@nitra/cfr 0.1.2 → 0.3.0

package/README.md

@@ -1,19 +1,30 @@
 # @nitra/cfr
 
+A handful of small k8s/GitOps CLI utilities, one `npx`/`bunx` away — no
+install, no dependencies. Two commands so far:
+
+- **`check`** (default) — verify a Kustomize directory's `resources:` list
+  matches what's actually on disk
+- **`kcc-inventory`** — diff a GCP Config Connector namespace against the
+  live project to find drift
+
+## `check`
+
 Kustomize's `resources:` field is an **explicit list**, not a glob. Add a
 YAML manifest to a directory managed by a [Flux](https://fluxcd.io)
 `Kustomization` without listing it in `resources:`, and
 `kustomize-controller` silently skips it — no error, no warning, the
 object just never reaches the cluster.
 
-This CLI catches that drift before it ships: it compares every
+This command catches that drift before it ships: it compares every
 `*.yaml`/`*.yml` file physically present in a directory against the
 `resources:` list in its `kustomization.yaml`, in both directions.
 
-## Usage
+### Usage
 
 ```sh
 npx @nitra/cfr [dir-or-kustomization.yaml ...]
+npx @nitra/cfr check [dir-or-kustomization.yaml ...]   # same, explicit
 ```
 
 No arguments checks `.`. Point it at one or more directories (or direct
@@ -47,7 +58,7 @@ jobs:
       - run: npx @nitra/cfr flux/clusters/production
 ```
 
-## What it checks
+### What it checks
 
 For each target directory:
 
@@ -61,13 +72,79 @@ Entries containing `/` (subdirectories, components) or a URL scheme
 against the specific footgun of a loose file sitting next to
 `kustomization.yaml` that nobody remembered to list.
 
-## Why this exists
+### Why this exists
 
 A real incident: a PR added two manifests to a Flux cluster directory but
 missed adding them to `resources:`. The PR merged clean, CI was green,
 `git log` showed the files — and Flux applied nothing. No error surfaced
 anywhere; the only symptom was the feature silently not existing in the
-cluster. This tool turns that into a CI failure at PR time instead.
+cluster. This command turns that into a CI failure at PR time instead.
+
+## `kcc-inventory`
+
+[Config Connector](https://cloud.google.com/config-connector/docs/overview)
+(KCC) lets a Kubernetes namespace declare a GCP project's resources as
+CRs, with a controller reconciling git against reality. It won't tell you
+about the reverse direction: a resource created straight in GCP — by hand,
+by another tool, by a Terraform run nobody ported — that KCC has never
+heard of, and never will until someone points it out.
+
+`kcc-inventory` is that someone. Per namespace (any namespace carrying the
+annotation `cnrm.cloud.google.com/project-id`), it compares what's live in
+the GCP project against what's declared under KCC, for
+`IAMServiceAccount`, `IAMServiceAccountKey`, `ArtifactRegistryRepository`,
+`ContainerCluster`, `ContainerNodePool`, `StorageBucket`, `ComputeAddress`,
+`DNSManagedZone`, `DNSRecordSet`, and `IAMPolicyMember`.
+
+Read-only — it reports, it doesn't touch anything.
+
+### Usage
+
+```sh
+npx @nitra/cfr kcc-inventory <namespace>
+npx @nitra/cfr kcc-inventory --all                              # every KCC namespace
+npx @nitra/cfr kcc-inventory <namespace|--all> --json
+npx @nitra/cfr kcc-inventory <namespace|--all> --include-system  # don't filter GCP-managed noise
+```
+
+```
+### namespace nitraai -> проєкт nitraai ###
+== StorageBucket (проєкт nitraai) ==
+  DRIFT — є в GCP, немає в KCC:
+    old-backups-bucket
+  чисто (11 live, 11 kcc)
+```
+
+Requires `kubectl` on `PATH`, pointed at the target cluster. Set
+`KUBE_CONTEXT` to target a specific kubeconfig context explicitly instead
+of relying on the current one. The GCP side talks to Cloud Asset
+Inventory, IAM, and Compute Engine directly over REST — no `gcloud` CLI
+needed, just [Application Default
+Credentials](https://cloud.google.com/docs/authentication/application-default-credentials)
+(`gcloud auth application-default login` locally, a service account key
+via `GOOGLE_APPLICATION_CREDENTIALS`, or the ambient credentials on
+GCE/GKE/Cloud Build).
+
+By default, GCP-managed system noise is filtered out — Google-owned
+service accounts, `gcr.io` shims, GKE-managed node pools and DNS zones,
+legacy bucket ACL entries. Pass `--include-system` to see it anyway.
+
+### Two directions
+
+- **DRIFT** — live in GCP, not declared under KCC. Either adopt it (give
+  it a matching CR with the right `resourceID`) or delete it by hand.
+- **ORPHAN** — declared under KCC, no longer live in GCP. The CR is
+  pointing at nothing; safe to remove from git.
+
+### A known Cloud Asset Inventory quirk
+
+`kcc-inventory` calls `searchAllResources`/`searchAllIamPolicies` on the
+Cloud Asset API — one or two paginated calls per project instead of a
+list call per resource kind. That index can lag: it has been observed
+returning `DNSRecordSet` and `ComputeAddress` entries for resources
+already deleted in GCP. Both are cross-checked against a direct Compute
+Engine call before being reported, and any stale entry found this way is
+counted and noted separately — never silently folded into DRIFT.
 
 ## License
 

package/bin/cli.mjs

@@ -1,137 +1,48 @@
 #!/usr/bin/env node
-// Kustomize's `resources:` field is an explicit list, not a glob. Add a
-// YAML file to a Kustomize directory without listing it there and
-// kustomize-controller silently skips it — no error, no warning, the
-// resource just never reaches the cluster. This CLI catches that drift
-// before it ships.
