kubernetes-fluent-client 3.0.5 → 3.1.1

package/dist/upstream.js

@@ -0,0 +1,56 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Kubernetes Fluent Client Authors
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenericKind = exports.Endpoint = exports.VolumeAttachment = exports.ValidatingWebhookConfiguration = exports.TokenReview = exports.SubjectAccessReview = exports.StorageClass = exports.StatefulSet = exports.ServiceAccount = exports.Service = exports.SelfSubjectRulesReview = exports.SelfSubjectAccessReview = exports.Secret = exports.RuntimeClass = exports.RoleBinding = exports.Role = exports.ResourceQuota = exports.ReplicationController = exports.ReplicaSet = exports.PodTemplate = exports.PodDisruptionBudget = exports.Pod = exports.PersistentVolumeClaim = exports.PersistentVolume = exports.Node = exports.NetworkPolicy = exports.Namespace = exports.MutatingWebhookConfiguration = exports.LocalSubjectAccessReview = exports.LimitRange = exports.Job = exports.IngressClass = exports.Ingress = exports.HorizontalPodAutoscaler = exports.EndpointSlice = exports.Deployment = exports.DaemonSet = exports.CustomResourceDefinition = exports.CSIDriver = exports.CronJob = exports.ControllerRevision = exports.ConfigMap = exports.ClusterRoleBinding = exports.ClusterRole = exports.CertificateSigningRequest = exports.APIService = exports.Event = exports.CoreEvent = void 0;
+/** a is a collection of K8s types to be used within an action: `When(a.Configmap)` */
+var client_node_1 = require("@kubernetes/client-node");
+Object.defineProperty(exports, "CoreEvent", { enumerable: true, get: function () { return client_node_1.CoreV1Event; } });
+Object.defineProperty(exports, "Event", { enumerable: true, get: function () { return client_node_1.EventsV1Event; } });
+Object.defineProperty(exports, "APIService", { enumerable: true, get: function () { return client_node_1.V1APIService; } });
+Object.defineProperty(exports, "CertificateSigningRequest", { enumerable: true, get: function () { return client_node_1.V1CertificateSigningRequest; } });
+Object.defineProperty(exports, "ClusterRole", { enumerable: true, get: function () { return client_node_1.V1ClusterRole; } });
+Object.defineProperty(exports, "ClusterRoleBinding", { enumerable: true, get: function () { return client_node_1.V1ClusterRoleBinding; } });
+Object.defineProperty(exports, "ConfigMap", { enumerable: true, get: function () { return client_node_1.V1ConfigMap; } });
+Object.defineProperty(exports, "ControllerRevision", { enumerable: true, get: function () { return client_node_1.V1ControllerRevision; } });
+Object.defineProperty(exports, "CronJob", { enumerable: true, get: function () { return client_node_1.V1CronJob; } });
+Object.defineProperty(exports, "CSIDriver", { enumerable: true, get: function () { return client_node_1.V1CSIDriver; } });
+Object.defineProperty(exports, "CustomResourceDefinition", { enumerable: true, get: function () { return client_node_1.V1CustomResourceDefinition; } });
+Object.defineProperty(exports, "DaemonSet", { enumerable: true, get: function () { return client_node_1.V1DaemonSet; } });
+Object.defineProperty(exports, "Deployment", { enumerable: true, get: function () { return client_node_1.V1Deployment; } });
+Object.defineProperty(exports, "EndpointSlice", { enumerable: true, get: function () { return client_node_1.V1EndpointSlice; } });
+Object.defineProperty(exports, "HorizontalPodAutoscaler", { enumerable: true, get: function () { return client_node_1.V1HorizontalPodAutoscaler; } });
+Object.defineProperty(exports, "Ingress", { enumerable: true, get: function () { return client_node_1.V1Ingress; } });
+Object.defineProperty(exports, "IngressClass", { enumerable: true, get: function () { return client_node_1.V1IngressClass; } });
+Object.defineProperty(exports, "Job", { enumerable: true, get: function () { return client_node_1.V1Job; } });
+Object.defineProperty(exports, "LimitRange", { enumerable: true, get: function () { return client_node_1.V1LimitRange; } });
+Object.defineProperty(exports, "LocalSubjectAccessReview", { enumerable: true, get: function () { return client_node_1.V1LocalSubjectAccessReview; } });
+Object.defineProperty(exports, "MutatingWebhookConfiguration", { enumerable: true, get: function () { return client_node_1.V1MutatingWebhookConfiguration; } });
+Object.defineProperty(exports, "Namespace", { enumerable: true, get: function () { return client_node_1.V1Namespace; } });
+Object.defineProperty(exports, "NetworkPolicy", { enumerable: true, get: function () { return client_node_1.V1NetworkPolicy; } });
+Object.defineProperty(exports, "Node", { enumerable: true, get: function () { return client_node_1.V1Node; } });
+Object.defineProperty(exports, "PersistentVolume", { enumerable: true, get: function () { return client_node_1.V1PersistentVolume; } });
+Object.defineProperty(exports, "PersistentVolumeClaim", { enumerable: true, get: function () { return client_node_1.V1PersistentVolumeClaim; } });
+Object.defineProperty(exports, "Pod", { enumerable: true, get: function () { return client_node_1.V1Pod; } });
+Object.defineProperty(exports, "PodDisruptionBudget", { enumerable: true, get: function () { return client_node_1.V1PodDisruptionBudget; } });
+Object.defineProperty(exports, "PodTemplate", { enumerable: true, get: function () { return client_node_1.V1PodTemplate; } });
+Object.defineProperty(exports, "ReplicaSet", { enumerable: true, get: function () { return client_node_1.V1ReplicaSet; } });
+Object.defineProperty(exports, "ReplicationController", { enumerable: true, get: function () { return client_node_1.V1ReplicationController; } });
+Object.defineProperty(exports, "ResourceQuota", { enumerable: true, get: function () { return client_node_1.V1ResourceQuota; } });
+Object.defineProperty(exports, "Role", { enumerable: true, get: function () { return client_node_1.V1Role; } });
+Object.defineProperty(exports, "RoleBinding", { enumerable: true, get: function () { return client_node_1.V1RoleBinding; } });
+Object.defineProperty(exports, "RuntimeClass", { enumerable: true, get: function () { return client_node_1.V1RuntimeClass; } });
+Object.defineProperty(exports, "Secret", { enumerable: true, get: function () { return client_node_1.V1Secret; } });
+Object.defineProperty(exports, "SelfSubjectAccessReview", { enumerable: true, get: function () { return client_node_1.V1SelfSubjectAccessReview; } });
+Object.defineProperty(exports, "SelfSubjectRulesReview", { enumerable: true, get: function () { return client_node_1.V1SelfSubjectRulesReview; } });
+Object.defineProperty(exports, "Service", { enumerable: true, get: function () { return client_node_1.V1Service; } });
+Object.defineProperty(exports, "ServiceAccount", { enumerable: true, get: function () { return client_node_1.V1ServiceAccount; } });
+Object.defineProperty(exports, "StatefulSet", { enumerable: true, get: function () { return client_node_1.V1StatefulSet; } });
+Object.defineProperty(exports, "StorageClass", { enumerable: true, get: function () { return client_node_1.V1StorageClass; } });
+Object.defineProperty(exports, "SubjectAccessReview", { enumerable: true, get: function () { return client_node_1.V1SubjectAccessReview; } });
+Object.defineProperty(exports, "TokenReview", { enumerable: true, get: function () { return client_node_1.V1TokenReview; } });
+Object.defineProperty(exports, "ValidatingWebhookConfiguration", { enumerable: true, get: function () { return client_node_1.V1ValidatingWebhookConfiguration; } });
+Object.defineProperty(exports, "VolumeAttachment", { enumerable: true, get: function () { return client_node_1.V1VolumeAttachment; } });
+Object.defineProperty(exports, "Endpoint", { enumerable: true, get: function () { return client_node_1.V1Endpoint; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "GenericKind", { enumerable: true, get: function () { return types_1.GenericKind; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kubernetes-fluent-client",
-  "version": "3.0.5",
+  "version": "3.1.1",
   "description": "A @kubernetes/client-node fluent API wrapper that leverages K8s Server Side Apply.",
   "bin": "./dist/cli.js",
   "main": "dist/index.js",

