@nitra/cfr 0.3.0 → 0.5.0

package/README.md

@@ -1,12 +1,14 @@
 # @nitra/cfr
 
 A handful of small k8s/GitOps CLI utilities, one `npx`/`bunx` away — no
-install, no dependencies. Two commands so far:
+install. Three commands so far:
 
 - **`check`** (default) — verify a Kustomize directory's `resources:` list
   matches what's actually on disk
 - **`kcc-inventory`** — diff a GCP Config Connector namespace against the
   live project to find drift
+- **`get-resources`** — the raw resource list `kcc-inventory` diffs,
+  without the diff
 
 ## `check`
 
@@ -115,16 +117,24 @@ npx @nitra/cfr kcc-inventory <namespace|--all> --include-system  # don't filter
   чисто (11 live, 11 kcc)
 ```
 
-Requires `kubectl` on `PATH`, pointed at the target cluster. Set
-`KUBE_CONTEXT` to target a specific kubeconfig context explicitly instead
-of relying on the current one. The GCP side talks to Cloud Asset
-Inventory, IAM, and Compute Engine directly over REST — no `gcloud` CLI
-needed, just [Application Default
+No `gcloud` or `kubectl` CLI needed on `PATH` — the GCP side (Cloud Asset
+Inventory, IAM, Compute Engine) and the cluster side both talk REST
+directly, authenticated with [Application Default
 Credentials](https://cloud.google.com/docs/authentication/application-default-credentials)
 (`gcloud auth application-default login` locally, a service account key
 via `GOOGLE_APPLICATION_CREDENTIALS`, or the ambient credentials on
 GCE/GKE/Cloud Build).
 
+Cluster connection details still come from your kubeconfig (`KUBECONFIG`,
+default `~/.kube/config`) — that part isn't going anywhere, it's the only
+place the cluster's API server address and CA certificate live. Set
+`KUBE_CONTEXT` to target a specific context explicitly instead of relying
+on `current-context`. The GCP access token is used directly as the
+cluster bearer token (the same trick `gke-gcloud-auth-plugin` performs
+under `kubectl`), so this only works against **GKE** clusters — a
+kubeconfig using client certs, a static token, or a non-GCP exec plugin
+(EKS, AKS, ...) won't authenticate.
+
 By default, GCP-managed system noise is filtered out — Google-owned
 service accounts, `gcr.io` shims, GKE-managed node pools and DNS zones,
 legacy bucket ACL entries. Pass `--include-system` to see it anyway.
@@ -146,6 +156,39 @@ already deleted in GCP. Both are cross-checked against a direct Compute
 Engine call before being reported, and any stale entry found this way is
 counted and noted separately — never silently folded into DRIFT.
 
+## `get-resources`
+
+`kcc-inventory` is a diff on top of a fact-finding step: for each KCC
+namespace, list what's live in GCP and what's declared under KCC. That
+step is `get-resources` — same scan, same filtering, no drift/orphan
+comparison. Useful on its own for piping into `jq`, feeding a different
+tool, or just seeing everything a namespace touches without wading
+through a diff.
+
+### Usage
+
+```sh
+npx @nitra/cfr get-resources <namespace>
+npx @nitra/cfr get-resources --all
+npx @nitra/cfr get-resources <namespace|--all> --json
+npx @nitra/cfr get-resources <namespace|--all> --include-system
+```
+
+```
+### namespace nitraai -> проєкт nitraai ###
+== StorageBucket ==
+  gcp: 7n-forgejo-lfs
+  gcp: old-backups-bucket
+  kcc: 7n-forgejo-lfs
+```
+
+`--json` emits `{resources: [{namespace, project, kind, id, source}, ...],
+diagnostics: [...]}` — `source` is `"gcp"` or `"kcc"`, `diagnostics`
+carries the same stale-cache/GKE-managed notes described above.
+
+Same requirements as `kcc-inventory` — no `gcloud`/`kubectl` needed, GKE
+only, `--include-system` to see GCP-managed noise.