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { basename, dirname, join, resolve } from 'node:path';
+import { run as runCheck } from '../lib/check.mjs';
+import { run as runKccInventory } from '../lib/kcc-inventory.mjs';
 
-const HELP = `cfr (@nitra/cfr) — verify kustomization.yaml resources: match the directory
+const TOP_HELP = `cfr (@nitra/cfr) — a handful of small k8s/GitOps CLI utilities
 
 Usage:
   npx @nitra/cfr [dir-or-kustomization.yaml ...]
+  npx @nitra/cfr <command> [args...]
 
-Each argument is either a directory containing a kustomization.yaml (or
-kustomization.yml), or a direct path to one. Defaults to "." when no
-argument is given.
+Commands:
+  check           Verify kustomization.yaml resources: match the directory
+                  (default when the first argument isn't a known command)
+  kcc-inventory   GCP Config Connector (KCC) drift inventory
 
-For each target, compares:
-  - every *.yaml/*.yml file physically present in the directory
-  - every plain-filename entry under the top-level "resources:" list
-
-and reports both directions: files on disk missing from resources: (Flux
-will never apply them), and resources: entries with no matching file
-(dead reference). Entries containing "/" or a URL scheme (subdirectories,
-components, remote bases) are out of scope and skipped.
-
-Exits 0 when every target is consistent, 1 otherwise.
-
-Options:
-  -h, --help    Show this help and exit.
+Run "npx @nitra/cfr <command> --help" for command-specific help.
 `;
 
-function findKustomization(target) {
-  const abs = resolve(target);
-  let stat;
-  try {
-    stat = statSync(abs);
-  } catch {
-    return { error: `${target}: no such file or directory` };
-  }
-  if (stat.isFile()) {
-    return { dir: dirname(abs), file: abs };
-  }
-  for (const name of ['kustomization.yaml', 'kustomization.yml']) {
-    const candidate = join(abs, name);
-    try {
-      if (statSync(candidate).isFile()) return { dir: abs, file: candidate };
-    } catch {
-      // try next
-    }
-  }
-  return { error: `${target}: no kustomization.yaml (or .yml) found` };
-}
-
-function extractResources(text) {
-  const lines = text.split('\n');
-  const entries = [];
-  let inBlock = false;
-  for (const line of lines) {
-    if (!inBlock) {
-      if (/^resources:\s*(#.*)?$/.test(line)) inBlock = true;
-      continue;
-    }
-    if (line.trim() === '') continue;
-    const item = line.match(/^\s+-\s*(.+?)\s*(#.*)?$/);
-    if (!item) break; // dedented past the list — block is over
-    let value = item[1].trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    entries.push(value);
-  }
-  return entries;
-}
-
-function isLocalYamlFilename(entry) {
-  return /^[^/]+\.ya?ml$/i.test(entry) && !/^[a-z]+:\/\//i.test(entry);
-}
-
-function checkTarget(target) {
-  const found = findKustomization(target);
-  if (found.error) return { target, ok: false, error: found.error };
-
-  const { dir, file } = found;
-  const onDisk = new Set(
-    readdirSync(dir).filter((name) => /\.ya?ml$/i.test(name) && join(dir, name) !== file),
-  );
-
-  const listedAll = extractResources(readFileSync(file, 'utf8'));
-  const listedLocal = new Set(listedAll.filter(isLocalYamlFilename));
-
-  const missing = [...onDisk].filter((name) => !listedLocal.has(name)).sort();
-  const dangling = [...listedLocal].filter((name) => !onDisk.has(name)).sort();
-
-  return { target, ok: missing.length === 0 && dangling.length === 0, file, missing, dangling };
-}
-
-function main(argv) {
-  if (argv.includes('-h') || argv.includes('--help')) {
-    process.stdout.write(HELP);
+const COMMANDS = {
+  check: runCheck,
+  'kcc-inventory': runKccInventory,
+};
+
+// check is synchronous (local filesystem only); kcc-inventory is async
+// (talks to GCP/kubectl over the network) — awaiting a plain number is a
+// no-op, so this works for either.
+async function main(argv) {
+  if (argv[0] === '-h' || argv[0] === '--help') {
+    process.stdout.write(TOP_HELP);
     return 0;
   }
 
-  const targets = argv.length > 0 ? argv : ['.'];
-  let exitCode = 0;
-
-  for (const target of targets) {
-    const result = checkTarget(target);
-    if (result.error) {
-      console.error(`✗ ${result.target}: ${result.error}`);
-      exitCode = 1;
-      continue;
-    }
-    if (result.ok) {
-      console.log(`✓ ${result.file}`);
-      continue;
-    }
-    exitCode = 1;
-    console.error(`✗ ${result.file}`);
-    if (result.missing.length > 0) {
-      console.error('  on disk but missing from resources: (Flux will not apply them):');
-      for (const name of result.missing) console.error(`    - ${name}`);
-    }
-    if (result.dangling.length > 0) {
-      console.error('  listed in resources: but missing on disk:');
-      for (const name of result.dangling) console.error(`    - ${name}`);
-    }
-  }
-
-  return exitCode;
+  const [first, ...rest] = argv;
+  const command = COMMANDS[first];
+  // No recognized subcommand name in front — treat the whole argv as
+  // arguments to the default command (`check`), same as before subcommands
+  // existed: `npx @nitra/cfr flux/clusters/prod` still just works.
+  if (!command) return runCheck(argv);
+  return command(rest);
 }
 
-process.exit(main(process.argv.slice(2)));
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    console.error(`✗ ${err.message || err}`);
+    process.exit(1);
+  },
+);

package/lib/check.mjs

@@ -0,0 +1,135 @@
+// Kustomize's `resources:` field is an explicit list, not a glob. Add a
+// YAML file to a Kustomize directory without listing it there and
+// kustomize-controller silently skips it — no error, no warning, the
+// resource just never reaches the cluster. This command catches that
+// drift before it ships.
