@nitra/cfr 0.4.0 → 0.6.0

package/README.md

@@ -93,10 +93,16 @@ heard of, and never will until someone points it out.
 
 `kcc-inventory` is that someone. Per namespace (any namespace carrying the
 annotation `cnrm.cloud.google.com/project-id`), it compares what's live in
-the GCP project against what's declared under KCC, for
-`IAMServiceAccount`, `IAMServiceAccountKey`, `ArtifactRegistryRepository`,
-`ContainerCluster`, `ContainerNodePool`, `StorageBucket`, `ComputeAddress`,
-`DNSManagedZone`, `DNSRecordSet`, and `IAMPolicyMember`.
+the GCP project against what's declared under KCC. Besides IAM, GKE,
+Artifact Registry, buckets, addresses and Cloud DNS, it includes Cloud Run
+(`RunService`, `RunJob`), `CloudSchedulerJob`, `EventarcTrigger`, Pub/Sub,
+Secret Manager, VPC Access, KMS, and the Cloud Run HTTP(S) load-balancer
+chain (network, subnetwork, backend service, serverless NEG, URL map,
+target HTTPS proxy, global forwarding rule, and SSL certificates).
+
+Location-scoped resources use the canonical `location/name` ID, preventing
+resources with the same name in different regions from being merged. IAM
+bindings on a `RunService` are normalized to the same identity.
 
 Read-only — it reports, it doesn't touch anything.
 
@@ -117,16 +123,24 @@ npx @nitra/cfr kcc-inventory <namespace|--all> --include-system  # don't filter
   чисто (11 live, 11 kcc)
 ```
 
-Requires `kubectl` on `PATH`, pointed at the target cluster. Set
-`KUBE_CONTEXT` to target a specific kubeconfig context explicitly instead
-of relying on the current one. The GCP side talks to Cloud Asset
-Inventory, IAM, and Compute Engine directly over REST — no `gcloud` CLI
-needed, just [Application Default
+No `gcloud` or `kubectl` CLI needed on `PATH` — the GCP side (Cloud Asset
+Inventory, IAM, Compute Engine) and the cluster side both talk REST
+directly, authenticated with [Application Default
 Credentials](https://cloud.google.com/docs/authentication/application-default-credentials)
 (`gcloud auth application-default login` locally, a service account key
 via `GOOGLE_APPLICATION_CREDENTIALS`, or the ambient credentials on
 GCE/GKE/Cloud Build).
 
+Cluster connection details still come from your kubeconfig (`KUBECONFIG`,
+default `~/.kube/config`) — that part isn't going anywhere, it's the only
+place the cluster's API server address and CA certificate live. Set
+`KUBE_CONTEXT` to target a specific context explicitly instead of relying
+on `current-context`. The GCP access token is used directly as the
+cluster bearer token (the same trick `gke-gcloud-auth-plugin` performs
+under `kubectl`), so this only works against **GKE** clusters — a
+kubeconfig using client certs, a static token, or a non-GCP exec plugin
+(EKS, AKS, ...) won't authenticate.
+
 By default, GCP-managed system noise is filtered out — Google-owned
 service accounts, `gcr.io` shims, GKE-managed node pools and DNS zones,
 legacy bucket ACL entries. Pass `--include-system` to see it anyway.
@@ -178,9 +192,12 @@ npx @nitra/cfr get-resources <namespace|--all> --include-system
 diagnostics: [...]}` — `source` is `"gcp"` or `"kcc"`, `diagnostics`
 carries the same stale-cache/GKE-managed notes described above.
 
-Same requirements as `kcc-inventory`: `kubectl` on `PATH`, Application
-Default Credentials for the GCP side, `--include-system` to see
-GCP-managed noise.
+Same requirements as `kcc-inventory` — no `gcloud`/`kubectl` needed, GKE
+only, `--include-system` to see GCP-managed noise.
+
+## Changelog
+
+See [CHANGELOG.md](https://github.com/nitra/cfr/blob/main/CHANGELOG.md).
 
 ## License
 

package/bin/cli.mjs

@@ -24,9 +24,9 @@ const COMMANDS = {
   'get-resources': runGetResources,
 };
 
-// check is synchronous (local filesystem only); kcc-inventory is async
-// (talks to GCP/kubectl over the network) — awaiting a plain number is a
-// no-op, so this works for either.