+
 ## License
 
 MIT

package/bin/cli.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { run as runCheck } from '../lib/check.mjs';
 import { run as runKccInventory } from '../lib/kcc-inventory.mjs';
+import { run as runGetResources } from '../lib/get-resources.mjs';
 
 const TOP_HELP = `cfr (@nitra/cfr) — a handful of small k8s/GitOps CLI utilities
 
@@ -12,6 +13,7 @@ Commands:
   check           Verify kustomization.yaml resources: match the directory
                   (default when the first argument isn't a known command)
   kcc-inventory   GCP Config Connector (KCC) drift inventory
+  get-resources   Raw KCC/GCP resource list behind kcc-inventory, no diff
 
 Run "npx @nitra/cfr <command> --help" for command-specific help.
 `;
@@ -19,11 +21,12 @@ Run "npx @nitra/cfr <command> --help" for command-specific help.
 const COMMANDS = {
   check: runCheck,
   'kcc-inventory': runKccInventory,
+  'get-resources': runGetResources,
 };
 
-// check is synchronous (local filesystem only); kcc-inventory is async
-// (talks to GCP/kubectl over the network) — awaiting a plain number is a
-// no-op, so this works for either.
+// check is synchronous (local filesystem only); the other two are async
+// (talk to GCP/Kubernetes over the network) — awaiting a plain number is
+// a no-op, so this works for either.
 async function main(argv) {
   if (argv[0] === '-h' || argv[0] === '--help') {
     process.stdout.write(TOP_HELP);

package/lib/gcp-rest.mjs

@@ -16,6 +16,18 @@ function client() {
   return authClientPromise;
 }
 
+/**
+ * Свіжий access token з того самого ADC-клієнта, що й GCP REST-виклики —
+ * спільний з k8s-rest.mjs: GKE приймає токен GCP IAM напряму як bearer
+ * (те саме, що робить `gke-gcloud-auth-plugin` під капотом kubectl), тож
+ * окремого клієнта чи окремого запиту токена для k8s-боку не треба.
+ */
+export async function getAccessToken() {
+  const c = await client();
+  const { token } = await c.getAccessToken();
+  return token;
+}
+
 /**
  * GET-запит, повертає розпарсений JSON. Помилку не ковтає мовчки — на
  * відміну від gcloud-версії (де collectNamespace просто бачив би порожній

package/lib/{kcc-resources.mjs → get-resources.mjs}

@@ -1,18 +1,18 @@
 // Сирий збір фактів для одного KCC namespace: що є "живого" в GCP-проєкті і
 // що заявлено як Config Connector CR у цьому namespace — для кожного з 10
 // видів ресурсів. Жодного diff-у, жодного форматування, жодного I/O в
-// консоль: тільки звернення до GCP REST API (через gcp-rest.mjs) і
-// kubectl, і нормалізація результату в плаский список. Diff і звіт —
-// робота kcc-inventory.mjs, який споживає цей список.
+// консоль: тільки звернення до GCP REST API (gcp-rest.mjs) і Kubernetes
+// REST API (k8s-rest.mjs), і нормалізація результату в плаский список.
+// Diff і звіт — робота kcc-inventory.mjs, який споживає цей список.
 //
-// GCP-бік іде напряму через REST (Application Default Credentials), не
-// через `gcloud` CLI: без залежності від встановленого на PATH gcloud, без
-// повільного старту Python-процесу на кожен виклик (сам по собі
-// перевірений внесок у затримку — один search-all-resources на проєкті з
-// сотнями активів під gcloud займав ~100с), і з реальною помилкою замість
-// мовчазного порожнього результату при збої автентифікації.
-import { spawnSync } from 'node:child_process';
+// Обидва боки йдуть напряму через REST (Application Default Credentials),
+// без gcloud/kubectl на PATH: без повільного старту процесу на кожен
+// виклик (сам по собі перевірений внесок у затримку — один
+// search-all-resources на проєкті з сотнями активів під gcloud займав
+// ~100с), і з реальною помилкою замість мовчазного порожнього результату
+// при збої автентифікації.
 import { getJson, paginate } from './gcp-rest.mjs';
+import { getNamespace, listNamespaces, listCustomObjects } from './k8s-rest.mjs';
 
 export const KIND_ORDER = [
   'IAMServiceAccount',
@@ -27,35 +27,9 @@ export const KIND_ORDER = [
   'IAMPolicyMember',
 ];
 
-function kubectlBase() {
-  const ctx = process.env.KUBE_CONTEXT;
-  return ctx ? ['kubectl', '--context', ctx] : ['kubectl'];
-}
-
-// maxBuffer: дефолтні 1MB замалі для kubectl get на namespace з великою
-// кількістю CR — spawnSync мовчки падає в ENOBUFS, і виклик, що його не
-// перевіряє (як тут), бачить порожній результат замість помилки. Той самий
-// клас бага, що раніше ловився на gcloud-виклику search-all-resources,
-// поки той не переїхав на пагінований REST (див. gcp-rest.mjs).
-function runCmd(cmd, args) {
-  return spawnSync(cmd, args, { encoding: 'utf8', maxBuffer: 100 * 1024 * 1024 });
-}
-
-function kubectlJson(...args) {
-  const [bin, ...base] = kubectlBase();
-  const proc = runCmd(bin, [...base, ...args, '-o', 'json']);
-  if (proc.status !== 0 || !proc.stdout || !proc.stdout.trim()) return null;
-  try {
-    return JSON.parse(proc.stdout);
-  } catch {
-    return null;
-  }
-}
-
-function kubectlField(crd, namespace, fieldFn) {
-  const data = kubectlJson('get', crd, '-n', namespace);
-  if (!data) return [];
-  return (data.items || []).map(fieldFn).filter(Boolean);
+async function kccField(kind, namespace, fieldFn) {
+  const items = await listCustomObjects(kind, namespace);
+  return items.map(fieldFn).filter(Boolean);
 }
 
 const ASSET_API = 'https://cloudasset.googleapis.com/v1';
@@ -186,8 +160,8 @@ function kccPolicyMemberId(item, project) {
 /**
  * Проєкт GCP, прив'язаний до namespace, або null, якщо анотація відсутня.
  */
-export function projectForNamespace(namespace) {
-  const ns = kubectlJson('get', 'namespace', namespace);
+export async function projectForNamespace(namespace) {
+  const ns = await getNamespace(namespace);
   return (ns && ns.metadata && ns.metadata.annotations
     && ns.metadata.annotations['cnrm.cloud.google.com/project-id']) || null;
 }
@@ -195,9 +169,9 @@ export function projectForNamespace(namespace) {
 /**
  * Усі namespace з анотацією cnrm.cloud.google.com/project-id.
  */
-export function listKccNamespaces() {
-  const data = kubectlJson('get', 'namespace');
-  return ((data && data.items) || [])
+export async function listKccNamespaces() {
+  const items = await listNamespaces();
+  return items
     .filter((i) => i.metadata && i.metadata.annotations && i.metadata.annotations['cnrm.cloud.google.com/project-id'])
     .map((i) => i.metadata.name);
 }
@@ -216,7 +190,7 @@ export function listKccNamespaces() {
  * (resources і diagnostics тоді порожні).
  */
 export async function collectNamespace(namespace, { includeSystem = false } = {}) {
-  const project = projectForNamespace(namespace);
+  const project = await projectForNamespace(namespace);
   if (!project) return { namespace, project: null, resources: [], diagnostics: [] };
 
   const resources = [];
@@ -235,8 +209,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   let liveSa = allLiveSa;
   if (!includeSystem) liveSa = liveSa.filter((e) => !isSystem(SA_SYSTEM, e));
   push('IAMServiceAccount', liveSa, 'gcp');
-  push('IAMServiceAccount', kubectlField(
-    'iamserviceaccounts.iam.cnrm.cloud.google.com', namespace,
+  push('IAMServiceAccount', await kccField(
+    'IAMServiceAccount', namespace,
     (i) => i.status && i.status.email,
   ), 'kcc');
 
@@ -247,10 +221,10 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   // процесів gcloud, найповільніша частина всього скану.
