasChanges()) {
             yield {
                 item,
@@ -374502,7 +374836,17 @@ async function* process_operation_markedToDeletion(item, op, handler) {
         }
         const deps = await handler.resolveReferences();
         const context = buildProvisionerContext(item, deps);
-        const destroyOutput = await runTerraformProvisioner(context, 'destroy');
+        const destroyOutput = await runTerraformProvisioner(context, 'destroy', null, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         yield {
             item,
             reason: op,
@@ -374613,7 +374957,17 @@ async function* process_operation_doApply(item, op, handler) {
         const deps = await handler.resolveReferences();
         operator_src_logger.info(`The Terraform processor is applying and assessing dependencies for item '${item.kind}/${item.metadata.name}' with dependencies: '${deps}'.`);
         const context = buildProvisionerContext(item, deps);
-        const applyOutput = await runTerraformProvisioner(context, 'apply', checkRunCtl);
+        const applyOutput = await runTerraformProvisioner(context, 'apply', checkRunCtl, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         const terraformOutputJson = await runTerraformProvisioner(context, 'output');
         if (!terraformOutputJson) {
             throw new Error(`Terraform output is empty for ${item.kind}/${item.metadata.name}`);
@@ -376752,9 +377106,9 @@ const crs_analyzerSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"1.59.0-snapshot-15"}');
+const package_namespaceObject = JSON.parse('{"i8":"1.59.0-snapshot-17"}');
 ;// CONCATENATED MODULE: ../../package.json
-const package_namespaceObject_1 = {"i8":"1.58.0"};
+const package_namespaceObject_1 = {"i8":"1.59.3"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts