@microagi/alchemy-gcp 0.5.0 → 0.6.0

package/src/Container/NodePool.ts

@@ -113,8 +113,31 @@ export type NodePoolProps = {
       enableSecureBoot?: boolean;
       enableIntegrityMonitoring?: boolean;
     };
-    /** Local SSDs. **Replace-only**. */
+    /**
+     * Local SSDs via the legacy SCSI-era count field. Prefer
+     * `localNvmeSsdBlockConfig` / `ephemeralStorageLocalSsdConfig` for
+     * NVMe-only machine families (Gen3+, Titanium SSD). Mutually
+     * exclusive with both. **Replace-only**.
+     */
     localSsdCount?: number;
+    /**
+     * Raw-block local NVMe SSDs — exposed to workloads as unformatted
+     * block devices (local PVs / your own RAID). For machine types with
+     * a fixed disk count (e.g. g4-standard-48 → 4), `localSsdCount`
+     * must equal that count or be 0/unset for the machine default.
+     * **Replace-only**.
+     */
+    localNvmeSsdBlockConfig?: { localSsdCount?: number };
+    /**
+     * Local NVMe SSDs backing node ephemeral storage (emptyDir, image
+     * layers, logs) — GKE RAID0s the disks. Same fixed-count rule as
+     * `localNvmeSsdBlockConfig`. `dataCacheCount` carves disks out for
+     * GKE Data Cache. **Replace-only**.
+     */
+    ephemeralStorageLocalSsdConfig?: {
+      localSsdCount?: number;
+      dataCacheCount?: number;
+    };
     /** Workload Identity metadata. Mutable via `update`. */
     workloadMetadataConfig?: { mode: "GKE_METADATA" | "GCE_METADATA" };
     /** GVNIC. Mutable via `update`. */
@@ -261,6 +284,12 @@ export const toNodeConfigCreateBody = (
     ...(config.localSsdCount !== undefined
       ? { localSsdCount: config.localSsdCount }
       : {}),
+    ...(config.localNvmeSsdBlockConfig
+      ? { localNvmeSsdBlockConfig: config.localNvmeSsdBlockConfig }
+      : {}),
+    ...(config.ephemeralStorageLocalSsdConfig
+      ? { ephemeralStorageLocalSsdConfig: config.ephemeralStorageLocalSsdConfig }
+      : {}),
     ...(config.workloadMetadataConfig
       ? { workloadMetadataConfig: config.workloadMetadataConfig }
       : {}),
@@ -320,8 +349,23 @@ const toNodePoolUpdateBody = (
   if (nc.taints && !deepEqual(oc.taints ?? [], nc.taints)) {
     body.taints = { taints: nc.taints };
   }
-  if (!deepEqual(oc.resourceLabels ?? {}, desiredResourceLabels)) {
-    body.resourceLabels = { labels: desiredResourceLabels };
+  // GKE injects its own `goog-*` resource labels (accelerator type,
+  // provisioning model, …) after create. Treat them as server-managed:
+  // fold the observed ones into the desired set before diffing, or
+  // every reconcile issues a labels update — which on a large pool is
+  // a long rolling cluster operation that wedges all other mutations
+  // on the cluster ("incompatible operation").
+  const observedResourceLabels = oc.resourceLabels ?? {};
+  const desiredWithServerManaged = {
+    ...Object.fromEntries(
+      Object.entries(observedResourceLabels).filter(([k]) =>
+        k.startsWith("goog-"),
+      ),
+    ),
+    ...desiredResourceLabels,
+  };
+  if (!deepEqual(observedResourceLabels, desiredWithServerManaged)) {
+    body.resourceLabels = { labels: desiredWithServerManaged };
   }
 
   if (nc.gvnic && !deepEqual(oc.gvnic, nc.gvnic)) {
@@ -365,6 +409,7 @@ export const NodePoolProvider = () =>
     NodePool,
     Effect.gen(function* () {
       const getNodePools = yield* cont.getProjectsLocationsClustersNodePools;
+      const listNodePools = yield* cont.listProjectsLocationsClustersNodePools;
       const createNodePools = yield* cont.createProjectsLocationsClustersNodePools;
       const updateNodePools = yield* cont.updateProjectsLocationsClustersNodePools;
       const setSize = yield* cont.setSizeProjectsLocationsClustersNodePools;
@@ -500,7 +545,12 @@ export const NodePoolProvider = () =>
             !deepEqual(oc.metadata, nc.metadata) ||
             !deepEqual(oc.sandboxConfig, nc.sandboxConfig) ||
             !deepEqual(oc.reservationAffinity, nc.reservationAffinity) ||
-            !deepEqual(oc.shieldedInstanceConfig, nc.shieldedInstanceConfig)
+            !deepEqual(oc.shieldedInstanceConfig, nc.shieldedInstanceConfig) ||
+            !deepEqual(oc.localNvmeSsdBlockConfig, nc.localNvmeSsdBlockConfig) ||
+            !deepEqual(
+              oc.ephemeralStorageLocalSsdConfig,
+              nc.ephemeralStorageLocalSsdConfig,
+            )
           ) {
             return { action: "replace" } as const;
           }
@@ -596,15 +646,39 @@ export const NodePoolProvider = () =>
           const location = output?.location ?? olds?.location;
           const clusterName = output?.clusterName ?? olds?.clusterName;
           if (!project || !location || !clusterName) return undefined;
-          const name =
-            output?.name ??
-            olds?.name ??
-            (yield* createPhysicalName({ id, maxLength: 40 })).toLowerCase();
-          const fqName = `projects/${project}/locations/${location}/clusters/${clusterName}/nodePools/${name}`;
-          const observed = yield* getNodePools({ name: fqName }).pipe(
-            Effect.catchTag("NotFound", () => Effect.succeed(undefined as cont.NodePool | undefined)),
-            Effect.catchTag("Forbidden", () => Effect.succeed(undefined as cont.NodePool | undefined)),
-          );
+          const name = output?.name ?? olds?.name;
+          let observed: cont.NodePool | undefined;
+          if (name) {
+            const fqName = `projects/${project}/locations/${location}/clusters/${clusterName}/nodePools/${name}`;
+            observed = yield* getNodePools({ name: fqName }).pipe(
+              Effect.catchTag("NotFound", () => Effect.succeed(undefined as cont.NodePool | undefined)),
+              Effect.catchTag("Forbidden", () => Effect.succeed(undefined as cont.NodePool | undefined)),
+            );
+          } else {
+            // Cold recovery (lost state): the pool name truncates the
+            // logical id and appends a random per-instance suffix that
+            // lived only in state, so a probe against a freshly-generated
+            // name can never hit. Scan the cluster's pools for our
+            // alchemy labels (stamped into config.resourceLabels).
+            const page = yield* listNodePools({
+              parent: `projects/${project}/locations/${location}/clusters/${clusterName}`,
+            }).pipe(
+              Effect.catchTag("NotFound", () =>
+                Effect.succeed(undefined as cont.ListNodePoolsResponse | undefined),
+              ),
+              Effect.catchTag("Forbidden", () =>
+                Effect.succeed(undefined as cont.ListNodePoolsResponse | undefined),
+              ),
+            );
+            for (const candidate of page?.nodePools ?? []) {
+              if (
+                yield* hasAlchemyLabels(id, candidate.config?.resourceLabels)
+              ) {
+                observed = candidate;
+                break;
+              }
+            }
+          }
           if (!observed) return undefined;
           const attrs = toNodePoolAttributes(observed, {
             project,

package/src/Kubernetes/Secret.ts

@@ -0,0 +1,274 @@
+import { Credentials } from "@distilled.cloud/gcp";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type * as GCP from "../Providers.ts";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import {
+  applySecret,
+  deleteSecret,
+  getSecret,
+  KubernetesApiError,
+  type GkeConnection,
+  type SecretObject,
+} from "./client.ts";
+
+/**
+ * An Opaque Kubernetes Secret in a GKE cluster.
+ *
+ * Unlike the rest of the GCP provider (which calls typed
+ * `@distilled.cloud/gcp` operations), this resource talks directly to a
+ * GKE cluster's Kubernetes API server — alchemy's upstream Kubernetes
+ * provider is EKS-only. The control-plane connection (`endpoint` +
+ * `caCertificate`) comes from a {@link GCP.Cluster}'s attributes; the
+ * bearer token is minted from the provider's ADC {@link Credentials}.