   const liveKey = (await Promise.all(allLiveSa.map(listUserManagedKeyIds))).flat();
   push('IAMServiceAccountKey', liveKey, 'gcp');
-  push('IAMServiceAccountKey', kubectlField(
-    'iamserviceaccountkeys.iam.cnrm.cloud.google.com', namespace,
+  push('IAMServiceAccountKey', (await kccField(
+    'IAMServiceAccountKey', namespace,
     (i) => i.status && i.status.name,
-  ).map((n) => n.split('/').pop()), 'kcc');
+  )).map((n) => n.split('/').pop()), 'kcc');
 
   // --- ArtifactRegistryRepository -------------------------------------------
   let liveAr = byType('artifactregistry.googleapis.com/Repository')
@@ -261,15 +235,15 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
     .filter(Boolean);
   if (!includeSystem) liveAr = liveAr.filter((r) => !isSystem(AR_SYSTEM, r));
   push('ArtifactRegistryRepository', liveAr, 'gcp');
-  push('ArtifactRegistryRepository', kubectlField(
-    'artifactregistryrepositories.artifactregistry.cnrm.cloud.google.com', namespace,
+  push('ArtifactRegistryRepository', await kccField(
+    'ArtifactRegistryRepository', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
   // --- ContainerCluster + ContainerNodePool ---------------------------------
   push('ContainerCluster', byType('container.googleapis.com/Cluster').map((a) => a.displayName), 'gcp');
-  push('ContainerCluster', kubectlField(
-    'containerclusters.container.cnrm.cloud.google.com', namespace,
+  push('ContainerCluster', await kccField(
+    'ContainerCluster', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
@@ -281,8 +255,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
     if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(`${cluster}/${pool}`);
   }
   push('ContainerNodePool', livePool, 'gcp');
-  push('ContainerNodePool', kubectlField(
-    'containernodepools.container.cnrm.cloud.google.com', namespace,
+  push('ContainerNodePool', await kccField(
+    'ContainerNodePool', namespace,
     (i) => {
       const ref = (i.spec && i.spec.clusterRef) || {};
       return `${ref.name || ref.external}/${i.spec && i.spec.resourceID}`;
@@ -293,8 +267,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   let liveBucket = byType('storage.googleapis.com/Bucket').map((a) => a.displayName);
   if (!includeSystem) liveBucket = liveBucket.filter((b) => !isSystemBucket(b, project));
   push('StorageBucket', liveBucket, 'gcp');
-  push('StorageBucket', kubectlField(
-    'storagebuckets.storage.cnrm.cloud.google.com', namespace,
+  push('StorageBucket', await kccField(
+    'StorageBucket', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
@@ -317,8 +291,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   const staleAddrCount = staleAddrCount0 - liveAddr.length;
   if (staleAddrCount) diagnostics.push({ kind: 'ComputeAddress', type: 'stale-cache', count: staleAddrCount });
   push('ComputeAddress', liveAddr, 'gcp');
-  push('ComputeAddress', kubectlField(
-    'computeaddresses.compute.cnrm.cloud.google.com', namespace,
+  push('ComputeAddress', await kccField(
+    'ComputeAddress', namespace,
     (i) => `${i.spec && i.spec.resourceID}/${(i.spec && i.spec.location) || 'global'}`,
   ), 'kcc');
 
@@ -334,8 +308,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
     diagnostics.push({ kind: 'DNSManagedZone', type: 'gke-managed-skip', zones: [...gkeZoneNames].sort() });
   }
   push('DNSManagedZone', liveZone, 'gcp');
-  push('DNSManagedZone', kubectlField(
-    'dnsmanagedzones.dns.cnrm.cloud.google.com', namespace,
+  push('DNSManagedZone', await kccField(
+    'DNSManagedZone', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
@@ -370,8 +344,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   }
   if (staleRrsetCount) diagnostics.push({ kind: 'DNSRecordSet', type: 'stale-cache', count: staleRrsetCount });
   push('DNSRecordSet', liveRrset, 'gcp');
-  push('DNSRecordSet', kubectlField(
-    'dnsrecordsets.dns.cnrm.cloud.google.com', namespace,
+  push('DNSRecordSet', await kccField(
+    'DNSRecordSet', namespace,
     (i) => {
       const zref = (i.spec && i.spec.managedZoneRef) || {};
       return `${zref.name}/${i.spec && i.spec.name}/${i.spec && i.spec.type}`;
@@ -395,12 +369,122 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   }
   push('IAMPolicyMember', liveIam, 'gcp');
 
-  const kccPolicyItems = kubectlJson('get', 'iampolicymembers.iam.cnrm.cloud.google.com', '-n', namespace);
-  push('IAMPolicyMember', ((kccPolicyItems && kccPolicyItems.items) || []).map((item) => {
-    const rid = kccPolicyMemberId(item, project);
-    const spec = item.spec || {};
-    return `${rid}/${spec.role}/${spec.member}`;
-  }), 'kcc');
+  push('IAMPolicyMember', await kccField(
+    'IAMPolicyMember', namespace,
+    (item) => {
+      const rid = kccPolicyMemberId(item, project);
+      const spec = item.spec || {};
+      return `${rid}/${spec.role}/${spec.member}`;
+    },
+  ), 'kcc');
 
   return { namespace, project, resources, diagnostics };
 }
+
+// --- CLI: `cfr get-resources` — collectNamespace() as its own subcommand,
+// no diffing. What kcc-inventory consumes, exposed directly for anyone
+// who wants the raw facts (piping into jq, feeding a different tool).
+
+export const HELP = `cfr get-resources — raw KCC/GCP resource list, no diff
+
+Usage:
+  npx @nitra/cfr get-resources <namespace>
+  npx @nitra/cfr get-resources --all
+  npx @nitra/cfr get-resources <namespace|--all> [--json] [--include-system]
+
+The mechanism kcc-inventory is built on, callable on its own: per KCC
+namespace (namespace carrying the annotation
+cnrm.cloud.google.com/project-id), lists every resource found live in the
+GCP project (source: gcp) and every one declared as a Config Connector
+custom resource in that namespace (source: kcc), for IAMServiceAccount,
+IAMServiceAccountKey, ArtifactRegistryRepository, ContainerCluster,
+ContainerNodePool, StorageBucket, ComputeAddress, DNSManagedZone,
+DNSRecordSet, and IAMPolicyMember. No drift/orphan diff — that's
+\`cfr kcc-inventory\`.
+
+By default GCP-managed system noise is filtered out (Google-owned service
+accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
+ACL entries, ...) — pass --include-system to see it anyway.
+
+No \`gcloud\` or \`kubectl\` CLI needed — both the GCP side and the cluster
+side talk REST directly, authenticated with Application Default
+Credentials. Cluster connection details (server, CA) still come from your
+kubeconfig (KUBECONFIG, default ~/.kube/config); set KUBE_CONTEXT to
+target a specific context explicitly instead of relying on
+current-context. Only tested against GKE.
+
+Options:
+  --json             Emit {resources, diagnostics} as JSON instead of the
+                      human-readable listing.
+  --include-system   Don't filter out GCP-managed system resources.
+  -h, --help         Show this help and exit.
+
+Exits 0 on a completed scan, 2 on a usage error.