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+export const HELP = `cfr check — verify kustomization.yaml resources: match the directory
+
+Usage:
+  npx @nitra/cfr [dir-or-kustomization.yaml ...]
+  npx @nitra/cfr check [dir-or-kustomization.yaml ...]
+
+Each argument is either a directory containing a kustomization.yaml (or
+kustomization.yml), or a direct path to one. Defaults to "." when no
+argument is given.
+
+For each target, compares:
+  - every *.yaml/*.yml file physically present in the directory
+  - every plain-filename entry under the top-level "resources:" list
+
+and reports both directions: files on disk missing from resources: (Flux
+will never apply them), and resources: entries with no matching file
+(dead reference). Entries containing "/" or a URL scheme (subdirectories,
+components, remote bases) are out of scope and skipped.
+
+Exits 0 when every target is consistent, 1 otherwise.
+
+Options:
+  -h, --help    Show this help and exit.
+`;
+
+function findKustomization(target) {
+  const abs = resolve(target);
+  let stat;
+  try {
+    stat = statSync(abs);
+  } catch {
+    return { error: `${target}: no such file or directory` };
+  }
+  if (stat.isFile()) {
+    return { dir: dirname(abs), file: abs };
+  }
+  for (const name of ['kustomization.yaml', 'kustomization.yml']) {
+    const candidate = join(abs, name);
+    try {
+      if (statSync(candidate).isFile()) return { dir: abs, file: candidate };
+    } catch {
+      // try next
+    }
+  }
+  return { error: `${target}: no kustomization.yaml (or .yml) found` };
+}
+
+function extractResources(text) {
+  const lines = text.split('\n');
+  const entries = [];
+  let inBlock = false;
+  for (const line of lines) {
+    if (!inBlock) {
+      if (/^resources:\s*(#.*)?$/.test(line)) inBlock = true;
+      continue;
+    }
+    if (line.trim() === '') continue;
+    const item = line.match(/^\s+-\s*(.+?)\s*(#.*)?$/);
+    if (!item) break; // dedented past the list — block is over
+    let value = item[1].trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    entries.push(value);
+  }
+  return entries;
+}
+
+function isLocalYamlFilename(entry) {
+  return /^[^/]+\.ya?ml$/i.test(entry) && !/^[a-z]+:\/\//i.test(entry);
+}
+
+function checkTarget(target) {
+  const found = findKustomization(target);
+  if (found.error) return { target, ok: false, error: found.error };
+
+  const { dir, file } = found;
+  const onDisk = new Set(
+    readdirSync(dir).filter((name) => /\.ya?ml$/i.test(name) && join(dir, name) !== file),
+  );
+
+  const listedAll = extractResources(readFileSync(file, 'utf8'));
+  const listedLocal = new Set(listedAll.filter(isLocalYamlFilename));
+
+  const missing = [...onDisk].filter((name) => !listedLocal.has(name)).sort();
+  const dangling = [...listedLocal].filter((name) => !onDisk.has(name)).sort();
+
+  return { target, ok: missing.length === 0 && dangling.length === 0, file, missing, dangling };
+}
+
+export function run(argv) {
+  if (argv.includes('-h') || argv.includes('--help')) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+
+  const targets = argv.length > 0 ? argv : ['.'];
+  let exitCode = 0;
+
+  for (const target of targets) {
+    const result = checkTarget(target);
+    if (result.error) {
+      console.error(`✗ ${result.target}: ${result.error}`);
+      exitCode = 1;
+      continue;
+    }
+    if (result.ok) {
+      console.log(`✓ ${result.file}`);
+      continue;
+    }
+    exitCode = 1;
+    console.error(`✗ ${result.file}`);
+    if (result.missing.length > 0) {
+      console.error('  on disk but missing from resources: (Flux will not apply them):');
+      for (const name of result.missing) console.error(`    - ${name}`);
+    }
+    if (result.dangling.length > 0) {
+      console.error('  listed in resources: but missing on disk:');
+      for (const name of result.dangling) console.error(`    - ${name}`);
+    }
+  }
+
+  return exitCode;
+}

package/lib/gcp-rest.mjs

@@ -0,0 +1,43 @@
+// Тонкий REST-транспорт до Google Cloud API — заміна шелл-аутів у gcloud
+// CLI. Автентифікація через Application Default Credentials (той самий
+// механізм, що й gcloud: `gcloud auth application-default login` локально,
+// service account key через GOOGLE_APPLICATION_CREDENTIALS, метадата-сервер
+// на GCE/GKE) — жодного окремого налаштування не додає, лише прибирає
+// залежність від встановленого `gcloud` на PATH і повільний старт
+// Python-процесу на кожен виклик.
+import { GoogleAuth } from 'google-auth-library';
+
+let authClientPromise;
+function client() {
+  if (!authClientPromise) {
+    const auth = new GoogleAuth({ scopes: ['https://www.googleapis.com/auth/cloud-platform'] });
+    authClientPromise = auth.getClient();
+  }
+  return authClientPromise;
+}
+
+/**
+ * GET-запит, повертає розпарсений JSON. Помилку не ковтає мовчки — на
+ * відміну від gcloud-версії (де collectNamespace просто бачив би порожній
+ * результат), кидає далі, щоб причина (401/403/мережа) була видна.
+ */
+export async function getJson(url, params) {
+  const c = await client();
+  const res = await c.request({ url, params });
+  return res.data;
+}
+
+/**
+ * Пагінація за nextPageToken/pageToken — спільна для Asset Inventory
+ * (results[]) і Compute globalAddresses (items[]).
