fix: remove kubectl from follower state helpers

scripts/native/cicd/read-state-summary.mjs

@@ -1,9 +1,14 @@
-import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import https from "node:https";
 
 const namespace = process.env.NAMESPACE || "";
 const configMap = process.env.CONFIGMAP || "";
 const followerIds = parseFollowerIds(process.env.FOLLOWERS_JSON || "[]");
 const maxTimingStages = Number(process.env.MAX_TIMING_STAGES || "24");
+const host = process.env.KUBERNETES_SERVICE_HOST;
+const port = Number(process.env.KUBERNETES_SERVICE_PORT || "443");
+const token = readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/token", "utf8").trim();
+const ca = readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt");
 
 function parseFollowerIds(text) {
   try {
@@ -14,18 +19,34 @@ function parseFollowerIds(text) {
   }
 }
 
-function kubectlConfigMap() {
-  try {
-    const stdout = execFileSync("kubectl", ["-n", namespace, "get", "configmap", configMap, "-o", "json"], {
-      encoding: "utf8",
-      maxBuffer: 16 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"],
+function request(method, path, body, contentType = "application/json") {
+  return new Promise((resolve, reject) => {
+    const headers = { authorization: `Bearer ${token}` };
+    const payload = body === undefined ? null : typeof body === "string" ? body : JSON.stringify(body);
+    if (payload !== null) {
+      headers["content-type"] = contentType;
+      headers["content-length"] = Buffer.byteLength(payload);
+    }
+    const req = https.request({ host, port, path, method, ca, headers }, (res) => {
+      let text = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => { text += chunk; });
+      res.on("end", () => resolve({ status: res.statusCode || 0, text }));
     });
-    return { ok: true, present: true, object: JSON.parse(stdout), error: "" };
+    req.on("error", reject);
+    if (payload !== null) req.write(payload);
+    req.end();
+  });
+}
+
+async function readConfigMap() {
+  try {
+    const result = await request("GET", `/api/v1/namespaces/${encodeURIComponent(namespace)}/configmaps/${encodeURIComponent(configMap)}`);
+    if (result.status === 404) return { ok: true, present: false, object: null, error: result.text };
+    if (result.status < 200 || result.status >= 300) return { ok: false, present: false, object: null, error: result.text || `kube api GET configmap status ${result.status}` };
+    return { ok: true, present: true, object: JSON.parse(result.text), error: "" };
   } catch (error) {
-    const stderr = String(error?.stderr || error?.message || "");
-    if (/not found/i.test(stderr)) return { ok: true, present: false, object: null, error: stderr };
-    return { ok: false, present: false, object: null, error: stderr || "kubectl configmap read failed" };
+    return { ok: false, present: false, object: null, error: error?.message || String(error) };
   }
 }
 
@@ -139,7 +160,7 @@ function numberOrNull(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 
-const result = kubectlConfigMap();
+const result = await readConfigMap();
 const errors = [];
 const stateByFollower = {};
 const valueBytes = {};