+`;
+
+function printHuman(namespace, collected) {
+  console.log(`### namespace ${namespace} -> проєкт ${collected.project} ###`);
+  const byKind = new Map(KIND_ORDER.map((k) => [k, []]));
+  for (const r of collected.resources) byKind.get(r.kind)?.push(r);
+  for (const kind of KIND_ORDER) {
+    const entries = byKind.get(kind);
+    if (!entries.length) continue;
+    console.log(`== ${kind} ==`);
+    for (const { source, id } of [...entries].sort((a, b) => a.id.localeCompare(b.id))) {
+      console.log(`  ${source}: ${id}`);
+    }
+  }
+  if (collected.diagnostics.length) {
+    console.log('== diagnostics ==');
+    for (const d of collected.diagnostics) {
+      if (d.type === 'stale-cache') console.log(`  ${d.kind}: застарілий кеш Asset Inventory, ${d.count} запис(ів)`);
+      else if (d.type === 'gke-managed-skip') console.log(`  ${d.kind}: керує сам GKE — ${d.zones.join(', ')}`);
+    }
+  }
+  console.log('');
+}
+
+export async function run(argv) {
+  if (argv.includes('-h') || argv.includes('--help')) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+
+  const target = argv[0];
+  if (!target) {
+    console.error('usage: cfr get-resources <namespace|--all> [--json] [--include-system]  (KUBE_CONTEXT=... для явного контексту)');
+    return 2;
+  }
+  const jsonMode = argv.includes('--json');
+  const includeSystem = argv.includes('--include-system');
+
+  let namespaces;
+  if (target === '--all') {
+    namespaces = await listKccNamespaces();
+    if (!namespaces.length) {
+      console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
+      return 2;
+    }
+  } else {
+    namespaces = [target];
+  }
+
+  const resources = [];
+  const diagnostics = [];
+  for (const namespace of namespaces) {
+    const collected = await collectNamespace(namespace, { includeSystem });
+    if (!collected.project) {
+      console.error(`namespace ${namespace} не має cnrm.cloud.google.com/project-id`);
+      continue;
+    }
+    if (jsonMode) {
+      for (const r of collected.resources) resources.push({ namespace, project: collected.project, ...r });
+      for (const d of collected.diagnostics) diagnostics.push({ namespace, project: collected.project, ...d });
+    } else {
+      printHuman(namespace, collected);
+    }
+  }
+
+  if (jsonMode) console.log(JSON.stringify({ resources, diagnostics }, null, 2));
+  return 0;
+}

package/lib/k8s-rest.mjs

@@ -0,0 +1,146 @@
+// Тонкий REST-транспорт до Kubernetes API server — заміна шелл-аутів у
+// kubectl CLI, для тих самих причин, що gcp-rest.mjs замінив gcloud: без
+// залежності від встановленого на PATH kubectl.
+//
+// Автентифікація — той самий ADC-токен, що йде на GCP REST-виклики
+// (gcp-rest.mjs:getAccessToken), не токен із самого kubeconfig. GKE
+// приймає OAuth2-токен GCP IAM напряму як bearer — це буквально те, що
+// робить exec-плагін `gke-gcloud-auth-plugin` під капотом kubectl, тільки
+// без окремого бінарника. Тому цей шар навмисно вузький: працює для GKE
+// (єдиний тип кластера, на якому реально стоїть KCC), не претендує бути
+// клієнтом для будь-якого kubeconfig — client-cert- чи Azure/AWS-подібна
+// exec-автентифікація тут не підтримується.
+//
+// server/CA беруться з kubeconfig як завжди (KUBECONFIG, чи
+// ~/.kube/config; контекст — KUBE_CONTEXT, чи current-context файлу).