+// check is synchronous (local filesystem only); the other two are async
+// (talk to GCP/Kubernetes over the network) — awaiting a plain number is
+// a no-op, so this works for either.
 async function main(argv) {
   if (argv[0] === '-h' || argv[0] === '--help') {
     process.stdout.write(TOP_HELP);

package/lib/gcp-rest.mjs

@@ -16,6 +16,18 @@ function client() {
   return authClientPromise;
 }
 
+/**
+ * Свіжий access token з того самого ADC-клієнта, що й GCP REST-виклики —
+ * спільний з k8s-rest.mjs: GKE приймає токен GCP IAM напряму як bearer
+ * (те саме, що робить `gke-gcloud-auth-plugin` під капотом kubectl), тож
+ * окремого клієнта чи окремого запиту токена для k8s-боку не треба.
+ */
+export async function getAccessToken() {
+  const c = await client();
+  const { token } = await c.getAccessToken();
+  return token;
+}
+
 /**
  * GET-запит, повертає розпарсений JSON. Помилку не ковтає мовчки — на
  * відміну від gcloud-версії (де collectNamespace просто бачив би порожній

package/lib/get-resources.mjs

@@ -1,18 +1,18 @@
 // Сирий збір фактів для одного KCC namespace: що є "живого" в GCP-проєкті і
-// що заявлено як Config Connector CR у цьому namespace — для кожного з 10
+// що заявлено як Config Connector CR у цьому namespace — для кожного з
 // видів ресурсів. Жодного diff-у, жодного форматування, жодного I/O в
-// консоль: тільки звернення до GCP REST API (через gcp-rest.mjs) і
-// kubectl, і нормалізація результату в плаский список. Diff і звіт —
-// робота kcc-inventory.mjs, який споживає цей список.
+// консоль: тільки звернення до GCP REST API (gcp-rest.mjs) і Kubernetes
+// REST API (k8s-rest.mjs), і нормалізація результату в плаский список.
+// Diff і звіт — робота kcc-inventory.mjs, який споживає цей список.
 //
-// GCP-бік іде напряму через REST (Application Default Credentials), не
-// через `gcloud` CLI: без залежності від встановленого на PATH gcloud, без
-// повільного старту Python-процесу на кожен виклик (сам по собі
-// перевірений внесок у затримку — один search-all-resources на проєкті з
-// сотнями активів під gcloud займав ~100с), і з реальною помилкою замість
-// мовчазного порожнього результату при збої автентифікації.
-import { spawnSync } from 'node:child_process';
+// Обидва боки йдуть напряму через REST (Application Default Credentials),
+// без gcloud/kubectl на PATH: без повільного старту процесу на кожен
+// виклик (сам по собі перевірений внесок у затримку — один
+// search-all-resources на проєкті з сотнями активів під gcloud займав
+// ~100с), і з реальною помилкою замість мовчазного порожнього результату
+// при збої автентифікації.
 import { getJson, paginate } from './gcp-rest.mjs';
+import { getNamespace, listNamespaces, listCustomObjects } from './k8s-rest.mjs';
 
 export const KIND_ORDER = [
   'IAMServiceAccount',
@@ -24,38 +24,29 @@ export const KIND_ORDER = [
   'ComputeAddress',
   'DNSManagedZone',
   'DNSRecordSet',
+  'RunService',
+  'RunJob',
+  'CloudSchedulerJob',
+  'EventarcTrigger',
+  'PubSubTopic',
+  'PubSubSubscription',
+  'SecretManagerSecret',
+  'VPCAccessConnector',
+  'ComputeNetwork',
+  'ComputeSubnetwork',
+  'KMSCryptoKey',
+  'ComputeBackendService',
+  'ComputeNetworkEndpointGroup',
+  'ComputeURLMap',
+  'ComputeTargetHTTPSProxy',
+  'ComputeGlobalForwardingRule',
+  'ComputeSSLCertificate',
   'IAMPolicyMember',
 ];
 
-function kubectlBase() {
-  const ctx = process.env.KUBE_CONTEXT;
-  return ctx ? ['kubectl', '--context', ctx] : ['kubectl'];
-}
-
-// maxBuffer: дефолтні 1MB замалі для kubectl get на namespace з великою
-// кількістю CR — spawnSync мовчки падає в ENOBUFS, і виклик, що його не
-// перевіряє (як тут), бачить порожній результат замість помилки. Той самий
-// клас бага, що раніше ловився на gcloud-виклику search-all-resources,
-// поки той не переїхав на пагінований REST (див. gcp-rest.mjs).
