fix: respect NODE_TLS_REJECT_UNAUTHORIZED environment variable

package.json

@@ -83,6 +83,7 @@
         "nock": "^14.0.5",
         "prettier": "^3.0.0",
         "pretty-quick": "^4.0.0",
+        "selfsigned": "^3.0.1",
         "ts-mockito": "^2.3.1",
         "tsx": "^4.19.1",
         "typedoc": "^0.28.0",

src/config.ts

@@ -202,7 +202,9 @@ export class KubeConfig implements SecurityAuthentication {
         agentOptions.key = opts.key;
         agentOptions.pfx = opts.pfx;
         agentOptions.passphrase = opts.passphrase;
-        agentOptions.rejectUnauthorized = opts.rejectUnauthorized;
+        if (opts.rejectUnauthorized !== undefined) {
+            agentOptions.rejectUnauthorized = opts.rejectUnauthorized;
+        }
         // The ws docs say that it accepts anything that https.RequestOptions accepts,
         // but Typescript doesn't understand that idea (yet) probably could be fixed in
         // the typings, but for now just cast to any
@@ -259,7 +261,9 @@ export class KubeConfig implements SecurityAuthentication {
         agentOptions.key = httpsOptions.key;
         agentOptions.pfx = httpsOptions.pfx;
         agentOptions.passphrase = httpsOptions.passphrase;
-        agentOptions.rejectUnauthorized = httpsOptions.rejectUnauthorized;
+        if (httpsOptions.rejectUnauthorized !== undefined) {
+            agentOptions.rejectUnauthorized = httpsOptions.rejectUnauthorized;
+        }
 
         context.setAgent(this.createAgent(cluster, agentOptions));
     }

src/config_test.ts

@@ -18,7 +18,7 @@ import { fileURLToPath } from 'node:url';
 import mockfs from 'mock-fs';
 
 import { Authenticator } from './auth.js';
-import { Headers } from 'node-fetch';
+import fetch, { Headers } from 'node-fetch';
 import { HttpMethod } from './index.js';
 import { assertRequestAgentsEqual, assertRequestOptionsEqual } from './test/match-buffer.js';
 import { CoreV1Api, RequestContext } from './api.js';
@@ -27,6 +27,8 @@ import { ActionOnInvalid, Cluster, newClusters, newContexts, newUsers, User } fr
 import { ExecAuth } from './exec_auth.js';
 import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent';
 import { SocksProxyAgent } from 'socks-proxy-agent';
+import { AddressInfo } from 'node:net';
+import selfsigned from 'selfsigned';
 
 const kcFileName = 'testdata/kubeconfig.yaml';
 const kc2FileName = 'testdata/kubeconfig-2.yaml';
@@ -491,6 +493,28 @@ describe('KubeConfig', () => {
 
             strictEqual(rc.getAgent() instanceof https.Agent, true);
         });
+
+        it('should apply NODE_TLS_REJECT_UNAUTHORIZED from environment to agent', async () => {
+            const { server, host, port } = await createTestHttpsServer();
+            const originalValue = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+            process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+            after(() => {
+                server.close();
+                process.env.NODE_TLS_REJECT_UNAUTHORIZED = originalValue;
+            });
+
+            const kc = new KubeConfig();
+            const rc = new RequestContext(`https://${host}:${port}`, HttpMethod.GET);
+            await kc.applySecurityAuthentication(rc);
+            const res = await fetch(`https://${host}:${port}`, { agent: rc.getAgent() });
+            strictEqual(res.status, 200);
+            strictEqual(await res.text(), 'OK');
+
+            const res2 = await fetch(`https://${host}:${port}`, await kc.applyToFetchOptions({}));
+            strictEqual(res2.status, 200);
+            strictEqual(await res2.text(), 'OK');
+            delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+        });
     });
 
     describe('loadClusterConfigObjects', () => {
@@ -1827,3 +1851,32 @@ describe('KubeConfig', () => {
         });
     });
 });
+
+// create a self-signed HTTPS test server
+async function createTestHttpsServer(): Promise<{
+    server: https.Server;
+    host: string;
+    port: number;
+    ca: string;
+}> {
+    const host = 'localhost';
+    const { private: key, cert } = selfsigned.generate([{ name: 'commonName', value: host }]);
+
+    const server = https.createServer({ key, cert }, (_req, res) => {
+        res.writeHead(200);
+        res.end('OK');
+    });
+
+    const port = await new Promise<number>((resolve) => {
+        server.listen(0, () => {
+            resolve((server.address() as AddressInfo).port);
+        });
+    });
+
+    return {
+        server,
+        host,
+        port,
+        ca: cert, // ca is the same as cert here
+    };
+}