package/src/fluent/http2-watch.spec.ts

@@ -0,0 +1,335 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { afterEach, beforeEach, describe, expect, it, jest } from "@jest/globals";
+import http2 from "http2";
+import { Watcher } from "./watch";
+import { WatchEvent, kind } from "..";
+import { WatchPhase } from "./types";
+import { K8s } from ".";
+
+jest.mock("http2");
+
+describe("Watcher HTTP2", () => {
+  let watcher: Watcher<typeof kind.Pod>;
+  let mockClient: jest.Mocked<http2.ClientHttp2Session>;
+  let mockReq: jest.Mocked<http2.ClientHttp2Stream>;
+  const evtMock = jest.fn<(update: kind.Pod, phase: WatchPhase) => void>();
+  const errMock = jest.fn<(err: Error) => void>();
+
+  const setupAndStartWatcher = (eventType: WatchEvent, handler: (...args: any[]) => void) => {
+    watcher.events.on(eventType, handler);
+    watcher.start().catch(errMock);
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    // http2.client
+    mockClient = {
+      request: jest.fn(),
+      close: jest.fn(),
+      on: jest.fn(),
+      destroy: jest.fn(),
+    } as unknown as jest.Mocked<http2.ClientHttp2Session>;
+
+    // http2.request stream
+    mockReq = {
+      on: jest.fn(),
+      end: jest.fn(),
+      setEncoding: jest.fn(),
+    } as unknown as jest.Mocked<http2.ClientHttp2Stream>;
+
+    // http2.connect function to return the mocked client session
+    (http2.connect as jest.Mock).mockReturnValue(mockClient);
+  });
+
+  afterEach(() => {
+    watcher.close();
+  });
+
+  it("should watch named resources", done => {
+    const pod = createMockPod("pod-1", "1");
+    const response = { type: "ADDED", object: pod };
+
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+    });
+
+    mockReq.on.mockImplementation((event, callback) => {
+      switch (event) {
+        case "response":
+          callback(
+            { ":status": 200 } as http2.IncomingHttpHeaders & http2.IncomingHttpStatusHeader,
+            0,
+          );
+          break;
+        case "data":
+          setTimeout(() => {
+            (callback as (chunk: Buffer) => void)(Buffer.from(JSON.stringify(response)));
+          }, 10);
+          break;
+        case "end":
+          setTimeout(() => {
+            (callback as () => void)();
+            done();
+          }, 20);
+          break;
+        case "error":
+          errMock(new Error("HTTP2 connection error"));
+          break;
+      }
+      return mockReq;
+    });
+
+    mockClient.request.mockReturnValue(mockReq);
+
+    setupAndStartWatcher(WatchEvent.CONNECT, () => {
+      setupAndStartWatcher(WatchEvent.DATA, (receivedPod, phase) => {
+        expect(receivedPod.metadata?.name).toBe("pod-1");
+        expect(receivedPod.metadata?.resourceVersion).toBe("1");
+        expect(phase).toBe(WatchPhase.Added);
+        done();
+      });
+    });
+  });
+
+  it("should handle resource version is too old", done => {
+    const errorResponse = {
+      type: "ERROR",
+      object: {
+        kind: "Status",
+        apiVersion: "v1",
+        metadata: {},
+        status: "Failure",
+        message: "too old resource version: 123 (391079)",
+        reason: "Gone",
+        code: 410,
+      },
+    };
+
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+    });
+
+    mockReq.on.mockImplementation((event, callback) => {
+      switch (event) {
+        case "response":
+          callback(
+            { ":status": 200 } as http2.IncomingHttpHeaders & http2.IncomingHttpStatusHeader,
+            0,
+          );
+          break;
+        case "data":
+          setTimeout(() => {
+            (callback as (chunk: Buffer) => void)(Buffer.from(JSON.stringify(errorResponse)));
+          }, 10);
+          break;
+        case "end":
+          setTimeout(() => {
+            (callback as () => void)();
+            done();
+          }, 20);
+          break;
+        case "error":
+          errMock(new Error("HTTP2 connection error"));
+          break;
+      }
+      return mockReq;
+    });
+
+    mockClient.request.mockReturnValue(mockReq);
+
+    setupAndStartWatcher(WatchEvent.OLD_RESOURCE_VERSION, res => {
+      expect(res).toEqual("123");
+      done();
+    });
+  });
+
+  it("should call the event handler for each event", done => {
+    const pod = createMockPod("pod-0", "1");
+    const response = { type: "ADDED", object: pod };
+
+    watcher = K8s(kind.Pod).Watch(
+      (evt, phase) => {
+        expect(evt.metadata?.name).toEqual("pod-0");
+        expect(phase).toEqual(WatchPhase.Added);
+      },
+      { useHTTP2: true },
+    );
+
