typekro 0.3.1 → 0.5.0

package/dist/core/kubernetes/bun-api-client.js

@@ -0,0 +1,183 @@
+/**
+ * Bun-compatible Kubernetes API Client Factory
+ *
+ * This module provides helper functions to create Kubernetes API clients
+ * that work correctly in Bun runtime by using a custom HTTP library that
+ * properly handles TLS certificates.
+ *
+ * ## Token Refresh Handling
+ *
+ * The authentication is handled by passing the KubeConfig instance as the
+ * auth method. The kubernetes client library calls `applyToRequest()` on
+ * each request, which ensures that:
+ *
+ * 1. OIDC tokens are refreshed when expired
+ * 2. GKE/EKS/AKS tokens are rotated automatically
+ * 3. Service account tokens are re-read from disk if changed
+ *
+ * This means long-running processes (>1 hour) will automatically get
+ * fresh tokens without any additional configuration.
+ *
+ * Use these functions instead of kubeConfig.makeApiClient() when running in Bun.
+ *
+ * @example
+ * ```typescript
+ * import { createBunCompatibleApiClient } from './bun-api-client.js';
+ * import * as k8s from '@kubernetes/client-node';
+ *
+ * const kc = new k8s.KubeConfig();
+ * kc.loadFromDefault();
+ *
+ * // Create a CoreV1Api client that works in Bun
+ * const coreApi = createBunCompatibleApiClient(kc, k8s.CoreV1Api);
+ * const namespaces = await coreApi.listNamespace();
+ * ```
+ */
+import * as k8s from '@kubernetes/client-node';
+import { createConfiguration } from '@kubernetes/client-node/dist/gen/configuration.js';
+import { ServerConfiguration } from '@kubernetes/client-node/dist/gen/servers.js';
+import { KubernetesClientError } from '../errors.js';
+import { getComponentLogger } from '../logging/index.js';
+import { BunCompatibleHttpLibrary, isBunRuntime, } from './bun-http-library.js';
+const logger = getComponentLogger('bun-api-client');
+// Re-export isBunRuntime and HttpTimeoutConfig for convenience
+export { isBunRuntime };
+/**
+ * Create a Kubernetes API client that works in Bun runtime.
+ *
+ * This function creates an API client using a custom HTTP library that
+ * properly handles TLS certificates in Bun. If not running in Bun,
+ * it falls back to the standard makeApiClient method.
+ *
+ * @param kubeConfig - The KubeConfig instance
+ * @param apiClientClass - The API client class (e.g., k8s.CoreV1Api)
+ * @param timeoutConfig - Optional HTTP timeout configuration for Bun runtime
+ * @returns An instance of the API client
+ */
+export function createBunCompatibleApiClient(kubeConfig, apiClientClass, timeoutConfig) {
+    // If not running in Bun, use standard makeApiClient
+    if (!isBunRuntime()) {
+        return kubeConfig.makeApiClient(apiClientClass);
+    }
+    const cluster = kubeConfig.getCurrentCluster();
+    if (!cluster) {
+        throw new KubernetesClientError('No active cluster in KubeConfig', 'configuration');
+    }
+    // Create configuration with Bun-compatible HTTP library
+    // The KubeConfig is passed as the auth method, which ensures that:
+    // - applyToRequest() is called on each request
+    // - Tokens are refreshed automatically when expired
+    // - OIDC/GKE/EKS/AKS token rotation is handled
+    const authConfig = {
+        default: kubeConfig,
+    };
+    const baseServerConfig = new ServerConfiguration(cluster.server, {});
+    const config = createConfiguration({
+        baseServer: baseServerConfig,
+        authMethods: authConfig,
+        httpApi: new BunCompatibleHttpLibrary(timeoutConfig),
+    });
+    logger.debug('Created Bun-compatible API client', {
+        apiClient: apiClientClass.name,
+        server: cluster.server,
+        tokenRefresh: 'enabled via KubeConfig.applyToRequest()',
+        hasCustomTimeouts: !!timeoutConfig,
+    });
+    return new apiClientClass(config);
+}
+/**
+ * Create a CoreV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleCoreV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.CoreV1Api, timeoutConfig);
+}
+/**
+ * Create an AppsV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleAppsV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.AppsV1Api, timeoutConfig);
+}
+/**
+ * Create a CustomObjectsApi client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleCustomObjectsApi(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.CustomObjectsApi, timeoutConfig);
+}
+/**
+ * Create a BatchV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleBatchV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.BatchV1Api, timeoutConfig);
+}
+/**
+ * Create a NetworkingV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleNetworkingV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.NetworkingV1Api, timeoutConfig);
+}
+/**
+ * Create an RbacAuthorizationV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleRbacAuthorizationV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.RbacAuthorizationV1Api, timeoutConfig);
+}
+/**
+ * Create a StorageV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleStorageV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.StorageV1Api, timeoutConfig);
+}
+/**
+ * Create an ApiextensionsV1Api client that works in Bun runtime.
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration
+ */
+export function createBunCompatibleApiextensionsV1Api(kubeConfig, timeoutConfig) {
+    return createBunCompatibleApiClient(kubeConfig, k8s.ApiextensionsV1Api, timeoutConfig);
+}
+/**
+ * Create a KubernetesObjectApi client that works in Bun runtime.
+ *
+ * Note: KubernetesObjectApi has a different constructor signature,
+ * so we need special handling.
+ *
+ * @param kubeConfig - The KubeConfig instance
+ * @param timeoutConfig - Optional HTTP timeout configuration for Bun runtime
+ * @returns KubernetesObjectApi instance
+ */
+export function createBunCompatibleKubernetesObjectApi(kubeConfig, timeoutConfig) {
+    // If not running in Bun, use standard method
+    if (!isBunRuntime()) {
+        return k8s.KubernetesObjectApi.makeApiClient(kubeConfig);
+    }
+    const cluster = kubeConfig.getCurrentCluster();
+    if (!cluster) {
+        throw new KubernetesClientError('No active cluster in KubeConfig', 'configuration');
+    }
+    // Create configuration with Bun-compatible HTTP library
+    const authConfig = {
+        default: kubeConfig,
+    };
+    const baseServerConfig = new ServerConfiguration(cluster.server, {});
+    const config = createConfiguration({
+        baseServer: baseServerConfig,
+        authMethods: authConfig,
+        httpApi: new BunCompatibleHttpLibrary(timeoutConfig),
+    });
+    return new k8s.KubernetesObjectApi(config);
+}
+//# sourceMappingURL=bun-api-client.js.map

package/dist/core/kubernetes/bun-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-api-client.js","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAG/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,wBAAwB,EAExB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AAEpD,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAA0B,CAAC;AAQhD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,cAAuC,EACvC,aAAiC;IAEjC,oDAAoD;IACpD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC;IAED,wDAAwD;IACxD,mEAAmE;IACnE,+CAA+C;IAC/C,oDAAoD;IACpD,+CAA+C;IAC/C,MAAM,UAAU,GAA6B;QAC3C,OAAO,EAAE,UAAU;KACpB,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,mBAAmB,CAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,IAAI,wBAAwB,CAAC,aAAa,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;QAChD,SAAS,EAAE,cAAc,CAAC,IAAI;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,yCAAyC;QACvD,iBAAiB,EAAE,CAAC,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA0B,EAC1B,aAAiC;IAEjC,OAAO,4BAA4B,CAAC,UAAU,EAAE,GAAG,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAA0B,EAC1B,aAAiC;IAEjC,6CAA6C;IAC7C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,mBAAmB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAA6B;QAC3C,OAAO,EAAE,UAAU;KACpB,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,mBAAmB,CAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,IAAI,wBAAwB,CAAC,aAAa,CAAC;KACrD,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/kubernetes/bun-http-library.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Custom HTTP Library for @kubernetes/client-node that works with Bun
+ *
+ * This module provides a workaround for Bun's fetch TLS issues:
+ * https://github.com/oven-sh/bun/issues/10642
+ *
+ * The issue: Bun intercepts node-fetch and uses its native fetch implementation,
+ * which doesn't properly support https.Agent for TLS configuration (client certificates,
+ * skipTLSVerify, etc.).
+ *
+ * The solution: Extract TLS options from the https.Agent and pass them directly
+ * to https.request instead of using the agent.
+ */
+import type { HttpLibrary, RequestContext, ResponseContext } from '@kubernetes/client-node/dist/gen/http/http.js';
+import { type Observable } from '@kubernetes/client-node/dist/gen/rxjsStub.js';
+/**
+ * Configuration for HTTP request timeouts by operation type.
+ *
+ * These timeouts apply when running in Bun runtime to prevent requests
+ * from hanging indefinitely when the Kubernetes API server doesn't respond
+ * (due to webhook delays, network issues, etc.).
+ *
+ * Timeout values are based on kubectl defaults and operation characteristics:
+ * - Watch operations: DISABLED (handled by API server via timeoutSeconds parameter)
+ * - Read operations (GET/LIST): Complete quickly
+ * - Write operations (CREATE/PATCH/PUT): May trigger webhooks, need longer timeouts
+ * - Delete operations: May wait for finalizers, need even longer timeouts
+ */
+export interface HttpTimeoutConfig {
+    /**
+     * Timeout for read operations (GET, LIST)
+     * @default 30000 (30 seconds) - matches kubectl default
+     */
+    default?: number;
+    /**
+     * Timeout for watch operations (long-lived connections with ?watch=true)
+     * @default 3600000 (1 hour) - effectively disabled
+     * Watch connections are controlled by the Kubernetes API server via timeoutSeconds
+     * query parameter. HTTP-level timeouts interfere with EventMonitor reconnection logic.
+     */
+    watch?: number;
+    /**
+     * Timeout for create operations (POST)
+     * @default 120000 (2 minutes)
+     * May trigger admission webhooks for validation, CRD defaults, mutations
+     */
+    create?: number;
+    /**
+     * Timeout for update operations (PATCH, PUT)
+     * @default 120000 (2 minutes)
+     * May trigger admission webhooks for validation, CRD defaults, mutations
+     */
+    update?: number;
+    /**
+     * Timeout for delete operations (DELETE)
+     * @default 180000 (3 minutes)
+     * May wait for finalizers, graceful termination
+     */
+    delete?: number;
+}
+/**
+ * Check if we're running in Bun runtime
+ */
+export declare function isBunRuntime(): boolean;
+/**
+ * Custom HTTP Library that uses Node's https module directly.
+ * This bypasses Bun's fetch which has TLS/agent issues.
+ *
+ * Use this when running in Bun with kubernetes client to ensure
+ * proper TLS certificate handling and request timeouts.
+ *
+ * @see https://github.com/oven-sh/bun/issues/10642
+ */
+export declare class BunCompatibleHttpLibrary implements HttpLibrary {
+    private timeouts;
+    private logger;
+    /**
+     * Create a new BunCompatibleHttpLibrary with optional custom timeout configuration
+     * @param timeoutConfig - Optional custom timeout values for different operation types
+     */
+    constructor(timeoutConfig?: HttpTimeoutConfig);
+    send(request: RequestContext): Observable<ResponseContext>;
+    /**
+     * Determine the appropriate timeout for this HTTP request based on
+     * the HTTP method and URL parameters
+     *
+     * @param method - HTTP method (GET, POST, PATCH, DELETE, etc.)
+     * @param url - Full request URL
+     * @returns Timeout in milliseconds
+     */
+    private getTimeoutForRequest;
+    private makeRequest;
+}
+/**
+ * Get the appropriate HTTP library based on the runtime environment.
