fix: remove kubectl from follower state helpers

scripts/native/cicd/patch-follower-state.mjs

@@ -1,38 +1,54 @@
-import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import https from "node:https";
 
 const namespace = process.env.NAMESPACE || "";
 const configMap = process.env.CONFIGMAP || "";
 const followerId = process.env.FOLLOWER_ID || "";
 const specRef = process.env.SPEC_REF || "";
 const stateJson = Buffer.from(process.env.STATE_B64 || "", "base64").toString("utf8");
+const host = process.env.KUBERNETES_SERVICE_HOST;
+const port = Number(process.env.KUBERNETES_SERVICE_PORT || "443");
+const token = readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/token", "utf8").trim();
+const ca = readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt");
 
-function kubectl(args, input) {
-  return execFileSync("kubectl", ["-n", namespace, ...args], {
-    input,
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "pipe"],
+function request(method, path, body, contentType = "application/json") {
+  return new Promise((resolve, reject) => {
+    const headers = { authorization: `Bearer ${token}` };
+    const payload = body === undefined ? null : typeof body === "string" ? body : JSON.stringify(body);
+    if (payload !== null) {
+      headers["content-type"] = contentType;
+      headers["content-length"] = Buffer.byteLength(payload);
+    }
+    const req = https.request({ host, port, path, method, ca, headers }, (res) => {
+      let text = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => { text += chunk; });
+      res.on("end", () => resolve({ status: res.statusCode || 0, text }));
+    });
+    req.on("error", reject);
+    if (payload !== null) req.write(payload);
+    req.end();
   });
 }
 
-function readConfigMap() {
-  try {
-    return JSON.parse(kubectl(["get", "configmap", configMap, "-o", "json"]));
-  } catch (error) {
-    const stderr = String(error?.stderr || error?.message || "");
-    if (/not found/i.test(stderr)) return null;
-    throw error;
-  }
+async function readConfigMap() {
+  const result = await request("GET", `/api/v1/namespaces/${encodeURIComponent(namespace)}/configmaps/${encodeURIComponent(configMap)}`);
+  if (result.status === 404) return null;
+  if (result.status < 200 || result.status >= 300) throw new Error(result.text || `kube api GET configmap status ${result.status}`);
+  return JSON.parse(result.text);
 }
 
-function ensureConfigMap() {
-  if (readConfigMap() !== null) return;
+async function ensureConfigMap() {
+  if (await readConfigMap() !== null) return;
   const object = {
     apiVersion: "v1",
     kind: "ConfigMap",
     metadata: { name: configMap, namespace },
     data: { _createdAt: new Date().toISOString(), _specRef: specRef },
   };
-  kubectl(["apply", "-f", "-"], JSON.stringify(object));
+  const result = await request("POST", `/api/v1/namespaces/${encodeURIComponent(namespace)}/configmaps`, object);
+  if (result.status === 409) return;
+  if (result.status < 200 || result.status >= 300) throw new Error(result.text || `kube api POST configmap status ${result.status}`);
 }
 
 function stringOrNull(value) {
@@ -91,8 +107,8 @@ function preserveExistingTiming(state, existing) {
   };
 }
 
-ensureConfigMap();
-const current = readConfigMap();
+await ensureConfigMap();
+const current = await readConfigMap();
 const beforeResourceVersion = stringOrNull(current?.metadata?.resourceVersion);
 const beforeUpdatedAt = stringOrNull(current?.data?._updatedAt);
 const currentText = current?.data?.[followerId];
@@ -106,8 +122,9 @@ const patch = {
     _specRef: specRef,
   },
 };
-kubectl(["patch", "configmap", configMap, "--type", "merge", "-p", JSON.stringify(patch)]);
-const updated = readConfigMap();
+const patchResult = await request("PATCH", `/api/v1/namespaces/${encodeURIComponent(namespace)}/configmaps/${encodeURIComponent(configMap)}`, patch, "application/merge-patch+json");
+if (patchResult.status < 200 || patchResult.status >= 300) throw new Error(patchResult.text || `kube api PATCH configmap status ${patchResult.status}`);
+const updated = await readConfigMap();
 process.stdout.write(JSON.stringify({
   ok: true,
   followerId,