+ */
+export async function paginate(url, params, itemsKey) {
+  const out = [];
+  let pageToken;
+  do {
+    const data = await getJson(url, { ...params, pageToken });
+    out.push(...(data[itemsKey] || []));
+    pageToken = data.nextPageToken;
+  } while (pageToken);
+  return out;
+}

package/lib/kcc-inventory.mjs

@@ -0,0 +1,160 @@
+// Diff і звіт над сирим списком з kcc-resources.mjs: що з GCP-ресурсів
+// проєкту реально живе під KCC (описано в git), а що — "чуже" (створено
+// повз KCC). Суто читання, нічого не видаляє — вхідний контракт для
+// окремого cleanup-рішення, яке вирішує, що з DRIFT можна прибрати.
+import { collectNamespace, listKccNamespaces, KIND_ORDER } from './kcc-resources.mjs';
+
+export const HELP = `cfr kcc-inventory — GCP Config Connector (KCC) drift inventory
+
+Usage:
+  npx @nitra/cfr kcc-inventory <namespace>
+  npx @nitra/cfr kcc-inventory --all
+  npx @nitra/cfr kcc-inventory <namespace|--all> [--json] [--include-system]
+
+Compares, per KCC namespace (namespace carrying the annotation
+cnrm.cloud.google.com/project-id), what actually exists in the GCP project
+against what's declared as Config Connector custom resources in that
+namespace — for IAMServiceAccount, IAMServiceAccountKey,
+ArtifactRegistryRepository, ContainerCluster, ContainerNodePool,
+StorageBucket, ComputeAddress, DNSManagedZone, DNSRecordSet, and
+IAMPolicyMember.
+
+Reports two directions per kind:
+  DRIFT   — live in GCP, not declared under KCC (adopt it or delete it)
+  ORPHAN  — declared under KCC, no longer live in GCP
+
+By default GCP-managed system noise is filtered out (Google-owned service
+accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
+ACL entries, ...) — pass --include-system to see it anyway.
+
+Requires \`kubectl\` on PATH, pointed at the target cluster (set KUBE_CONTEXT
+to target a specific kubeconfig context explicitly instead of relying on
+the current one). The GCP side talks to Cloud Asset Inventory, IAM, and
+Compute Engine directly over REST — no \`gcloud\` CLI needed, just
+Application Default Credentials (\`gcloud auth application-default login\`,
+a service account key via GOOGLE_APPLICATION_CREDENTIALS, or the ambient
+credentials on GCE/GKE/Cloud Build).
+
+Options:
+  --json             Emit a JSON array of {kind, id, project, status} instead
+                      of the human-readable report.
+  --include-system   Don't filter out GCP-managed system resources.
+  -h, --help         Show this help and exit.
+
+Exits 0 on a completed scan (DRIFT/ORPHAN findings are not failures — this
+is a report, not a gate), 2 on a usage error.
+`;
+
+// --- diff+звіт по одному kind: sort+diff двох списків, людський звіт і/або JSON
+
+function report(kind, liveIds, kccIds, project, jsonMode, results) {
+  const live = [...new Set(liveIds.filter(Boolean))].sort();
+  const kcc = [...new Set(kccIds.filter(Boolean))].sort();
+  const kccSet = new Set(kcc);
+  const liveSet = new Set(live);
+  const drift = live.filter((x) => !kccSet.has(x)).sort();
+  const orphan = kcc.filter((x) => !liveSet.has(x)).sort();
+
+  if (!jsonMode) {
+    console.log(`== ${kind} (проєкт ${project}) ==`);
+    if (drift.length) {
+      console.log('  DRIFT — є в GCP, немає в KCC:');
+      for (const x of drift) console.log(`    ${x}`);
+    }
+    if (orphan.length) {
+      console.log('  ORPHAN — є в KCC, зникло з GCP:');
+      for (const x of orphan) console.log(`    ${x}`);
+    }
+    if (!drift.length && !orphan.length) {
+      console.log(`  чисто (${live.length} live, ${kcc.length} kcc)`);
+    }
+    console.log('');
+  }
+
+  for (const x of drift) results.push({ kind, id: x, project, status: 'drift' });
+  for (const x of orphan) results.push({ kind, id: x, project, status: 'orphan' });
+}
+
+function printDiagnostic(diag, jsonMode, results, project) {
+  if (diag.type === 'stale-cache') {
+    const label = diag.kind === 'ComputeAddress'
+      ? `проігноровано ${diag.count} запис(ів), яких уже нема в GCP (застарілий кеш Asset Inventory)`
+      : `проігноровано ${diag.count} запис(ів) від зон, яких уже нема (застарілий кеш Asset Inventory)`;
+    if (jsonMode) {
+      results.push({ kind: diag.kind, id: `stale_asset_inventory_cache:${diag.count}`, project, status: 'ignored' });
+    } else {
+      console.log(`== ${diag.kind}: ${label} ==`);
+      console.log('');
+    }
+  } else if (diag.type === 'gke-managed-skip' && !jsonMode) {
+    console.log(`== ${diag.kind}: пропущено (goog-gke-node, керує сам GKE) ==`);
+    for (const z of diag.zones) console.log(`    ${z}`);
+    console.log('');
+  }
+}
+
+// Groups the flat resources list from kcc-resources.mjs back into
+// per-kind {live, kcc} arrays, diffs and prints each kind in KIND_ORDER,
+// interleaving each kind's diagnostics (if any) right before its report —
+// same order a human reading top to bottom expects.