+ *
+ * Ownership for adoption is gated on alchemy-internal `metadata.labels`
+ * (same triple as labelled GCP resources), so a Secret created out of
+ * band reads back as {@link Unowned} until adopted.
+ *
+ * @section Creating a Secret
+ * @example Wire a Cloudflare tunnel token into the cluster
+ * ```typescript
+ * // `tunnel.token` is a `Redacted<string>`; pass it straight through —
+ * // the value is unwrapped only at the moment it's written to the API,
+ * // and stays redacted in logs/plan output.
+ * yield* GCP.KubernetesSecret("CloudflaredTunnelSecret", {
+ *   endpoint: cluster.endpoint,
+ *   caCertificate: cluster.clusterCaCertificate,
+ *   namespace: "admin",
+ *   name: "cloudflared-tunnel",
+ *   stringData: { TUNNEL_TOKEN: tunnel.token },
+ * }).pipe(adopt(true)); // take over a secret previously applied by kubectl
+ * ```
+ */
+export type KubernetesSecretProps = {
+  /**
+   * GKE control-plane endpoint (IP or hostname, no scheme) — typically
+   * `cluster.endpoint`. Mutable (a cluster replace yields a new one).
+   */
+  endpoint: string;
+  /**
+   * Base64-encoded cluster CA certificate (PEM) — typically
+   * `cluster.clusterCaCertificate`. Mutable.
+   */
+  caCertificate: string;
+  /** Target namespace. Immutable — replace if changed. */
+  namespace: string;
+  /**
+   * Secret name. Defaults to `createPhysicalName({ id, lowercase: true,
+   * maxLength: 63 })`. Immutable — replace if changed.
+   */
+  name?: string;
+  /** Secret `type`. Default `"Opaque"`. Mutable. */
+  type?: string;
+  /**
+   * String data (written under `stringData`; UTF-8 values). Mutable.
+   *
+   * Values may be `Redacted<string>` (e.g. a resource's secret output
+   * like `tunnel.token`) — they are unwrapped only when written to the
+   * Kubernetes API and stay opaque in logs/plan output. Plain strings
+   * are accepted too.
+   *
+   * NOTE: the underlying values are persisted in alchemy stack state
+   * (the engine diffs on the real value) — protect the state backend.
+   */
+  stringData: Record<string, Redacted.Redacted<string> | string>;
+  /** Extra metadata labels (alchemy ownership labels merge on top). Mutable. */
+  labels?: Record<string, string>;
+};
+
+export type KubernetesSecretAttributes = {
+  /** Secret name. */
+  name: string;
+  /** Namespace. */
+  namespace: string;
+  /** Control-plane endpoint, threaded through for delete/read. */
+  endpoint: string;
+  /** Cluster CA certificate, threaded through for delete/read. */
+  caCertificate: string;
+  /** Secret type. */
+  type: string;
+  /** Server-assigned uid. */
+  uid: string | undefined;
+  /** Server-assigned resourceVersion at last apply. */
+  resourceVersion: string | undefined;
+};
+
+export type KubernetesSecret = Resource<
+  "GCP.KubernetesSecret",
+  KubernetesSecretProps,
+  KubernetesSecretAttributes,
+  never,
+  GCP.Providers
+>;
+export const KubernetesSecret = Resource<KubernetesSecret>(
+  "GCP.KubernetesSecret",
+);
+
+const toAttributes = (
+  s: SecretObject | undefined,
+  parent: {
+    name: string;
+    namespace: string;
+    endpoint: string;
+    caCertificate: string;
+    type: string;
+  },
+): KubernetesSecretAttributes => ({
+  name: s?.metadata?.name ?? parent.name,
+  namespace: s?.metadata?.namespace ?? parent.namespace,
+  endpoint: parent.endpoint,
+  caCertificate: parent.caCertificate,
+  type: s?.type ?? parent.type,
+  uid: s?.metadata?.uid,
+  resourceVersion: s?.metadata?.resourceVersion,
+});
+
+/** Mint a fresh GKE connection from props + ADC credentials. */
+const connect = Effect.fn("k8sSecret.connect")(function* (props: {
+  endpoint: string;
+  caCertificate: string;
+}) {
+  const { accessToken } = yield* yield* Credentials;
+  return {
+    endpoint: props.endpoint,
+    caCertificate: props.caCertificate,
+    token: Redacted.value(accessToken),
+  } satisfies GkeConnection;
+});
+
+const observe = (connection: GkeConnection, namespace: string, name: string) =>