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import https from 'node:https';
+import { parse as parseYaml } from 'yaml';
+import { getAccessToken } from './gcp-rest.mjs';
+
+function kubeconfigPath() {
+  return process.env.KUBECONFIG || join(homedir(), '.kube', 'config');
+}
+
+let configCache;
+function loadKubeconfig() {
+  if (!configCache) configCache = parseYaml(readFileSync(kubeconfigPath(), 'utf8'));
+  return configCache;
+}
+
+let clusterInfoCache;
+function clusterInfo() {
+  if (clusterInfoCache) return clusterInfoCache;
+
+  const config = loadKubeconfig();
+  const contextName = process.env.KUBE_CONTEXT || config['current-context'];
+  if (!contextName) throw new Error('kubeconfig has no current-context (set KUBE_CONTEXT)');
+
+  const ctxEntry = (config.contexts || []).find((c) => c.name === contextName);
+  if (!ctxEntry) throw new Error(`context "${contextName}" not found in kubeconfig`);
+
+  const clusterName = ctxEntry.context.cluster;
+  const clusterEntry = (config.clusters || []).find((c) => c.name === clusterName);
+  if (!clusterEntry) throw new Error(`cluster "${clusterName}" not found in kubeconfig`);
+
+  const cluster = clusterEntry.cluster;
+  const ca = cluster['certificate-authority-data']
+    ? Buffer.from(cluster['certificate-authority-data'], 'base64')
+    : cluster['certificate-authority']
+      ? readFileSync(cluster['certificate-authority'])
+      : undefined;
+
+  clusterInfoCache = { server: cluster.server, ca, insecureSkipTlsVerify: !!cluster['insecure-skip-tls-verify'] };
+  return clusterInfoCache;
+}
+
+async function requestJson(pathAndQuery) {
+  const { server, ca, insecureSkipTlsVerify } = clusterInfo();
+  const token = await getAccessToken();
+  const url = new URL(pathAndQuery, server);
+
+  return new Promise((resolve, reject) => {
+    const req = https.request(url, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      ca,
+      rejectUnauthorized: !insecureSkipTlsVerify,
+    }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => {
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          const err = new Error(`kubernetes API ${res.statusCode} ${pathAndQuery}: ${body.slice(0, 300)}`);
+          err.status = res.statusCode;
+          reject(err);
+          return;
+        }
+        try {
+          resolve(body ? JSON.parse(body) : null);
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+/**
+ * Один namespace, або null якщо його немає (404) — той самий сигнал, що
+ * раніше давав ненульовий exit-код kubectl.
+ */
+export async function getNamespace(name) {
+  try {
+    return await requestJson(`/api/v1/namespaces/${encodeURIComponent(name)}`);
+  } catch (err) {
+    if (err.status === 404) return null;
+    throw err;
+  }
+}
+
+/**
+ * Усі namespace кластера.
+ */
+export async function listNamespaces() {
+  const data = await requestJson('/api/v1/namespaces');
+  return (data && data.items) || [];
+}
+
+// group + множина для кожного виду KCC-ресурсу, який сканує
+// get-resources.mjs. Версія скрізь v1beta1 — перевірено по всіх десяти
+// CRD на живому кластері (kubectl get crd ... -o jsonpath спрацьовує), і
+// це стандарт самого KCC, не наш вибір.
+const CRD_GVR = {
+  IAMServiceAccount: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccounts' },
+  IAMServiceAccountKey: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccountkeys' },
+  ArtifactRegistryRepository: { group: 'artifactregistry.cnrm.cloud.google.com', plural: 'artifactregistryrepositories' },
+  ContainerCluster: { group: 'container.cnrm.cloud.google.com', plural: 'containerclusters' },
+  ContainerNodePool: { group: 'container.cnrm.cloud.google.com', plural: 'containernodepools' },
+  StorageBucket: { group: 'storage.cnrm.cloud.google.com', plural: 'storagebuckets' },
+  ComputeAddress: { group: 'compute.cnrm.cloud.google.com', plural: 'computeaddresses' },
+  DNSManagedZone: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsmanagedzones' },
+  DNSRecordSet: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsrecordsets' },
+  IAMPolicyMember: { group: 'iam.cnrm.cloud.google.com', plural: 'iampolicymembers' },
+};
+
+/**
+ * Усі CR даного KCC-виду в namespace. Порожній масив, якщо CRD не
+ * встановлений (404) — той самий сигнал, що раніше давав ненульовий
+ * exit-код kubectl, коли CRD немає в кластері. Інші помилки (401/403/
+ * мережа) кидаються далі.