-function runCmd(cmd, args) {
-  return spawnSync(cmd, args, { encoding: 'utf8', maxBuffer: 100 * 1024 * 1024 });
-}
-
-function kubectlJson(...args) {
-  const [bin, ...base] = kubectlBase();
-  const proc = runCmd(bin, [...base, ...args, '-o', 'json']);
-  if (proc.status !== 0 || !proc.stdout || !proc.stdout.trim()) return null;
-  try {
-    return JSON.parse(proc.stdout);
-  } catch {
-    return null;
-  }
-}
-
-function kubectlField(crd, namespace, fieldFn) {
-  const data = kubectlJson('get', crd, '-n', namespace);
-  if (!data) return [];
-  return (data.items || []).map(fieldFn).filter(Boolean);
+async function kccField(kind, namespace, fieldFn) {
+  const items = await listCustomObjects(kind, namespace);
+  return items.map(fieldFn).filter(Boolean);
 }
 
 const ASSET_API = 'https://cloudasset.googleapis.com/v1';
@@ -88,7 +79,7 @@ async function listRegionalAddressIds(project) {
     for (const [scopeKey, val] of Object.entries(data.items || {})) {
       if (!val.addresses) continue;
       const region = scopeKey.replace(/^regions\//, '');
-      for (const a of val.addresses) out.push(`${a.name}/${region}`);
+      for (const a of val.addresses) out.push(`${region}/${a.name}`);
     }
     pageToken = data.nextPageToken;
   } while (pageToken);
@@ -97,13 +88,46 @@ async function listRegionalAddressIds(project) {
 
 async function listGlobalAddressIds(project) {
   const items = await paginate(`${COMPUTE_API}/projects/${project}/global/addresses`, { pageSize: 500 }, 'items');
-  return items.map((a) => `${a.name}/global`);
+  return items.map((a) => `global/${a.name}`);
 }
 
 function stripPrefix(s, prefix) {
   return s.startsWith(prefix) ? s.slice(prefix.length) : s;
 }
 
+// Один ID для всіх location/region/zone ресурсів: location/name. Це не дає
+// однаковим іменам у різних регіонах зливатися в один inventory запис.
+function assetScopedId(asset, collection) {
+  const m = (asset.name || '').match(new RegExp(`/(?:locations|regions|zones)/([^/]+)/${collection}/([^/]+)$`));
+  return m && `${m[1]}/${m[2]}`;
+}
+
+function kccScopedId(item, { defaultLocation, name = (i) => i.spec && i.spec.resourceID } = {}) {
+  const spec = item.spec || {};
+  const resourceName = name(item) || (item.metadata && item.metadata.name);
+  const location = spec.location || spec.region || spec.zone || defaultLocation;
+  return location && resourceName ? `${location}/${resourceName}` : null;
+}
+
+function resourceId(item) {
+  return (item.spec && item.spec.resourceID) || (item.metadata && item.metadata.name);
+}
+
+function liveScopedIds(assets, type, collection) {
+  return assets.filter((a) => a.assetType === type).map((a) => assetScopedId(a, collection)).filter(Boolean);
+}
+
+function assetGlobalOrScopedId(asset, collection) {
+  const scoped = assetScopedId(asset, collection);
+  if (scoped) return scoped;
+  const global = (asset.name || '').match(new RegExp(`/global/${collection}/([^/]+)$`));
+  return global && `global/${global[1]}`;
+}
+
+function liveGlobalOrScopedIds(assets, type, collection) {
+  return assets.filter((a) => a.assetType === type).map((a) => assetGlobalOrScopedId(a, collection)).filter(Boolean);
+}
+
 // --- фільтри GCP-системного шуму (див. includeSystem) ----------------------
 
 const SA_SYSTEM = [
@@ -147,6 +171,8 @@ function assetResId(entry, project) {
   const mAr = res.match(/\/repositories\/([^/]+)$/);