+  getSecret(connection, namespace, name).pipe(
+    Effect.catchIf(
+      (e): e is KubernetesApiError =>
+        e instanceof KubernetesApiError && e.statusCode === 404,
+      () => Effect.succeed(undefined as SecretObject | undefined),
+    ),
+  );
+
+export const KubernetesSecretProvider = () =>
+  Provider.effect(
+    KubernetesSecret,
+    Effect.gen(function* () {
+      return {
+        // Attributes unchanged by an in-place update (so dependents can
+        // resolve them at plan time): identity (name/namespace), the
+        // server-assigned uid, and endpoint — which is a replace trigger,
+        // so it never changes on update. caCertificate is intentionally
+        // excluded: it can rotate on the same cluster.
+        stables: ["name", "namespace", "endpoint", "uid"],
+        diff: Effect.fn(function* ({ id, news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          const o = olds as KubernetesSecretProps;
+          // Compare the RESOLVED name and type (with their defaults
+          // applied), not the raw props — otherwise omitting `name` on one
+          // side and setting it to the generated physical name on the
+          // other (or the same for `type`/"Opaque") triggers a spurious
+          // replace.
+          const defaultName = (
+            yield* createPhysicalName({ id, maxLength: 63 })
+          ).toLowerCase();
+          const sameName = (o.name ?? defaultName) === (news.name ?? defaultName);
+          const sameType = (o.type ?? "Opaque") === (news.type ?? "Opaque");
+          // Replace (create new + delete old) rather than in-place SSA on:
+          // - `endpoint`: points at a different cluster (would orphan the
+          //   old Secret). caCertificate is excluded — it can rotate on
+          //   the same cluster and should just re-apply.
+          // - `namespace`/`name`: the object's identity.
+          // - `type`: immutable on a Kubernetes Secret; an in-place apply
+          //   with a new type is rejected by the API.
+          if (
+            !sameName ||
+            !sameType ||
+            somePropsAreDifferent(o, news, ["namespace", "endpoint"])
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news }) {
+          const desiredName =
+            news.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const desiredType = news.type ?? "Opaque";
+          const labels = {
+            ...(news.labels ?? {}),
+            ...(yield* gcpInternalLabels(id)),
+          };
+          const connection = yield* connect(news);
+
+          // Unwrap any Redacted values at the last moment — Redacted is
+          // kept opaque through Output resolution, so it arrives here as
+          // a Redacted object that would JSON-serialize to "<redacted>"
+          // if passed through verbatim — then base64-encode for `data`.
+          const data: Record<string, string> = {};
+          for (const [k, v] of Object.entries(news.stringData)) {
+            const raw = Redacted.isRedacted(v) ? Redacted.value(v) : v;
+            data[k] = Buffer.from(raw, "utf8").toString("base64");
+          }
+
+          // Server-side apply is an idempotent upsert — it both creates
+          // the Secret if missing and converges its data/labels if it
+          // exists, taking field-manager ownership (force=true).
+          const applied = yield* applySecret(connection, {
+            metadata: { name: desiredName, namespace: news.namespace, labels },
+            type: desiredType,
+            data,
+          });
+
+          // A 2xx apply normally echoes the object, but a successful
+          // empty-body response is possible — re-read so we always return
+          // real attributes (uid/resourceVersion) rather than crash. Use
+          // getSecret (NOT observe): if the Secret is somehow absent after
+          // a successful apply, propagate the 404 and fail the reconcile
+          // instead of recording an empty success.