+ * Returns BunCompatibleHttpLibrary when running in Bun, otherwise
+ * returns undefined to use the default IsomorphicFetchHttpLibrary.
+ *
+ * @param timeoutConfig - Optional custom timeout configuration for Bun runtime
+ * @returns BunCompatibleHttpLibrary for Bun, undefined for other runtimes
+ */
+export declare function getHttpLibraryForRuntime(timeoutConfig?: HttpTimeoutConfig): HttpLibrary | undefined;
+export type { HttpLibrary, RequestContext, ResponseContext };
+//# sourceMappingURL=bun-http-library.d.ts.map

package/dist/core/kubernetes/bun-http-library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-http-library.d.ts","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,8CAA8C,CAAC;AASrF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6BD;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,WAAW;IAC1D,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,MAAM,CAA0C;IAExD;;;OAGG;gBACS,aAAa,CAAC,EAAE,iBAAiB;IAkBtC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC;IAKjE;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,WAAW;CAkJpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,CAAC,EAAE,iBAAiB,GAChC,WAAW,GAAG,SAAS,CAKzB;AAGD,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC"}

package/dist/core/kubernetes/bun-http-library.js

@@ -0,0 +1,240 @@
+/**
+ * Custom HTTP Library for @kubernetes/client-node that works with Bun
+ *
+ * This module provides a workaround for Bun's fetch TLS issues:
+ * https://github.com/oven-sh/bun/issues/10642
+ *
+ * The issue: Bun intercepts node-fetch and uses its native fetch implementation,
+ * which doesn't properly support https.Agent for TLS configuration (client certificates,
+ * skipTLSVerify, etc.).
+ *
+ * The solution: Extract TLS options from the https.Agent and pass them directly
+ * to https.request instead of using the agent.
+ */
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { from } from '@kubernetes/client-node/dist/gen/rxjsStub.js';
+import { DEFAULT_HTTP_DELETE_TIMEOUT, DEFAULT_HTTP_READ_TIMEOUT, DEFAULT_HTTP_WATCH_TIMEOUT, DEFAULT_HTTP_WRITE_TIMEOUT, } from '../config/defaults.js';
+import { getComponentLogger } from '../logging/index.js';
+/**
+ * Default timeout values for Kubernetes API operations
+ * Based on kubectl defaults and operation characteristics
+ */
+const DEFAULT_TIMEOUTS = {
+    default: DEFAULT_HTTP_READ_TIMEOUT,
+    watch: DEFAULT_HTTP_WATCH_TIMEOUT, // 1 hour - effectively disabled (API server controls watch timeouts)
+    create: DEFAULT_HTTP_WRITE_TIMEOUT, // 2 minutes - write operations with webhooks
+    update: DEFAULT_HTTP_WRITE_TIMEOUT, // 2 minutes - write operations with webhooks
+    delete: DEFAULT_HTTP_DELETE_TIMEOUT, // 3 minutes - may need to wait for finalizers
+};
+/**
+ * Check if we're running in Bun runtime
+ */
+export function isBunRuntime() {
+    return typeof Bun !== 'undefined';
+}
+/**
+ * Custom HTTP Library that uses Node's https module directly.
+ * This bypasses Bun's fetch which has TLS/agent issues.
+ *
+ * Use this when running in Bun with kubernetes client to ensure
+ * proper TLS certificate handling and request timeouts.
