@nitra/cfr 0.3.0 → 0.4.0

package/README.md

@@ -1,12 +1,14 @@
 # @nitra/cfr
 
 A handful of small k8s/GitOps CLI utilities, one `npx`/`bunx` away — no
-install, no dependencies. Two commands so far:
+install. Three commands so far:
 
 - **`check`** (default) — verify a Kustomize directory's `resources:` list
   matches what's actually on disk
 - **`kcc-inventory`** — diff a GCP Config Connector namespace against the
   live project to find drift
+- **`get-resources`** — the raw resource list `kcc-inventory` diffs,
+  without the diff
 
 ## `check`
 
@@ -146,6 +148,40 @@ already deleted in GCP. Both are cross-checked against a direct Compute
 Engine call before being reported, and any stale entry found this way is
 counted and noted separately — never silently folded into DRIFT.
 
+## `get-resources`
+
+`kcc-inventory` is a diff on top of a fact-finding step: for each KCC
+namespace, list what's live in GCP and what's declared under KCC. That
+step is `get-resources` — same scan, same filtering, no drift/orphan
+comparison. Useful on its own for piping into `jq`, feeding a different
+tool, or just seeing everything a namespace touches without wading
+through a diff.
+
+### Usage
+
+```sh
+npx @nitra/cfr get-resources <namespace>
+npx @nitra/cfr get-resources --all
+npx @nitra/cfr get-resources <namespace|--all> --json
+npx @nitra/cfr get-resources <namespace|--all> --include-system
+```
+
+```
+### namespace nitraai -> проєкт nitraai ###
+== StorageBucket ==
+  gcp: 7n-forgejo-lfs
+  gcp: old-backups-bucket
+  kcc: 7n-forgejo-lfs
+```
+
+`--json` emits `{resources: [{namespace, project, kind, id, source}, ...],
+diagnostics: [...]}` — `source` is `"gcp"` or `"kcc"`, `diagnostics`
+carries the same stale-cache/GKE-managed notes described above.
+
+Same requirements as `kcc-inventory`: `kubectl` on `PATH`, Application
+Default Credentials for the GCP side, `--include-system` to see
+GCP-managed noise.
+
 ## License
 
 MIT

package/bin/cli.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { run as runCheck } from '../lib/check.mjs';
 import { run as runKccInventory } from '../lib/kcc-inventory.mjs';
+import { run as runGetResources } from '../lib/get-resources.mjs';
 
 const TOP_HELP = `cfr (@nitra/cfr) — a handful of small k8s/GitOps CLI utilities
 
@@ -12,6 +13,7 @@ Commands:
   check           Verify kustomization.yaml resources: match the directory
                   (default when the first argument isn't a known command)
   kcc-inventory   GCP Config Connector (KCC) drift inventory
+  get-resources   Raw KCC/GCP resource list behind kcc-inventory, no diff
 
 Run "npx @nitra/cfr <command> --help" for command-specific help.
 `;
@@ -19,6 +21,7 @@ Run "npx @nitra/cfr <command> --help" for command-specific help.
 const COMMANDS = {
   check: runCheck,
   'kcc-inventory': runKccInventory,
+  'get-resources': runGetResources,
 };
 