+          const final = applied?.metadata
+            ? applied
+            : yield* getSecret(connection, news.namespace, desiredName);
+
+          return toAttributes(final, {
+            name: desiredName,
+            namespace: news.namespace,
+            endpoint: news.endpoint,
+            caCertificate: news.caCertificate,
+            type: desiredType,
+          });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const connection = yield* connect(output);
+          yield* deleteSecret(connection, output.namespace, output.name);
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const endpoint = output?.endpoint ?? olds?.endpoint;
+          const caCertificate = output?.caCertificate ?? olds?.caCertificate;
+          const namespace = output?.namespace ?? olds?.namespace;
+          if (!endpoint || !caCertificate || !namespace) return undefined;
+          const name =
+            output?.name ??
+            olds?.name ??
+            (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
+          const type = output?.type ?? olds?.type ?? "Opaque";
+
+          const connection = yield* connect({ endpoint, caCertificate });
+          const observed = yield* observe(connection, namespace, name);
+          if (!observed) return undefined;
+
+          const attrs = toAttributes(observed, {
+            name,
+            namespace,
+            endpoint,
+            caCertificate,
+            type,
+          });
+          return (yield* hasAlchemyLabels(id, observed.metadata?.labels))
+            ? attrs
+            : Unowned(attrs);
+        }),
+      };
+    }),
+  );

package/src/Kubernetes/client.ts

@@ -0,0 +1,219 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as https from "node:https";
+
+/**
+ * Minimal GKE Kubernetes REST client.
+ *
+ * Talks to a GKE cluster's control plane over HTTPS using:
+ * - a Google OAuth bearer token (cloud-platform scope), minted from the
+ *   provider's ADC {@link Credentials}, and
+ * - the cluster's own CA certificate for TLS verification.
+ *
+ * `node:https` is used deliberately here (rather than the Effect
+ * `HttpClient`): the GKE API server presents a certificate signed by the
+ * *per-cluster* CA — not a public root — so the request must trust an
+ * explicit, runtime-resolved `ca` PEM. This is the same justified TLS
+ * exception alchemy makes in its own (EKS-only) Kubernetes client. Calls
+ * are wrapped in `Effect.tryPromise` so failures surface as typed errors
+ * in the Effect runtime; a socket timeout bounds hung requests. (Effect
+ * interruption won't abort an in-flight socket — the timeout is what
+ * guarantees a deploy can't block forever.)
+ */
+const REQUEST_TIMEOUT_MS = 30_000;
+
+/** Connection details for a single GKE control plane. */
+export interface GkeConnection {
+  /** Master endpoint — IP or hostname, no scheme (e.g. `34.1.2.3`). */
+  endpoint: string;
+  /** Base64-encoded cluster CA certificate (PEM), as GKE returns it. */
+  caCertificate: string;
+  /** Google OAuth access token (cloud-platform scope) for `Authorization`. */
+  token: string;
+}
+
+/** A non-2xx (or transport) response from the Kubernetes API server. */
+export class KubernetesApiError extends Data.TaggedError(
+  "KubernetesApiError",
+)<{
+  method: string;
+  path: string;
+  statusCode: number;
+  body: string;
+}> {}
+
+const requestJson = Effect.fn("k8s.requestJson")(function* ({
+  connection,
+  method,
+  path,
+  body,
+  contentType,
+}: {
+  connection: GkeConnection;
+  method: string;
+  path: string;
+  body?: Record<string, unknown>;
+  contentType?: string;
+}) {
+  const url = new URL(path, `https://${connection.endpoint}`);
+  const payload = body ? JSON.stringify(body) : undefined;
+  const ca = Buffer.from(connection.caCertificate, "base64").toString("utf8");
+
+  return yield* Effect.tryPromise({
+    try: () =>
+      new Promise<unknown>((resolve, reject) => {
+        const request = https.request(
+          {
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: `${url.pathname}${url.search}`,
+            method,
+            headers: {
+              Authorization: `Bearer ${connection.token}`,
+              Accept: "application/json",
+              ...(payload
+                ? {
+                    "Content-Type":
+                      contentType ?? "application/json",
+                    "Content-Length": Buffer.byteLength(payload),
+                  }
+                : {}),
+            },
+            ca,
+            timeout: REQUEST_TIMEOUT_MS,
+          },
+          (response) => {
+            const chunks: Buffer[] = [];
+            response.on("data", (chunk) => {
+              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            response.on("end", () => {
+              const responseBody = Buffer.concat(chunks).toString("utf8");
+              const statusCode = response.statusCode ?? 500;
+
+              if (statusCode < 200 || statusCode >= 300) {
+                reject(
+                  new KubernetesApiError({
+                    method,
+                    path,
+                    statusCode,
+                    body: responseBody,
+                  }),
+                );
+                return;
+              }
+
+              if (!responseBody.trim()) {
+                resolve(undefined);
+                return;
+              }
+
+              try {
+                resolve(JSON.parse(responseBody));
+              } catch {
+                resolve(responseBody);
+              }
+            });
+          },
+        );
+
+        request.on("error", reject);
+        // `timeout` only fires the event — we must destroy the socket
+        // ourselves so the promise rejects instead of hanging.
