vibecarbon 0.3.1 → 0.5.0

package/src/lib/kubectl.js

@@ -1,81 +0,0 @@
-/**
- * Kubectl helpers that avoid exposing secrets in argv.
- *
- * Any Kubernetes manifest containing secret data MUST use
- * kubectlApplyManifest so the bytes flow through stdin instead of the
- * shell command line.
- */
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-/**
- * Apply a Kubernetes manifest via `kubectl apply -f -` piped from stdin.
- * The manifest body (including any secret data) never appears in argv.
- *
- * @param {object} manifest - Kubernetes resource as a plain object
- * @param {object} [options]
- * @param {string} [options.namespace]
- * @param {object} [options.env]
- * @param {number} [options.timeout=60000]
- * @returns {string} - kubectl stdout
- */
-export function kubectlApplyManifest(manifest, options = {}) {
-  const yaml = JSON.stringify(manifest);
-  const args = ['apply', '-f', '-'];
-  if (options.namespace) args.push('-n', options.namespace);
-  const res = spawnSync('kubectl', args, {
-    input: yaml,
-    encoding: 'utf-8',
-    env: options.env ?? process.env,
-    timeout: options.timeout ?? 60_000,
-  });
-  if (res.status !== 0) {
-    const stderr = (res.stderr || '').trim();
-    const exitCode = res.status ?? '(null)';
-    // NEVER include res.stdout — kubectl may echo the submitted manifest on
-    // failure, and the manifest may contain secret data.
-    throw new Error(`kubectl apply failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
-  }
-  return res.stdout;
-}
-
-/**
- * Apply a strategic-merge patch to a resource via a temp patch file.
- * Use this instead of interpolating JSON into a shell command line.
- *
- * @param {string} resourceRef - e.g. 'deployment/app' or 'serviceaccount/default'
- * @param {string} namespace
- * @param {object} patch - patch object
- * @param {object} [options]
- * @param {string} [options.type='strategic'] - 'strategic' | 'merge' | 'json'
- * @param {object} [options.env]
- * @param {boolean} [options.ignoreError]
- * @param {number} [options.timeout=60000]
- * @returns {string|null} - kubectl stdout, or null when ignoreError + failure
- */
-export function kubectlPatch(resourceRef, namespace, patch, options = {}) {
-  const { type = 'strategic', env, ignoreError = false, timeout = 60_000 } = options;
-  const dir = mkdtempSync(join(tmpdir(), 'vibecarbon-patch-'));
-  const patchFile = join(dir, 'patch.json');
-  try {
-    writeFileSync(patchFile, JSON.stringify(patch), { mode: 0o600 });
-    const args = ['patch', resourceRef, '-n', namespace, '--type', type, '--patch-file', patchFile];
-    const res = spawnSync('kubectl', args, {
-      encoding: 'utf-8',
-      env: env ?? process.env,
-      timeout,
-    });
-    if (res.status !== 0) {
-      if (ignoreError) return null;
-      const stderr = (res.stderr || '').trim();
-      const exitCode = res.status ?? '(null)';
-      throw new Error(`kubectl patch failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
-    }
-    return res.stdout;
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}