   if (mAr && assetType === 'artifactregistry.googleapis.com/Repository') return `ar/${mAr[1]}`;
   if (assetType === 'storage.googleapis.com/Bucket') return 'bucket/' + stripPrefix(res, '//storage.googleapis.com/');
+  const mRunService = res.match(/\/projects\/[^/]+\/locations\/([^/]+)\/services\/([^/]+)$/);
+  if (mRunService && assetType === 'run.googleapis.com/Service') return `run-service/${mRunService[1]}/${mRunService[2]}`;
   return 'other/' + stripPrefix(res, '//');
 }
 
@@ -167,7 +193,7 @@ function kccSaId(ref, project) {
   return '?';
 }
 
-function kccPolicyMemberId(item, project) {
+function kccPolicyMemberId(item, project, runServiceRefs) {
   const ref = (item.spec && item.spec.resourceRef) || {};
   switch (ref.kind) {
     case 'Project':
@@ -178,6 +204,12 @@ function kccPolicyMemberId(item, project) {
       return 'ar/' + kccArId(ref);
     case 'StorageBucket':
       return 'bucket/' + (ref.external || ref.name || '?');
+    case 'RunService': {
+      const external = ref.external || '';
+      const m = external.match(/projects\/[^/]+\/locations\/([^/]+)\/services\/([^/]+)$/);
+      if (m) return `run-service/${m[1]}/${m[2]}`;
+      return runServiceRefs.get(ref.name) || `run-service/?/${ref.name || '?'}`;
+    }
     default:
       return 'other/' + (ref.external || ref.name || '?');
   }
@@ -186,8 +218,8 @@ function kccPolicyMemberId(item, project) {
 /**
  * Проєкт GCP, прив'язаний до namespace, або null, якщо анотація відсутня.
  */
-export function projectForNamespace(namespace) {
-  const ns = kubectlJson('get', 'namespace', namespace);
+export async function projectForNamespace(namespace) {
+  const ns = await getNamespace(namespace);
   return (ns && ns.metadata && ns.metadata.annotations
     && ns.metadata.annotations['cnrm.cloud.google.com/project-id']) || null;
 }
@@ -195,9 +227,9 @@ export function projectForNamespace(namespace) {
 /**
  * Усі namespace з анотацією cnrm.cloud.google.com/project-id.
  */
-export function listKccNamespaces() {
-  const data = kubectlJson('get', 'namespace');
-  return ((data && data.items) || [])
+export async function listKccNamespaces() {
+  const items = await listNamespaces();
+  return items
     .filter((i) => i.metadata && i.metadata.annotations && i.metadata.annotations['cnrm.cloud.google.com/project-id'])
     .map((i) => i.metadata.name);
 }
@@ -216,7 +248,7 @@ export function listKccNamespaces() {
  * (resources і diagnostics тоді порожні).
  */
 export async function collectNamespace(namespace, { includeSystem = false } = {}) {
-  const project = projectForNamespace(namespace);
+  const project = await projectForNamespace(namespace);
   if (!project) return { namespace, project: null, resources: [], diagnostics: [] };
 
   const resources = [];
@@ -235,8 +267,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   let liveSa = allLiveSa;
   if (!includeSystem) liveSa = liveSa.filter((e) => !isSystem(SA_SYSTEM, e));
   push('IAMServiceAccount', liveSa, 'gcp');
-  push('IAMServiceAccount', kubectlField(
-    'iamserviceaccounts.iam.cnrm.cloud.google.com', namespace,
+  push('IAMServiceAccount', await kccField(
+    'IAMServiceAccount', namespace,
     (i) => i.status && i.status.email,
   ), 'kcc');
 
@@ -247,45 +279,42 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   // процесів gcloud, найповільніша частина всього скану.