+        request.on("timeout", () =>
+          request.destroy(
+            new KubernetesApiError({
+              method,
+              path,
+              statusCode: 0,
+              body: `request timed out after ${REQUEST_TIMEOUT_MS}ms`,
+            }),
+          ),
+        );
+        if (payload) request.write(payload);
+        request.end();
+      }),
+    catch: (error) =>
+      error instanceof KubernetesApiError
+        ? error
+        : new KubernetesApiError({
+            method,
+            path,
+            statusCode: 0,
+            body: error instanceof Error ? error.message : String(error),
+          }),
+  });
+});
+
+/** Live view of a Kubernetes Secret object (subset we care about). */
+export interface SecretObject {
+  apiVersion?: string;
+  kind?: string;
+  metadata?: {
+    name?: string;
+    namespace?: string;
+    uid?: string;
+    resourceVersion?: string;
+    labels?: Record<string, string>;
+  };
+  type?: string;
+}
+
+const secretPath = (namespace: string, name: string) =>
+  `/api/v1/namespaces/${namespace}/secrets/${name}`;
+
+/** GET a Secret; the caller maps `KubernetesApiError(404)` to "missing". */
+export const getSecret = (
+  connection: GkeConnection,
+  namespace: string,
+  name: string,
+) =>
+  requestJson({
+    connection,
+    method: "GET",
+    path: secretPath(namespace, name),
+  }) as Effect.Effect<SecretObject, KubernetesApiError>;
+
+/**
+ * Server-side apply a Secret (idempotent create-or-update). `force=true`
+ * makes alchemy the field manager even if another manager owns fields.
+ *
+ * Values go through `data` (base64), NOT `stringData`: server-side apply
+ * tracks the field manager's ownership of `data` keys, so dropping a key
+ * from a later apply prunes it from the stored Secret. `stringData` is
+ * write-only/ephemeral and isn't tracked, which would leave stale keys.
+ */
+export const applySecret = (
+  connection: GkeConnection,
+  secret: {
+    metadata: { name: string; namespace: string; labels?: Record<string, string> };
+    type: string;
+    data: Record<string, string>;
+  },
+) =>
+  requestJson({
+    connection,
+    method: "PATCH",
+    path: `${secretPath(secret.metadata.namespace, secret.metadata.name)}?fieldManager=alchemy&force=true`,
+    contentType: "application/apply-patch+yaml",
+    body: { apiVersion: "v1", kind: "Secret", ...secret },
+  }) as Effect.Effect<SecretObject | undefined, KubernetesApiError>;
+
+/** DELETE a Secret; 404 is tolerated as success (idempotent teardown). */
+export const deleteSecret = (
+  connection: GkeConnection,
+  namespace: string,
+  name: string,
+) =>
+  requestJson({
+    connection,
+    method: "DELETE",
+    path: secretPath(namespace, name),
+  }).pipe(
+    Effect.catchIf(
+      (e): e is KubernetesApiError =>
+        e instanceof KubernetesApiError && e.statusCode === 404,
+      () => Effect.void,
+    ),
+  );

package/src/Kubernetes/index.ts

@@ -0,0 +1 @@
+export * from "./Secret.ts";