+    mockReq.on.mockImplementation((event, callback) => {
+      switch (event) {
+        case "response":
+          callback(
+            { ":status": 200 } as http2.IncomingHttpHeaders & http2.IncomingHttpStatusHeader,
+            0,
+          );
+          break;
+        case "data":
+          setTimeout(() => {
+            (callback as (chunk: Buffer) => void)(Buffer.from(JSON.stringify(response)));
+          }, 10);
+          break;
+        case "end":
+          setTimeout(() => {
+            (callback as () => void)();
+          }, 20);
+          break;
+        case "error":
+          errMock(new Error("HTTP2 connection error"));
+          break;
+      }
+      return mockReq;
+    });
+
+    mockClient.request.mockReturnValue(mockReq);
+
+    watcher.start().catch(errMock);
+    done();
+  });
+
+  it("should return the cache id", () => {
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      resyncDelaySec: 1,
+      useHTTP2: true,
+    });
+    expect(watcher.getCacheID()).toEqual("d69b75a611");
+  });
+
+  it("should handle the CONNECT event", done => {
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      resyncDelaySec: 1,
+      useHTTP2: true,
+    });
+    setupAndStartWatcher(WatchEvent.CONNECT, () => {});
+    done();
+  });
+
+  it("should handle the DATA event", done => {
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      resyncDelaySec: 1,
+      useHTTP2: true,
+    });
+    setupAndStartWatcher(WatchEvent.DATA, (pod, phase) => {
+      expect(pod.metadata?.name).toEqual("pod-0");
+      expect(phase).toEqual(WatchPhase.Added);
+    });
+    done();
+  });
+
+  it("should handle the NETWORK_ERROR event", done => {
+    const errorMessage = "Something bad happened";
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+      resyncDelaySec: 1,
+    });
+
+    mockReq.on.mockImplementation((event, callback) => {
+      if (event === "response") {
+        callback(
+          { ":status": 200 } as http2.IncomingHttpHeaders & http2.IncomingHttpStatusHeader,
+          0,
+        );
+      } else if (event === "error") {
+        (callback as (err: Error) => void)(new Error(errorMessage));
+      }
+      return mockReq;
+    });
+
+    mockClient.request.mockReturnValue(mockReq);
+
+    setupAndStartWatcher(WatchEvent.NETWORK_ERROR, error => {
+      expect(error.message).toEqual(errorMessage);
+    });
+
+    watcher.start().catch(errMock);
+    done();
+  });
+
+  it("should handle the RECONNECT event on an error", done => {
+    const errorMessage = "Something bad happened";
+
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+      resyncDelaySec: 0.01,
+    });
+
+    let reconnectCount = 0;
+
+    mockReq.on.mockImplementation((event, callback) => {
+      if (event === "response") {
+        callback(
+          { ":status": 200 } as http2.IncomingHttpHeaders & http2.IncomingHttpStatusHeader,
+          0,
+        );
+      } else if (event === "error") {
+        reconnectCount += 1;
+        (callback as (err: Error) => void)(new Error(errorMessage));
+      }
+      return mockReq;
+    });
+
+    mockClient.request.mockReturnValue(mockReq);
+
+    setupAndStartWatcher(WatchEvent.RECONNECT, count => {
+      expect(count).toEqual(reconnectCount);
+    });
+
+    watcher.start().catch(errMock);
+    done();
+  });
+  it("should perform a resync after the resync interval", done => {
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+      resyncDelaySec: 1,
+    });
+    watcher.start().catch(errMock);
+    done();
+  });
+  it("should handle the GIVE_UP event", done => {
+    watcher = K8s(kind.Pod).Watch(evtMock, {
+      useHTTP2: true,
+      lastSeenLimitSeconds: 0.01,
+      resyncDelaySec: 0.01,
+      resyncFailureMax: 1,
+    });
+    setupAndStartWatcher(WatchEvent.GIVE_UP, () => {
+      expect(errMock).toBeCalled();
+    });
+    watcher.start().catch(errMock);
+    done();
+  });
+});
+
+/**
+ * Creates a mock pod object
+ *
+ * @param name The name of the pod
+ * @param resourceVersion The resource version of the pod
+ * @returns A mock pod object
+ */
+function createMockPod(name: string, resourceVersion: string): kind.Pod {
+  return {
+    kind: "Pod",
+    apiVersion: "v1",
+    metadata: {
+      name,
+      resourceVersion,
+      uid: "abc-123-xyz",
+    },
+    spec: {
+      containers: [
+        {
+          name: "nginx",
+          image: "nginx:1.14.2",
+          ports: [
+            {
+              containerPort: 80,
+              protocol: "TCP",
+            },
+          ],
+        },
+      ],
+    },
+    status: {},
+  };
+}