+function diffAndReport(collected, jsonMode, results) {
+  const { project, resources, diagnostics } = collected;
+  const byKind = new Map(KIND_ORDER.map((k) => [k, { live: [], kcc: [] }]));
+  for (const { kind, id, source } of resources) {
+    const bucket = byKind.get(kind);
+    if (!bucket) continue;
+    bucket[source === 'kcc' ? 'kcc' : 'live'].push(id);
+  }
+  const diagByKind = new Map();
+  for (const d of diagnostics) diagByKind.set(d.kind, d);
+
+  for (const kind of KIND_ORDER) {
+    const diag = diagByKind.get(kind);
+    if (diag) printDiagnostic(diag, jsonMode, results, project);
+    const { live, kcc } = byKind.get(kind);
+    report(kind, live, kcc, project, jsonMode, results);
+  }
+}
+
+async function scanNamespace(namespace, includeSystem, jsonMode, results) {
+  const collected = await collectNamespace(namespace, { includeSystem });
+  if (!collected.project) {
+    console.error(`namespace ${namespace} не має cnrm.cloud.google.com/project-id`);
+    return;
+  }
+  if (!jsonMode) console.log(`### namespace ${namespace} -> проєкт ${collected.project} ###`);
+  diffAndReport(collected, jsonMode, results);
+  if (!jsonMode) console.log('');
+}
+
+export async function run(argv) {
+  if (argv.includes('-h') || argv.includes('--help')) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+
+  const target = argv[0];
+  if (!target) {
+    console.error('usage: cfr kcc-inventory <namespace|--all> [--json] [--include-system]  (KUBE_CONTEXT=... для явного контексту)');
+    return 2;
+  }
+  const jsonMode = argv.includes('--json');
+  const includeSystem = argv.includes('--include-system');
+
+  let namespaces;
+  if (target === '--all') {
+    namespaces = listKccNamespaces();
+    if (!namespaces.length) {
+      console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
+      return 2;
+    }
+  } else {
+    namespaces = [target];
+  }
+
+  const results = [];
+  for (const ns of namespaces) await scanNamespace(ns, includeSystem, jsonMode, results);
+
+  if (jsonMode) console.log(JSON.stringify(results, null, 2));
+  return 0;
+}

package/lib/kcc-resources.mjs

@@ -0,0 +1,406 @@
+// Сирий збір фактів для одного KCC namespace: що є "живого" в GCP-проєкті і
+// що заявлено як Config Connector CR у цьому namespace — для кожного з 10
+// видів ресурсів. Жодного diff-у, жодного форматування, жодного I/O в
+// консоль: тільки звернення до GCP REST API (через gcp-rest.mjs) і
+// kubectl, і нормалізація результату в плаский список. Diff і звіт —
+// робота kcc-inventory.mjs, який споживає цей список.
+//
+// GCP-бік іде напряму через REST (Application Default Credentials), не
+// через `gcloud` CLI: без залежності від встановленого на PATH gcloud, без
+// повільного старту Python-процесу на кожен виклик (сам по собі
+// перевірений внесок у затримку — один search-all-resources на проєкті з
+// сотнями активів під gcloud займав ~100с), і з реальною помилкою замість
+// мовчазного порожнього результату при збої автентифікації.
+import { spawnSync } from 'node:child_process';
+import { getJson, paginate } from './gcp-rest.mjs';
+
+export const KIND_ORDER = [
+  'IAMServiceAccount',
+  'IAMServiceAccountKey',
+  'ArtifactRegistryRepository',
+  'ContainerCluster',
+  'ContainerNodePool',
+  'StorageBucket',
+  'ComputeAddress',
+  'DNSManagedZone',
+  'DNSRecordSet',
+  'IAMPolicyMember',
+];
+
+function kubectlBase() {
+  const ctx = process.env.KUBE_CONTEXT;
+  return ctx ? ['kubectl', '--context', ctx] : ['kubectl'];
+}
+
+// maxBuffer: дефолтні 1MB замалі для kubectl get на namespace з великою
+// кількістю CR — spawnSync мовчки падає в ENOBUFS, і виклик, що його не
+// перевіряє (як тут), бачить порожній результат замість помилки. Той самий
+// клас бага, що раніше ловився на gcloud-виклику search-all-resources,
+// поки той не переїхав на пагінований REST (див. gcp-rest.mjs).
+function runCmd(cmd, args) {
+  return spawnSync(cmd, args, { encoding: 'utf8', maxBuffer: 100 * 1024 * 1024 });
+}
+
+function kubectlJson(...args) {
+  const [bin, ...base] = kubectlBase();
+  const proc = runCmd(bin, [...base, ...args, '-o', 'json']);
+  if (proc.status !== 0 || !proc.stdout || !proc.stdout.trim()) return null;
+  try {
+    return JSON.parse(proc.stdout);
+  } catch {
+    return null;
+  }
+}
+
+function kubectlField(crd, namespace, fieldFn) {
+  const data = kubectlJson('get', crd, '-n', namespace);
+  if (!data) return [];
+  return (data.items || []).map(fieldFn).filter(Boolean);
+}
+
+const ASSET_API = 'https://cloudasset.googleapis.com/v1';
+const IAM_API = 'https://iam.googleapis.com/v1';
+const COMPUTE_API = 'https://compute.googleapis.com/compute/v1';
+
+function searchAllResources(project) {
+  return paginate(`${ASSET_API}/projects/${project}:searchAllResources`, { pageSize: 500 }, 'results');
+}
+
+function searchAllIamPolicies(project) {
+  return paginate(`${ASSET_API}/projects/${project}:searchAllIamPolicies`, { pageSize: 500 }, 'results');
+}
+
+// projects/-/serviceAccounts/{email} — валідний шлях в IAM API, project
+// беремо з листа `-`: не треба окремо передавати project поруч з email.
+async function listUserManagedKeyIds(email) {
+  const data = await getJson(`${IAM_API}/projects/-/serviceAccounts/${email}/keys`, { keyTypes: 'USER_MANAGED' });
+  return (data.keys || []).map((k) => k.name.split('/').pop());
+}
+
+// aggregatedList: один виклик на всі регіони одразу, а не по одному на
+// регіон. items — мапа "regions/{region}" -> {addresses: [...]}, не
+// плаский масив під nextPageToken, тому власна пагінація, не paginate().