+ *
+ * @see https://github.com/oven-sh/bun/issues/10642
+ */
+export class BunCompatibleHttpLibrary {
+    timeouts;
+    logger = getComponentLogger('bun-http-library');
+    /**
+     * Create a new BunCompatibleHttpLibrary with optional custom timeout configuration
+     * @param timeoutConfig - Optional custom timeout values for different operation types
+     */
+    constructor(timeoutConfig) {
+        this.timeouts = {
+            ...DEFAULT_TIMEOUTS,
+            ...timeoutConfig,
+        };
+        // Log timeout configuration when running in Bun
+        if (isBunRuntime()) {
+            this.logger.debug('BunCompatibleHttpLibrary initialized with timeouts', {
+                default: `${this.timeouts.default}ms`,
+                watch: `${this.timeouts.watch}ms`,
+                create: `${this.timeouts.create}ms`,
+                update: `${this.timeouts.update}ms`,
+                delete: `${this.timeouts.delete}ms`,
+            });
+        }
+    }
+    send(request) {
+        const resultPromise = this.makeRequest(request);
+        return from(resultPromise);
+    }
+    /**
+     * Determine the appropriate timeout for this HTTP request based on
+     * the HTTP method and URL parameters
+     *
+     * @param method - HTTP method (GET, POST, PATCH, DELETE, etc.)
+     * @param url - Full request URL
+     * @returns Timeout in milliseconds
+     */
+    getTimeoutForRequest(method, url) {
+        // Watch operations are long-lived streaming connections controlled by the
+        // Kubernetes API server via timeoutSeconds query parameter. Do NOT set
+        // HTTP-level timeouts on watch connections as this interferes with the
+        // EventMonitor's reconnection logic and causes AbortError issues.
+        if (url.includes('?watch=true') || url.includes('&watch=true')) {
+            return this.timeouts.watch;
+        }
+        // Operation-specific timeouts based on HTTP method
+        // Increased for complex operations that may involve webhooks/finalizers
+        const upperMethod = method.toUpperCase();
+        switch (upperMethod) {
+            case 'POST':
+                return this.timeouts.create;
+            case 'PATCH':
+            case 'PUT':
+                return this.timeouts.update;
+            case 'DELETE':
+                return this.timeouts.delete;
+            default:
+                return this.timeouts.default;
+        }
+    }
+    makeRequest(request) {
+        return new Promise((resolve, reject) => {
+            const url = new URL(request.getUrl());
+            const method = request.getHttpMethod();
+            const isHttps = url.protocol === 'https:';
+            const httpModule = isHttps ? https : http;
+            // Determine appropriate timeout for this request
+            const timeoutMs = this.getTimeoutForRequest(method, url.toString());
+            // For watch operations, skip HTTP timeout entirely - let API server handle it
+            const shouldSetTimeout = !url.toString().includes('?watch=true') && !url.toString().includes('&watch=true');
+            const agent = request.getAgent();
+            const headers = request.getHeaders();
+            const body = request.getBody();
+            // Extract TLS options from the agent if present
+            // This is the key workaround for Bun's https.Agent issues
+            // Node.js stores constructor options on agent.options (not in public types)
+            const agentOptions = agent && 'options' in agent ? Reflect.get(agent, 'options') : {};
+            const options = {
+                hostname: url.hostname,
+                port: url.port || (isHttps ? 443 : 80),
+                path: url.pathname + url.search,
+                method: method,
+                headers: headers,
+                // Pass TLS options directly instead of using agent
+                // This works around Bun's issues with https.Agent
+                rejectUnauthorized: agentOptions.rejectUnauthorized ?? true,
+                cert: agentOptions.cert,
+                key: agentOptions.key,
+                ca: agentOptions.ca,
+                // Additional TLS options that might be set
+                pfx: agentOptions.pfx,
+                passphrase: agentOptions.passphrase,
+                servername: agentOptions.servername,
+                ciphers: agentOptions.ciphers,
+            };
+            const req = httpModule.request(options, (res) => {
+                const chunks = [];
+                res.on('data', (chunk) => {
+                    chunks.push(chunk);
+                });
