Fixhancement: Handle k8s ipv6 node tls bug (#7035)

src/utils/config/kubernetes.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "fs";
+import { isIPv6 } from "net";
 import path from "path";
 
 import { ApiextensionsV1Api, KubeConfig } from "@kubernetes/client-node";
@@ -21,6 +22,10 @@ export const getKubeConfig = () => {
   switch (config?.mode) {
     case "cluster":
       kc.loadFromCluster();
+      // node < 26 can't match an IPv6 host against an IP SAN, so verify against the DNS SAN instead (nodejs/node#64032)
+      if (isIPv6(process.env.KUBERNETES_SERVICE_HOST ?? "")) {
+        kc.clusters = kc.clusters.map((cluster) => ({ ...cluster, tlsServerName: "kubernetes.default.svc" }));
+      }
       break;
     case "default":
       kc.loadFromDefault();

src/utils/config/kubernetes.test.js

@@ -43,6 +43,7 @@ vi.mock("@kubernetes/client-node", () => ({
   ApiextensionsV1Api: class ApiextensionsV1Api {},
   KubeConfig: class KubeConfig {
     loadFromCluster() {
+      this.clusters = [{ name: "inCluster", server: "https://host:443", skipTLSVerify: false }];
       return kube.loadFromCluster();
     }
     loadFromDefault() {
@@ -85,6 +86,27 @@ describe("utils/config/kubernetes", () => {
     expect(kc2).not.toBeNull();
   });
 
+  it("getKubeConfig sets tlsServerName when the in-cluster host is IPv6", () => {
+    vi.stubEnv("KUBERNETES_SERVICE_HOST", "fd00:1018:2000::1");
+    yaml.load.mockReturnValueOnce({ mode: "cluster" });
+
+    expect(getKubeConfig().clusters[0]).toMatchObject({
+      name: "inCluster",
+      tlsServerName: "kubernetes.default.svc",
+    });
+
+    vi.unstubAllEnvs();
+  });
+
+  it("getKubeConfig leaves tlsServerName unset for non-IPv6 in-cluster hosts", () => {
+    vi.stubEnv("KUBERNETES_SERVICE_HOST", "10.43.0.1");
+    yaml.load.mockReturnValueOnce({ mode: "cluster" });
+
+    expect(getKubeConfig().clusters[0].tlsServerName).toBeUndefined();
+
+    vi.unstubAllEnvs();
+  });
+
   it("checkCRD returns true when the CRD exists", async () => {
     apiExt.readCustomResourceDefinitionStatus.mockResolvedValueOnce({ ok: true });
     const logger = { error: vi.fn() };