+async function listRegionalAddressIds(project) {
+  const out = [];
+  let pageToken;
+  do {
+    const data = await getJson(`${COMPUTE_API}/projects/${project}/aggregated/addresses`, { pageSize: 500, pageToken });
+    for (const [scopeKey, val] of Object.entries(data.items || {})) {
+      if (!val.addresses) continue;
+      const region = scopeKey.replace(/^regions\//, '');
+      for (const a of val.addresses) out.push(`${a.name}/${region}`);
+    }
+    pageToken = data.nextPageToken;
+  } while (pageToken);
+  return out;
+}
+
+async function listGlobalAddressIds(project) {
+  const items = await paginate(`${COMPUTE_API}/projects/${project}/global/addresses`, { pageSize: 500 }, 'items');
+  return items.map((a) => `${a.name}/global`);
+}
+
+function stripPrefix(s, prefix) {
+  return s.startsWith(prefix) ? s.slice(prefix.length) : s;
+}
+
+// --- фільтри GCP-системного шуму (див. includeSystem) ----------------------
+
+const SA_SYSTEM = [
+  /^[0-9]+-compute@developer\.gserviceaccount\.com$/,
+  /@appspot\.gserviceaccount\.com$/,
+  /@cloudservices\.gserviceaccount\.com$/,
+  /^firebase-adminsdk-/,
+];
+
+const AR_SYSTEM = [/(^|\.)gcr\.io$/, /^gcf-artifacts$/];
+
+const NODEPOOL_SYSTEM = /^nap-/;
+
+function isSystemBucket(name, project) {
+  return name.endsWith('.appspot.com') || name.startsWith('gcf-sources-') || name === `${project}_cloudbuild`;
+}
+
+// projectEditor:/projectOwner:/projectViewer: — legacy bucket ACL, GCP
+// навішує на кожен бакет сам; решта — Google-керовані service agents.
+const IAM_SYSTEM = [
+  /^project(Editor|Owner|Viewer):/,
+  /@system\.gserviceaccount\.com$/,
+  /serviceAccount:service-[0-9]+@/,
+  /@gcp-sa-[a-z0-9-]+\.iam\.gserviceaccount\.com$/,
+  /@(cloudbuild|cloudservices|developer|appspot)\.gserviceaccount\.com$/,
+  /@(container-engine-robot|serverless-robot-prod|gcf-admin-robot|firebase-rules|firebase-sa-management)\.iam\.gserviceaccount\.com$/,
+];
+
+function isSystem(patterns, value) {
+  return patterns.some((p) => p.test(value));
+}
+
+// --- IAMPolicyMember: розбір id ресурсу з обох боків -----------------------
+
+function assetResId(entry, project) {
+  const assetType = entry.assetType || '';
+  const res = entry.resource || '';
+  if (res.endsWith(`/projects/${project}`)) return `project/${project}`;
+  const mSa = res.match(/\/serviceAccounts\/([^/]+)$/);
+  if (mSa && assetType === 'iam.googleapis.com/ServiceAccount') return `sa/${mSa[1]}`;
+  const mAr = res.match(/\/repositories\/([^/]+)$/);
+  if (mAr && assetType === 'artifactregistry.googleapis.com/Repository') return `ar/${mAr[1]}`;
+  if (assetType === 'storage.googleapis.com/Bucket') return 'bucket/' + stripPrefix(res, '//storage.googleapis.com/');
+  return 'other/' + stripPrefix(res, '//');
+}
+
+function kccArId(ref) {
+  const ext = ref.external || '';
+  const m = ext.match(/\/repositories\/([^/]+)$/);
+  if (m) return m[1];
+  if (ref.name) return ref.name;
+  return '?';
+}
+
+function kccSaId(ref, project) {
+  const ext = ref.external || '';
+  const m = ext.match(/\/serviceAccounts\/([^/]+)$/);
+  if (m) return m[1];
+  if (ext) return ext;
+  if (ref.name) return `${ref.name}@${project}.iam.gserviceaccount.com`;
+  return '?';
+}
+
+function kccPolicyMemberId(item, project) {
+  const ref = (item.spec && item.spec.resourceRef) || {};
+  switch (ref.kind) {
+    case 'Project':
+      return `project/${project}`;
+    case 'IAMServiceAccount':
+      return 'sa/' + kccSaId(ref, project);
+    case 'ArtifactRegistryRepository':
+      return 'ar/' + kccArId(ref);
+    case 'StorageBucket':
+      return 'bucket/' + (ref.external || ref.name || '?');
+    default:
+      return 'other/' + (ref.external || ref.name || '?');
+  }
+}
+
+/**
+ * Проєкт GCP, прив'язаний до namespace, або null, якщо анотація відсутня.
+ */
+export function projectForNamespace(namespace) {
+  const ns = kubectlJson('get', 'namespace', namespace);
+  return (ns && ns.metadata && ns.metadata.annotations
+    && ns.metadata.annotations['cnrm.cloud.google.com/project-id']) || null;
+}
+
+/**
+ * Усі namespace з анотацією cnrm.cloud.google.com/project-id.
+ */
+export function listKccNamespaces() {
+  const data = kubectlJson('get', 'namespace');
+  return ((data && data.items) || [])
+    .filter((i) => i.metadata && i.metadata.annotations && i.metadata.annotations['cnrm.cloud.google.com/project-id'])
+    .map((i) => i.metadata.name);
+}
+
+/**
+ * Збирає сирий список ресурсів одного namespace: усе, що живе в GCP
+ * (source: 'gcp'), і все, що заявлено під KCC (source: 'kcc'), для кожного
+ * з KIND_ORDER. Дублікати не прибираються — це відповідальність споживача.
+ *
+ * diagnostics — записи, які не є ні "живим", ні "заявленим" ресурсом, а
+ * приміткою про сам збір: застарілий кеш Cloud Asset Inventory, зони, якими
+ * керує сам GKE.