 // check is synchronous (local filesystem only); kcc-inventory is async

package/lib/{kcc-resources.mjs → get-resources.mjs}

@@ -404,3 +404,110 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
 
   return { namespace, project, resources, diagnostics };
 }
+
+// --- CLI: `cfr get-resources` — collectNamespace() as its own subcommand,
+// no diffing. What kcc-inventory consumes, exposed directly for anyone
+// who wants the raw facts (piping into jq, feeding a different tool).
+
+export const HELP = `cfr get-resources — raw KCC/GCP resource list, no diff
+
+Usage:
+  npx @nitra/cfr get-resources <namespace>
+  npx @nitra/cfr get-resources --all
+  npx @nitra/cfr get-resources <namespace|--all> [--json] [--include-system]
+
+The mechanism kcc-inventory is built on, callable on its own: per KCC
+namespace (namespace carrying the annotation
+cnrm.cloud.google.com/project-id), lists every resource found live in the
+GCP project (source: gcp) and every one declared as a Config Connector
+custom resource in that namespace (source: kcc), for IAMServiceAccount,
+IAMServiceAccountKey, ArtifactRegistryRepository, ContainerCluster,
+ContainerNodePool, StorageBucket, ComputeAddress, DNSManagedZone,
+DNSRecordSet, and IAMPolicyMember. No drift/orphan diff — that's
+\`cfr kcc-inventory\`.
+
+By default GCP-managed system noise is filtered out (Google-owned service
+accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
+ACL entries, ...) — pass --include-system to see it anyway.
+
+Requires \`kubectl\` on PATH, pointed at the target cluster (set KUBE_CONTEXT
+to target a specific kubeconfig context explicitly instead of relying on
+the current one). The GCP side talks to Cloud Asset Inventory, IAM, and
+Compute Engine directly over REST via Application Default Credentials —
+no \`gcloud\` CLI needed.
+
+Options:
+  --json             Emit {resources, diagnostics} as JSON instead of the
+                      human-readable listing.
+  --include-system   Don't filter out GCP-managed system resources.
+  -h, --help         Show this help and exit.
+
+Exits 0 on a completed scan, 2 on a usage error.
+`;
+
+function printHuman(namespace, collected) {
+  console.log(`### namespace ${namespace} -> проєкт ${collected.project} ###`);
+  const byKind = new Map(KIND_ORDER.map((k) => [k, []]));
+  for (const r of collected.resources) byKind.get(r.kind)?.push(r);
+  for (const kind of KIND_ORDER) {
+    const entries = byKind.get(kind);
+    if (!entries.length) continue;
+    console.log(`== ${kind} ==`);
+    for (const { source, id } of [...entries].sort((a, b) => a.id.localeCompare(b.id))) {
+      console.log(`  ${source}: ${id}`);
+    }
+  }
+  if (collected.diagnostics.length) {
+    console.log('== diagnostics ==');
+    for (const d of collected.diagnostics) {
+      if (d.type === 'stale-cache') console.log(`  ${d.kind}: застарілий кеш Asset Inventory, ${d.count} запис(ів)`);
+      else if (d.type === 'gke-managed-skip') console.log(`  ${d.kind}: керує сам GKE — ${d.zones.join(', ')}`);
+    }
+  }
+  console.log('');
+}
+
+export async function run(argv) {
+  if (argv.includes('-h') || argv.includes('--help')) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+
+  const target = argv[0];
+  if (!target) {
+    console.error('usage: cfr get-resources <namespace|--all> [--json] [--include-system]  (KUBE_CONTEXT=... для явного контексту)');
+    return 2;
+  }
+  const jsonMode = argv.includes('--json');
+  const includeSystem = argv.includes('--include-system');
+
+  let namespaces;
+  if (target === '--all') {
+    namespaces = listKccNamespaces();
+    if (!namespaces.length) {
+      console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
+      return 2;
+    }
+  } else {
+    namespaces = [target];
+  }
+
+  const resources = [];
+  const diagnostics = [];
+  for (const namespace of namespaces) {
+    const collected = await collectNamespace(namespace, { includeSystem });
+    if (!collected.project) {
+      console.error(`namespace ${namespace} не має cnrm.cloud.google.com/project-id`);
+      continue;
+    }
+    if (jsonMode) {
+      for (const r of collected.resources) resources.push({ namespace, project: collected.project, ...r });
+      for (const d of collected.diagnostics) diagnostics.push({ namespace, project: collected.project, ...d });
+    } else {
+      printHuman(namespace, collected);
+    }
+  }
+
+  if (jsonMode) console.log(JSON.stringify({ resources, diagnostics }, null, 2));
+  return 0;
+}

package/lib/kcc-inventory.mjs

@@ -1,8 +1,8 @@
-// Diff і звіт над сирим списком з kcc-resources.mjs: що з GCP-ресурсів
+// Diff і звіт над сирим списком з get-resources.mjs: що з GCP-ресурсів
 // проєкту реально живе під KCC (описано в git), а що — "чуже" (створено
 // повз KCC). Суто читання, нічого не видаляє — вхідний контракт для
 // окремого cleanup-рішення, яке вирішує, що з DRIFT можна прибрати.
-import { collectNamespace, listKccNamespaces, KIND_ORDER } from './kcc-resources.mjs';
+import { collectNamespace, listKccNamespaces, KIND_ORDER } from './get-resources.mjs';
 
 export const HELP = `cfr kcc-inventory — GCP Config Connector (KCC) drift inventory
 
@@ -93,7 +93,7 @@ function printDiagnostic(diag, jsonMode, results, project) {
   }
 }
 
-// Groups the flat resources list from kcc-resources.mjs back into
+// Groups the flat resources list from get-resources.mjs back into
 // per-kind {live, kcc} arrays, diffs and prints each kind in KIND_ORDER,
 // interleaving each kind's diagnostics (if any) right before its report —
 // same order a human reading top to bottom expects.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nitra/cfr",
-  "version": "0.3.0",
-  "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift.",
+  "version": "0.4.0",
+  "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift; `get-resources` is that same scan without the diff.",
   "keywords": [
     "kustomize",
     "flux",