+                res.on('end', () => {
+                    const buffer = Buffer.concat(chunks);
+                    const responseHeaders = {};
+                    // Convert headers to simple object
+                    for (const [key, value] of Object.entries(res.headers)) {
+                        if (value) {
+                            responseHeaders[key] = Array.isArray(value) ? value.join(', ') : value;
+                        }
+                    }
+                    // Create response body with all methods expected by kubernetes client
+                    // Including getBodyAsAny which is used by KubernetesObjectApi
+                    const responseBody = {
+                        text: () => Promise.resolve(buffer.toString('utf-8')),
+                        binary: () => Promise.resolve(buffer),
+                    };
+                    // Create a response context that matches the expected interface
+                    // KubernetesObjectApi expects getBodyAsAny() method on the response
+                    const response = {
+                        httpStatusCode: res.statusCode || 0,
+                        headers: responseHeaders,
+                        body: responseBody,
+                        // Add getBodyAsAny method for KubernetesObjectApi compatibility
+                        getBodyAsAny: async () => {
+                            const text = buffer.toString('utf-8');
+                            try {
+                                return JSON.parse(text);
+                            }
+                            catch (error) {
+                                this.logger.debug('Failed to parse response body as JSON, returning raw text', {
+                                    err: error,
+                                });
+                                return text;
+                            }
+                        },
+                    };
+                    resolve(response);
+                });
+            });
+            req.on('error', (err) => {
+                reject(err);
+            });
+            // ⭐ SET HTTP REQUEST TIMEOUT (skip for watch operations)
+            // This is critical for preventing requests from hanging indefinitely
+            // when the Kubernetes API server doesn't respond (webhooks, network issues)
+            // Watch operations are handled by the API server via timeoutSeconds parameter
+            if (shouldSetTimeout) {
+                req.setTimeout(timeoutMs, () => {
+                    req.destroy(); // Abort the request
+                    const timeoutError = new Error(`HTTP request timeout: ${method} ${url.pathname} timed out after ${timeoutMs}ms\n` +
+                        `URL: ${url.toString()}\n` +
+                        `\n` +
+                        `💡 Possible causes:\n` +
+                        `  • Kubernetes API server is not responding\n` +
+                        `  • Admission webhooks are slow or unavailable\n` +
+                        `  • Network connectivity issues\n` +
+                        `  • Request is legitimately slow and timeout is too short\n` +
+                        `\n` +
+                        `✅ Solutions:\n` +
+                        `  • Verify Kubernetes API server is running: kubectl cluster-info\n` +
+                        `  • Check webhook status: kubectl get validatingwebhookconfigurations\n` +
+                        `  • Increase timeout via httpTimeouts option if needed\n` +
+                        `  • For watch operations: timeouts are disabled (API server controls via timeoutSeconds)`);
+                    reject(timeoutError);
+                });
+            }
+            // Handle abort signal (if available - added in newer versions).
+            // Use { once: true } to automatically remove the listener after firing,
+            // preventing memory growth when the AbortSignal outlives the request.
+            const getSignal = Reflect.get(request, 'getSignal');
+            const signal = getSignal?.();
+            if (signal) {
+                signal.addEventListener('abort', () => {
+                    req.destroy(new Error('Request aborted'));
+                }, { once: true });
+            }
+            // Send body if present
+            if (body) {
+                req.write(body);
+            }
+            req.end();
+        });
+    }
+}
+/**
+ * Get the appropriate HTTP library based on the runtime environment.
+ * Returns BunCompatibleHttpLibrary when running in Bun, otherwise
+ * returns undefined to use the default IsomorphicFetchHttpLibrary.