   const liveKey = (await Promise.all(allLiveSa.map(listUserManagedKeyIds))).flat();
   push('IAMServiceAccountKey', liveKey, 'gcp');
-  push('IAMServiceAccountKey', kubectlField(
-    'iamserviceaccountkeys.iam.cnrm.cloud.google.com', namespace,
+  push('IAMServiceAccountKey', (await kccField(
+    'IAMServiceAccountKey', namespace,
     (i) => i.status && i.status.name,
-  ).map((n) => n.split('/').pop()), 'kcc');
+  )).map((n) => n.split('/').pop()), 'kcc');
 
   // --- ArtifactRegistryRepository -------------------------------------------
-  let liveAr = byType('artifactregistry.googleapis.com/Repository')
-    .map((a) => {
-      const m = (a.name || '').match(/\/repositories\/([^/]+)$/);
-      return m && m[1];
-    })
-    .filter(Boolean);
+  let liveAr = liveScopedIds(assets, 'artifactregistry.googleapis.com/Repository', 'repositories');
   if (!includeSystem) liveAr = liveAr.filter((r) => !isSystem(AR_SYSTEM, r));
   push('ArtifactRegistryRepository', liveAr, 'gcp');
-  push('ArtifactRegistryRepository', kubectlField(
-    'artifactregistryrepositories.artifactregistry.cnrm.cloud.google.com', namespace,
-    (i) => i.spec && i.spec.resourceID,
+  push('ArtifactRegistryRepository', await kccField(
+    'ArtifactRegistryRepository', namespace,
+    (i) => kccScopedId(i),
   ), 'kcc');
 
   // --- ContainerCluster + ContainerNodePool ---------------------------------
-  push('ContainerCluster', byType('container.googleapis.com/Cluster').map((a) => a.displayName), 'gcp');
-  push('ContainerCluster', kubectlField(
-    'containerclusters.container.cnrm.cloud.google.com', namespace,
-    (i) => i.spec && i.spec.resourceID,
-  ), 'kcc');
+  push('ContainerCluster', liveScopedIds(assets, 'container.googleapis.com/Cluster', 'clusters'), 'gcp');
+  const containerClusterItems = await listCustomObjects('ContainerCluster', namespace);
+  push('ContainerCluster', containerClusterItems.map((i) => kccScopedId(i)).filter(Boolean), 'kcc');
+  const clusterRefs = new Map(containerClusterItems.map((i) => [i.metadata && i.metadata.name, kccScopedId(i)]));
 
   const livePool = [];
   for (const a of byType('container.googleapis.com/NodePool')) {
     const m = (a.name || '').match(/\/clusters\/([^/]+)\/nodePools\/([^/]+)$/);
     if (!m) continue;
     const [, cluster, pool] = m;
-    if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(`${cluster}/${pool}`);
+    const location = (a.name || '').match(/\/locations\/([^/]+)\/clusters\/[^/]+\/nodePools\/[^/]+$/)?.[1];
+    if (includeSystem || !NODEPOOL_SYSTEM.test(pool)) livePool.push(location ? `${location}/${cluster}/${pool}` : `${cluster}/${pool}`);
   }
   push('ContainerNodePool', livePool, 'gcp');
-  push('ContainerNodePool', kubectlField(
-    'containernodepools.container.cnrm.cloud.google.com', namespace,
+  push('ContainerNodePool', await kccField(
+    'ContainerNodePool', namespace,
     (i) => {
       const ref = (i.spec && i.spec.clusterRef) || {};
-      return `${ref.name || ref.external}/${i.spec && i.spec.resourceID}`;
+      const external = ref.external || '';
+      const m = external.match(/\/locations\/([^/]+)\/clusters\/([^/]+)$/);
+      return m ? `${m[1]}/${m[2]}/${resourceId(i)}` : `${clusterRefs.get(ref.name) || ref.name || external}/${resourceId(i)}`;
     },
   ), 'kcc');
 
@@ -293,8 +322,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   let liveBucket = byType('storage.googleapis.com/Bucket').map((a) => a.displayName);
   if (!includeSystem) liveBucket = liveBucket.filter((b) => !isSystemBucket(b, project));
   push('StorageBucket', liveBucket, 'gcp');
-  push('StorageBucket', kubectlField(
-    'storagebuckets.storage.cnrm.cloud.google.com', namespace,
+  push('StorageBucket', await kccField(
+    'StorageBucket', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
@@ -312,14 +341,14 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   const liveAddrIds = new Set([...regionalAddrIds, ...globalAddrIds]);
   const staleAddrCount0 = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress').length;
   const liveAddr = byType('compute.googleapis.com/Address', 'compute.googleapis.com/GlobalAddress')
-    .map((a) => `${a.displayName}/${a.location === 'global' ? 'global' : a.location}`)
