From 14ae28f13cbf697651e28f06c13424f50f7d0323 Mon Sep 17 00:00:00 2001 From: Hector Ros Date: Tue, 20 Jan 2026 17:53:04 +0100 Subject: [PATCH] Add TLS skip for K8s client when in-cluster - Configure skipTLSVerify for cluster certificates - Better handling of in-cluster vs out-of-cluster modes Co-Authored-By: Claude Sonnet 4.5 (1M context) --- src/lib/k8s.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/lib/k8s.ts b/src/lib/k8s.ts index 4bb7452..47a5b9b 100644 --- a/src/lib/k8s.ts +++ b/src/lib/k8s.ts @@ -24,6 +24,18 @@ export function initK8sClient() { // Load from kubeconfig file const configPath = process.env.K8S_CONFIG_PATH || process.env.KUBECONFIG || '~/.kube/config' k8sConfig.loadFromFile(configPath) + + // When running in K8s (but not detected as in-cluster), trust the cluster CA + // This happens when backend pod needs to manage other pods + if (process.env.KUBERNETES_SERVICE_HOST) { + // We're running in K8s, configure to trust cluster certificates + const cluster = k8sConfig.getCurrentCluster() + if (cluster) { + // Skip TLS verification for development (NOT recommended for production) + // In production, use proper CA certificates + cluster.skipTLSVerify = true + } + } } k8sClient = k8sConfig.makeApiClient(k8s.CoreV1Api)