+ *
+ * Повертає { namespace, project, resources, diagnostics }. project — null,
+ * якщо namespace не має анотації cnrm.cloud.google.com/project-id
+ * (resources і diagnostics тоді порожні).
+ */
+export async function collectNamespace(namespace, { includeSystem = false } = {}) {
+  const project = projectForNamespace(namespace);
+  if (!project) return { namespace, project: null, resources: [], diagnostics: [] };
+
+  const resources = [];
+  const diagnostics = [];
+  const push = (kind, ids, source) => {
+    for (const id of ids) if (id) resources.push({ kind, id, source });
+  };
+
+  const assets = await searchAllResources(project);
+  const byType = (...types) => assets.filter((a) => types.includes(a.assetType));
+
+  // --- IAMServiceAccount ---------------------------------------------------
+  const allLiveSa = byType('iam.googleapis.com/ServiceAccount')
+    .map((a) => a.additionalAttributes && a.additionalAttributes.email)
+    .filter(Boolean);
+  let liveSa = allLiveSa;
+  if (!includeSystem) liveSa = liveSa.filter((e) => !isSystem(SA_SYSTEM, e));
+  push('IAMServiceAccount', liveSa, 'gcp');
+  push('IAMServiceAccount', kubectlField(
+    'iamserviceaccounts.iam.cnrm.cloud.google.com', namespace,
+    (i) => i.status && i.status.email,
+  ), 'kcc');
+
+  // --- IAMServiceAccountKey (тільки user-managed) ---------------------------
+  // Живі SA для циклу ключів беремо БЕЗ фільтра system — дешевше не
+  // ускладнювати, ключ системного SA все одно рідкість. Один REST-виклик
+  // на SA, усі паралельно — раніше це був послідовний цикл окремих
+  // процесів gcloud, найповільніша частина всього скану.
+  const liveKey = (await Promise.all(allLiveSa.map(listUserManagedKeyIds))).flat();
+  push('IAMServiceAccountKey', liveKey, 'gcp');
+  push('IAMServiceAccountKey', kubectlField(
+    'iamserviceaccountkeys.iam.cnrm.cloud.google.com', namespace,
+    (i) => i.status && i.status.name,
+  ).map((n) => n.split('/').pop()), 'kcc');
+
+  // --- ArtifactRegistryRepository -------------------------------------------
+  let liveAr = byType('artifactregistry.googleapis.com/Repository')
+    .map((a) => {
+      const m = (a.name || '').match(/\/repositories\/([^/]+)$/);
+      return m && m[1];
+    })
+    .filter(Boolean);
+  if (!includeSystem) liveAr = liveAr.filter((r) => !isSystem(AR_SYSTEM, r));
+  push('ArtifactRegistryRepository', liveAr, 'gcp');
+  push('ArtifactRegistryRepository', kubectlField(
+    'artifactregistryrepositories.artifactregistry.cnrm.cloud.google.com', namespace,
+    (i) => i.spec && i.spec.resourceID,
+  ), 'kcc');
+
+  // --- ContainerCluster + ContainerNodePool ---------------------------------
+  push('ContainerCluster', byType('container.googleapis.com/Cluster').map((a) => a.displayName), 'gcp');
+  push('ContainerCluster', kubectlField(
+    'containerclusters.container.cnrm.cloud.google.com', namespace,
+    (i) => i.spec && i.spec.resourceID,
+  ), 'kcc');
+
+  const livePool = [];
+  for (const a of byType('container.googleapis.com/NodePool')) {
+    const m = (a.name || '').match(/\/clusters\/([^/]+)\/nodePools\/([^/]+)$/);
+    if (!m) continue;
+    const [, cluster, pool] = m;
+    if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(`${cluster}/${pool}`);
+  }
+  push('ContainerNodePool', livePool, 'gcp');
+  push('ContainerNodePool', kubectlField(
+    'containernodepools.container.cnrm.cloud.google.com', namespace,
+    (i) => {
+      const ref = (i.spec && i.spec.clusterRef) || {};
+      return `${ref.name || ref.external}/${i.spec && i.spec.resourceID}`;
+    },
+  ), 'kcc');
+
+  // --- StorageBucket ---------------------------------------------------------
+  let liveBucket = byType('storage.googleapis.com/Bucket').map((a) => a.displayName);
+  if (!includeSystem) liveBucket = liveBucket.filter((b) => !isSystemBucket(b, project));
+  push('StorageBucket', liveBucket, 'gcp');
+  push('StorageBucket', kubectlField(
+    'storagebuckets.storage.cnrm.cloud.google.com', namespace,
+    (i) => i.spec && i.spec.resourceID,
+  ), 'kcc');
+
+  // --- ComputeAddress (регіональні й глобальні) -------------------------------
+  // Asset Inventory інколи повертає вже видалені адреси (перевірено
+  // емпірично на azovmemo: search-all-resources показав адресу без
+  // читабельного імені, якої `gcloud compute addresses describe` вже не
+  // знаходить — той самий клас застарілого кешу, що й ResourceRecordSet).
+  // Два дешевих прямих виклики (regional + global), не по одному на
+  // ресурс, — фільтруємо ними ці привиди CAI.
+  const [regionalAddrIds, globalAddrIds] = await Promise.all([
+    listRegionalAddressIds(project),
+    listGlobalAddressIds(project),
+  ]);
+  const liveAddrIds = new Set([...regionalAddrIds, ...globalAddrIds]);
+  const staleAddrCount0 = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress').length;
+  const liveAddr = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress')
+    .map((a) => `${a.displayName}/${a.location === 'global' ? 'global' : a.location}`)
+    .filter((id) => liveAddrIds.has(id));
+  const staleAddrCount = staleAddrCount0 - liveAddr.length;
+  if (staleAddrCount) diagnostics.push({ kind: 'ComputeAddress', type: 'stale-cache', count: staleAddrCount });
+  push('ComputeAddress', liveAddr, 'gcp');
+  push('ComputeAddress', kubectlField(
+    'computeaddresses.compute.cnrm.cloud.google.com', namespace,
+    (i) => `${i.spec && i.spec.resourceID}/${(i.spec && i.spec.location) || 'global'}`,
+  ), 'kcc');
+
+  // --- DNSManagedZone + DNSRecordSet -------------------------------------------
+  // Зони, які GKE заводить і веде сам (label goog-gke-node) — не в diff
+  // узагалі: не KCC-кандидат, і рекордсетів там сотні на Service.