package/src/fluent/watch.ts

@@ -4,12 +4,14 @@
 import byline from "byline";
 import { createHash } from "crypto";
 import { EventEmitter } from "events";
+import https from "https";
+import http2 from "http2";
 import fetch from "node-fetch";
-
 import { fetch as wrappedFetch } from "../fetch";
 import { GenericClass, KubernetesListObject } from "../types";
 import { Filters, WatchAction, WatchPhase } from "./types";
 import { k8sCfg, pathBuilder } from "./utils";
+import fs from "fs";
 
 export enum WatchEvent {
   /** Watch is connected successfully */
@@ -52,6 +54,8 @@ export type WatchCfg = {
   relistIntervalSec?: number;
   /** Max amount of seconds to go without receiving an event before reconciliation starts. Defaults to 300 (5 minutes). */
   lastSeenLimitSeconds?: number;
+  /** Use http2 for the Watch */
+  useHTTP2?: boolean;
 };
 
 const NONE = 50;
@@ -65,6 +69,7 @@ export class Watcher<T extends GenericClass> {
   #callback: WatchAction<T>;
   #watchCfg: WatchCfg;
   #latestRelistWindow: string = "";
+  #useHTTP2: boolean = false;
 
   // Track the last time data was received
   #lastSeenTime = NONE;
@@ -97,6 +102,8 @@ export class Watcher<T extends GenericClass> {
   // Track the list of items in the cache
   #cache = new Map<string, InstanceType<T>>();
 