+ */
+export async function listCustomObjects(kind, namespace) {
+  const { group, plural } = CRD_GVR[kind];
+  try {
+    const data = await requestJson(`/apis/${group}/v1beta1/namespaces/${encodeURIComponent(namespace)}/${plural}`);
+    return (data && data.items) || [];
+  } catch (err) {
+    if (err.status === 404) return [];
+    throw err;
+  }
+}

package/lib/kcc-inventory.mjs

@@ -1,8 +1,8 @@
-// Diff і звіт над сирим списком з kcc-resources.mjs: що з GCP-ресурсів
+// Diff і звіт над сирим списком з get-resources.mjs: що з GCP-ресурсів
 // проєкту реально живе під KCC (описано в git), а що — "чуже" (створено
 // повз KCC). Суто читання, нічого не видаляє — вхідний контракт для
 // окремого cleanup-рішення, яке вирішує, що з DRIFT можна прибрати.
-import { collectNamespace, listKccNamespaces, KIND_ORDER } from './kcc-resources.mjs';
+import { collectNamespace, listKccNamespaces, KIND_ORDER } from './get-resources.mjs';
 
 export const HELP = `cfr kcc-inventory — GCP Config Connector (KCC) drift inventory
 
@@ -27,13 +27,17 @@ By default GCP-managed system noise is filtered out (Google-owned service
 accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
 ACL entries, ...) — pass --include-system to see it anyway.
 
-Requires \`kubectl\` on PATH, pointed at the target cluster (set KUBE_CONTEXT
-to target a specific kubeconfig context explicitly instead of relying on
-the current one). The GCP side talks to Cloud Asset Inventory, IAM, and
-Compute Engine directly over REST — no \`gcloud\` CLI needed, just
-Application Default Credentials (\`gcloud auth application-default login\`,
-a service account key via GOOGLE_APPLICATION_CREDENTIALS, or the ambient
-credentials on GCE/GKE/Cloud Build).
+No \`gcloud\` or \`kubectl\` CLI needed — both the GCP side (Cloud Asset
+Inventory, IAM, Compute Engine) and the cluster side talk REST directly,
+authenticated with Application Default Credentials (\`gcloud auth
+application-default login\` locally, a service account key via
+GOOGLE_APPLICATION_CREDENTIALS, or the ambient credentials on
+GCE/GKE/Cloud Build). Cluster connection details (server, CA) still come
+from your kubeconfig (KUBECONFIG, default ~/.kube/config); set
+KUBE_CONTEXT to target a specific context explicitly instead of relying
+on current-context. Only tested against GKE — the cluster-side REST calls
+assume a GCP OAuth2 token is a valid bearer token for the API server,
+which isn't true for every cluster type.
 
 Options:
   --json             Emit a JSON array of {kind, id, project, status} instead
@@ -93,7 +97,7 @@ function printDiagnostic(diag, jsonMode, results, project) {
   }
 }
 
-// Groups the flat resources list from kcc-resources.mjs back into
+// Groups the flat resources list from get-resources.mjs back into
 // per-kind {live, kcc} arrays, diffs and prints each kind in KIND_ORDER,
 // interleaving each kind's diagnostics (if any) right before its report —
 // same order a human reading top to bottom expects.
@@ -143,7 +147,7 @@ export async function run(argv) {
 
   let namespaces;
   if (target === '--all') {
-    namespaces = listKccNamespaces();
+    namespaces = await listKccNamespaces();
     if (!namespaces.length) {
       console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
       return 2;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nitra/cfr",
-  "version": "0.3.0",
-  "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift.",
+  "version": "0.5.0",
+  "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift; `get-resources` is that same scan without the diff.",
   "keywords": [
     "kustomize",
     "flux",
@@ -39,6 +39,7 @@
     "test": "node --test test/cli.test.mjs"
   },
   "dependencies": {
-    "google-auth-library": "^10.9.1"
+    "google-auth-library": "^10.9.1",
+    "yaml": "^2.9.0"
   }
 }