+  const zones = byType('dns.googleapis.com/ManagedZone');
+  const gkeZoneNames = new Set(
+    zones.filter((z) => z.labels && z.labels['goog-gke-node'] !== undefined).map((z) => z.displayName),
+  );
+  const liveZone = zones.map((z) => z.displayName).filter((n) => !gkeZoneNames.has(n));
+  if (gkeZoneNames.size) {
+    diagnostics.push({ kind: 'DNSManagedZone', type: 'gke-managed-skip', zones: [...gkeZoneNames].sort() });
+  }
+  push('DNSManagedZone', liveZone, 'gcp');
+  push('DNSManagedZone', kubectlField(
+    'dnsmanagedzones.dns.cnrm.cloud.google.com', namespace,
+    (i) => i.spec && i.spec.resourceID,
+  ), 'kcc');
+
+  // rrset .name містить числовий id зони, не читабельне ім'я — мапа
+  // id->displayName будується з тих самих ManagedZone-записів.
+  const zoneNameById = new Map();
+  for (const z of zones) {
+    const m = (z.name || '').match(/\/managedZones\/([^/]+)$/);
+    if (m) zoneNameById.set(m[1], z.displayName);
+  }
+  // Cloud Asset Inventory інколи повертає ResourceRecordSet від зон, яких
+  // уже немає (перевірено емпірично на azovmemo: rrsets посилались на три
+  // різні managedZone-id, жоден з яких не збігався з id живої зони —
+  // застарілий кеш після пересоздання GKE-зони). Запис без резолву в
+  // zoneNameById — не дрейф, а сміття CAI, тому пропускаємо мовчки, а не
+  // фолбечимось на сирий id (інакше він ніколи не збіжиться з
+  // gkeZoneNames і завжди рахувався б за DRIFT).
+  let staleRrsetCount = 0;
+  const liveRrset = [];
+  for (const a of byType('dns.googleapis.com/ResourceRecordSet')) {
+    const mZid = (a.parentFullResourceName || '').match(/\/managedZones\/([^/]+)$/);
+    if (!mZid) continue;
+    const zname = zoneNameById.get(mZid[1]);
+    if (zname === undefined) {
+      staleRrsetCount += 1;
+      continue;
+    }
+    if (gkeZoneNames.has(zname)) continue;
+    const mRr = (a.name || '').match(/\/rrsets\/(.+)\/([A-Za-z]+)$/);
+    if (!mRr) continue;
+    liveRrset.push(`${zname}/${mRr[1]}/${mRr[2]}`);
+  }
+  if (staleRrsetCount) diagnostics.push({ kind: 'DNSRecordSet', type: 'stale-cache', count: staleRrsetCount });
+  push('DNSRecordSet', liveRrset, 'gcp');
+  push('DNSRecordSet', kubectlField(
+    'dnsrecordsets.dns.cnrm.cloud.google.com', namespace,
+    (i) => {
+      const zref = (i.spec && i.spec.managedZoneRef) || {};
+      return `${zref.name}/${i.spec && i.spec.name}/${i.spec && i.spec.type}`;
+    },
+  ), 'kcc');
+
+  // --- IAMPolicyMember ---------------------------------------------------------
+  // search-all-iam-policies — усі біндинги проєкту одразу, на будь-якому
+  // типі ресурсу, не тільки на трьох раніше підтримуваних (Project/SA/AR).
+  const iamPolicies = await searchAllIamPolicies(project);
+  const liveIam = [];
+  for (const entry of iamPolicies) {
+    const rid = assetResId(entry, project);
+    for (const binding of (entry.policy && entry.policy.bindings) || []) {
+      for (const member of binding.members || []) {
+        if (includeSystem || !isSystem(IAM_SYSTEM, member)) {
+          liveIam.push(`${rid}/${binding.role}/${member}`);
+        }
+      }
+    }
+  }
+  push('IAMPolicyMember', liveIam, 'gcp');
+
+  const kccPolicyItems = kubectlJson('get', 'iampolicymembers.iam.cnrm.cloud.google.com', '-n', namespace);
+  push('IAMPolicyMember', ((kccPolicyItems && kccPolicyItems.items) || []).map((item) => {
+    const rid = kccPolicyMemberId(item, project);
+    const spec = item.spec || {};
+    return `${rid}/${spec.role}/${spec.member}`;
+  }), 'kcc');
+
+  return { namespace, project, resources, diagnostics };
+}

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "@nitra/cfr",
-  "version": "0.1.2",
-  "description": "Verify that every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa) — catches files Flux silently ignores.",
+  "version": "0.3.0",
+  "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift.",
   "keywords": [
     "kustomize",
     "flux",
     "fluxcd",
     "kubernetes",
     "gitops",
-    "lint"
+    "lint",
+    "config-connector",
+    "kcc",
+    "gcp"
   ],
   "homepage": "https://github.com/nitra/cfr#readme",
   "bugs": "https://github.com/nitra/cfr/issues",
@@ -26,12 +29,16 @@
     "cfr": "./bin/cli.mjs"
   },
   "files": [
-    "bin"
+    "bin",
+    "lib"
   ],
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "test": "node --test test/cli.test.mjs"
+  },
+  "dependencies": {
+    "google-auth-library": "^10.9.1"
   }
 }