+  // Token Path
+  #TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
   /**
    * Setup a Kubernetes watcher for the specified model and filters. The callback function will be called for each event received.
    * The watch can be aborted by calling {@link Watcher.close} or by calling abort() on the AbortController returned by {@link Watcher.start}.
@@ -125,6 +132,9 @@ export class Watcher<T extends GenericClass> {
     // Set the latest relist interval to now
     this.#latestRelistWindow = new Date().toISOString();
 
+    // Set the latest relist interval to now
+    this.#useHTTP2 = watchCfg.useHTTP2 ?? false;
+
     // Add random jitter to the relist/resync intervals (up to 1 second)
     const jitter = Math.floor(Math.random() * 1000);
 
@@ -158,7 +168,11 @@ export class Watcher<T extends GenericClass> {
    */
   public async start(): Promise<AbortController> {
     this.#events.emit(WatchEvent.INIT_CACHE_MISS, this.#latestRelistWindow);
-    await this.#watch();
+    if (this.#useHTTP2) {
+      await this.#http2Watch();
+    } else {
+      await this.#watch();
+    }
     return this.#abortController;
   }
 
@@ -198,6 +212,19 @@ export class Watcher<T extends GenericClass> {
     return this.#events;
   }
 
+  /**
+   * Read the serviceAccount Token
+   *
+   * @returns token or null
+   */
+  async #getToken() {
+    try {
+      return (await fs.promises.readFile(this.#TOKEN_PATH, "utf8")).trim();
+    } catch {
+      return null;
+    }
+  }
+
   /**
    * Build the URL and request options for the watch.
    *
@@ -351,6 +378,42 @@ export class Watcher<T extends GenericClass> {
     }
   };
 
+  // process a line from the chunk
+  #processLine = async (
+    line: string,
+    process: (payload: InstanceType<T>, phase: WatchPhase) => Promise<void>,
+  ) => {
+    try {
+      // Parse the event payload
+      const { object: payload, type: phase } = JSON.parse(line) as {
+        type: WatchPhase;
+        object: InstanceType<T>;
+      };
+
+      // Update the last seen time
+      this.#lastSeenTime = Date.now();
+
+      // If the watch is too old, remove the resourceVersion and reload the watch
+      if (phase === WatchPhase.Error && payload.code === 410) {
+        throw {
+          name: "TooOld",
+          message: this.#resourceVersion!,
+        };
+      }
+
+      // Process the event payload, do not update the resource version as that is handled by the list operation
+      await process(payload, phase);
+    } catch (err) {
+      if (err.name === "TooOld") {
+        // Reload the watch
+        void this.#errHandler(err);
+        return;
+      }
+
+      this.#events.emit(WatchEvent.DATA_ERROR, err);
+    }
+  };
+
   /**
    * Watch for changes to the resource.
    */
@@ -388,38 +451,7 @@ export class Watcher<T extends GenericClass> {
 
         // Listen for events and call the callback function
         this.#stream.on("data", async line => {
-          try {
-            // Parse the event payload
-            const { object: payload, type: phase } = JSON.parse(line) as {
-              type: WatchPhase;
-              object: InstanceType<T>;
-            };
-
-            // Update the last seen time
-            this.#lastSeenTime = Date.now();
-
-            // If the watch is too old, remove the resourceVersion and reload the watch
-            if (phase === WatchPhase.Error && payload.code === 410) {
-              throw {
-                name: "TooOld",
-                message: this.#resourceVersion!,
-              };
-            }
-
-            // Process the event payload, do not update the resource version as that is handled by the list operation
-            await this.#process(payload, phase);
-          } catch (err) {
-            if (err.name === "TooOld") {
-              // Prevent any body events from firing
-              body.removeAllListeners();
-
-              // Reload the watch
-              void this.#errHandler(err);
-              return;
-            }
-
-            this.#events.emit(WatchEvent.DATA_ERROR, err);
-          }
+          await this.#processLine(line, this.#process);
         });
 