+ *
+ * @param timeoutConfig - Optional custom timeout configuration for Bun runtime
+ * @returns BunCompatibleHttpLibrary for Bun, undefined for other runtimes
+ */
+export function getHttpLibraryForRuntime(timeoutConfig) {
+    if (isBunRuntime()) {
+        return new BunCompatibleHttpLibrary(timeoutConfig);
+    }
+    return undefined;
+}
+//# sourceMappingURL=bun-http-library.js.map

package/dist/core/kubernetes/bun-http-library.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-http-library.js","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAMpC,OAAO,EAAE,IAAI,EAAmB,MAAM,8CAA8C,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAmEzD;;;GAGG;AACH,MAAM,gBAAgB,GAAgC;IACpD,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,0BAA0B,EAAE,qEAAqE;IACxG,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,2BAA2B,EAAE,8CAA8C;CACpF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,GAAG,KAAK,WAAW,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAA8B;IACtC,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAExD;;;OAGG;IACH,YAAY,aAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,gBAAgB;YACnB,GAAG,aAAa;SACjB,CAAC;QAEF,gDAAgD;QAChD,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;gBACtE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI;gBACrC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACjC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,OAAuB;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,MAAc,EAAE,GAAW;QACtD,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,mDAAmD;QACnD,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,OAAO,CAAC;YACb,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B;gBACE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAuB;QACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1C,iDAAiD;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEpE,8EAA8E;YAC9E,MAAM,gBAAgB,GACpB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAErF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAE/B,gDAAgD;YAChD,0DAA0D;YAC1D,4EAA4E;YAC5E,MAAM,YAAY,GAChB,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;YAExF,MAAM,OAAO,GAAyB;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO;gBAChB,mDAAmD;gBACnD,kDAAkD;gBAClD,kBAAkB,EAAE,YAAY,CAAC,kBAAkB,IAAI,IAAI;gBAC3D,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,2CAA2C;gBAC3C,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,OAAO,EAAE,YAAY,CAAC,OAAO;aAC9B,CAAC;YAEF,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;gBAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACrC,MAAM,eAAe,GAA2B,EAAE,CAAC;oBAEnD,mCAAmC;oBACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACvD,IAAI,KAAK,EAAE,CAAC;4BACV,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBACzE,CAAC;oBACH,CAAC;oBAED,sEAAsE;oBACtE,8DAA8D;oBAC9D,MAAM,YAAY,GAAG;wBACnB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACrD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;qBACtC,CAAC;oBAEF,gEAAgE;oBAChE,oEAAoE;oBACpE,MAAM,QAAQ,GAAG;wBACf,cAAc,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBACnC,OAAO,EAAE,eAAe;wBACxB,IAAI,EAAE,YAAY;wBAClB,gEAAgE;wBAChE,YAAY,EAAE,KAAK,IAAI,EAAE;4BACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;4BACtC,IAAI,CAAC;gCACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC1B,CAAC;4BAAC,OAAO,KAAc,EAAE,CAAC;gCACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;oCAC7E,GAAG,EAAE,KAAK;iCACX,CAAC,CAAC;gCACH,OAAO,IAAI,CAAC;4BACd,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,OAAO,CAAC,QAA2B,CAAC,CAAC;gBACvC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,yDAAyD;YACzD,qEAAqE;YACrE,4EAA4E;YAC5E,8EAA8E;YAC9E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC7B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAoB;oBACnC,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,yBAAyB,MAAM,IAAI,GAAG,CAAC,QAAQ,oBAAoB,SAAS,MAAM;wBAChF,QAAQ,GAAG,CAAC,QAAQ,EAAE,IAAI;wBAC1B,IAAI;wBACJ,uBAAuB;wBACvB,+CAA+C;wBAC/C,kDAAkD;wBAClD,mCAAmC;wBACnC,6DAA6D;wBAC7D,IAAI;wBACJ,gBAAgB;wBAChB,qEAAqE;wBACrE,yEAAyE;wBACzE,0DAA0D;wBAC1D,0FAA0F,CAC7F,CAAC;oBACF,MAAM,CAAC,YAAY,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAoC,CAAC;YACvF,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,gBAAgB,CACrB,OAAO,EACP,GAAG,EAAE;oBACH,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACJ,CAAC;YAED,uBAAuB;YACvB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAED,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAiC;IAEjC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}