         // Bind the body events
@@ -437,6 +469,108 @@ export class Watcher<T extends GenericClass> {
     }
   };
 
+  /**
+   * Watch for changes to the resource.
+   */
+  #http2Watch = async () => {
+    try {
+      // Start with a list operation
+      await this.#list();
+
+      // Build the URL and request options
+      const { opts, url } = await this.#buildURL(true, this.#resourceVersion);
+      let agentOptions;
+
+      if (opts.agent && opts.agent instanceof https.Agent) {
+        agentOptions = {
+          key: opts.agent.options.key,
+          cert: opts.agent.options.cert,
+          ca: opts.agent.options.ca,
+          rejectUnauthorized: false,
+        };
+      }
+
+      // HTTP/2 client connection setup
+      const client = http2.connect(url.origin, {
+        ca: agentOptions?.ca,
+        cert: agentOptions?.cert,
+        key: agentOptions?.key,
+        rejectUnauthorized: agentOptions?.rejectUnauthorized,
+      });
+
+      // Set up headers for the HTTP/2 request
+      const token = await this.#getToken();
+      const headers: Record<string, string> = {
+        ":method": "GET",
+        ":path": url.pathname + url.search,
+        "content-type": "application/json",
+        "user-agent": "kubernetes-fluent-client",
+      };
+
+      if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+
+      // Make the HTTP/2 request
+      const req = client.request(headers);
+
+      req.setEncoding("utf8");
+
+      let buffer = "";
+
+      // Handle response data
+      req.on("response", headers => {
+        const statusCode = headers[":status"];
+
+        if (statusCode && statusCode >= 200 && statusCode < 300) {
+          this.#pendingReconnect = false;
+          this.#events.emit(WatchEvent.CONNECT, url.pathname);
+
+          // Reset the retry count
+          this.#resyncFailureCount = 0;
+          this.#events.emit(WatchEvent.INC_RESYNC_FAILURE_COUNT, this.#resyncFailureCount);
+
+          req.on("data", async chunk => {
+            try {
+              buffer += chunk;
+              const lines = buffer.split("\n");
+              // Avoid  Watch event data_error received. Unexpected end of JSON input.
+              buffer = lines.pop()!;
+
+              for (const line of lines) {
+                await this.#processLine(line, this.#process);
+              }
+            } catch (err) {
+              void this.#errHandler(err);
+            }
+          });
+
+          req.on("end", () => {
+            client.close();
+            this.#streamCleanup();
+          });
+
+          req.on("close", () => {
+            client.close();
+            this.#streamCleanup();
+          });
+
+          req.on("error", err => {
+            void this.#errHandler(err);
+          });
+        } else {
+          const statusMessage = headers[":status-text"] || "Unknown";
+          throw new Error(`watch connect failed: ${statusCode} ${statusMessage}`);
+        }
+      });
+      req.on("error", err => {
+        void this.#errHandler(err);
+      });
+    } catch (e) {
+      void this.#errHandler(e);
+    }
+  };
+
   /** Clear the resync timer and schedule a new one. */
   #checkResync = () => {
     // Ignore if the last seen time is not set
@@ -468,7 +602,9 @@ export class Watcher<T extends GenericClass> {
           this.#events.emit(WatchEvent.RECONNECT, this.#resyncFailureCount);
           this.#streamCleanup();
 
-          void this.#watch();
+          if (!this.#useHTTP2) {
+            void this.#watch();
+          }
         }
       } else {
         // Otherwise, call the finally function if it exists
@@ -516,5 +652,8 @@ export class Watcher<T extends GenericClass> {
       this.#stream.removeAllListeners();
       this.#stream.destroy();
     }
+    if (this.#useHTTP2) {
+      void this.#http2Watch();
+    }
   };
 }