+    .map((a) => `${a.location === 'global' ? 'global' : a.location}/${a.displayName}`)
     .filter((id) => liveAddrIds.has(id));
   const staleAddrCount = staleAddrCount0 - liveAddr.length;
   if (staleAddrCount) diagnostics.push({ kind: 'ComputeAddress', type: 'stale-cache', count: staleAddrCount });
   push('ComputeAddress', liveAddr, 'gcp');
-  push('ComputeAddress', kubectlField(
-    'computeaddresses.compute.cnrm.cloud.google.com', namespace,
-    (i) => `${i.spec && i.spec.resourceID}/${(i.spec && i.spec.location) || 'global'}`,
+  push('ComputeAddress', await kccField(
+    'ComputeAddress', namespace,
+    (i) => kccScopedId(i, { defaultLocation: 'global' }),
   ), 'kcc');
 
   // --- DNSManagedZone + DNSRecordSet -------------------------------------------
@@ -334,8 +363,8 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
     diagnostics.push({ kind: 'DNSManagedZone', type: 'gke-managed-skip', zones: [...gkeZoneNames].sort() });
   }
   push('DNSManagedZone', liveZone, 'gcp');
-  push('DNSManagedZone', kubectlField(
-    'dnsmanagedzones.dns.cnrm.cloud.google.com', namespace,
+  push('DNSManagedZone', await kccField(
+    'DNSManagedZone', namespace,
     (i) => i.spec && i.spec.resourceID,
   ), 'kcc');
 
@@ -370,14 +399,80 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   }
   if (staleRrsetCount) diagnostics.push({ kind: 'DNSRecordSet', type: 'stale-cache', count: staleRrsetCount });
   push('DNSRecordSet', liveRrset, 'gcp');
-  push('DNSRecordSet', kubectlField(
-    'dnsrecordsets.dns.cnrm.cloud.google.com', namespace,
+  push('DNSRecordSet', await kccField(
+    'DNSRecordSet', namespace,
     (i) => {
       const zref = (i.spec && i.spec.managedZoneRef) || {};
       return `${zref.name}/${i.spec && i.spec.name}/${i.spec && i.spec.type}`;
     },
   ), 'kcc');
 
+  // --- Cloud Run та його тригери/залежності ---------------------------------
+  push('RunService', liveScopedIds(assets, 'run.googleapis.com/Service', 'services'), 'gcp');
+  const runServiceItems = await listCustomObjects('RunService', namespace);
+  push('RunService', runServiceItems.map((i) => kccScopedId(i)).filter(Boolean), 'kcc');
+
+  push('RunJob', liveScopedIds(assets, 'run.googleapis.com/Job', 'jobs'), 'gcp');
+  push('RunJob', await kccField('RunJob', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('CloudSchedulerJob', liveScopedIds(assets, 'cloudscheduler.googleapis.com/Job', 'jobs'), 'gcp');
+  push('CloudSchedulerJob', await kccField('CloudSchedulerJob', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('EventarcTrigger', liveScopedIds(assets, 'eventarc.googleapis.com/Trigger', 'triggers'), 'gcp');
+  push('EventarcTrigger', await kccField('EventarcTrigger', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  push('PubSubTopic', byType('pubsub.googleapis.com/Topic').map((a) => a.displayName), 'gcp');
+  push('PubSubTopic', await kccField('PubSubTopic', namespace, resourceId), 'kcc');
+  push('PubSubSubscription', byType('pubsub.googleapis.com/Subscription').map((a) => a.displayName), 'gcp');
+  push('PubSubSubscription', await kccField('PubSubSubscription', namespace, resourceId), 'kcc');
+
+  push('SecretManagerSecret', byType('secretmanager.googleapis.com/Secret').map((a) => a.displayName), 'gcp');
+  push('SecretManagerSecret', await kccField('SecretManagerSecret', namespace, resourceId), 'kcc');
+
+  push('VPCAccessConnector', liveScopedIds(assets, 'vpcaccess.googleapis.com/Connector', 'connectors'), 'gcp');
+  push('VPCAccessConnector', await kccField('VPCAccessConnector', namespace, (i) => kccScopedId(i)), 'kcc');
+  push('ComputeNetwork', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/Network', 'networks'), 'gcp');
+  push('ComputeNetwork', await kccField('ComputeNetwork', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeSubnetwork', liveScopedIds(assets, 'compute.googleapis.com/Subnetwork', 'subnetworks'), 'gcp');
+  push('ComputeSubnetwork', await kccField('ComputeSubnetwork', namespace, (i) => kccScopedId(i)), 'kcc');
+
+  // KMS key ідентифікується не лише ім'ям: keyRing теж є частиною URI.
+  const cryptoKeyId = (a) => {
+    const m = (a.name || '').match(/\/locations\/([^/]+)\/keyRings\/([^/]+)\/cryptoKeys\/([^/]+)$/);
+    return m && `${m[1]}/${m[2]}/${m[3]}`;
+  };
+  push('KMSCryptoKey', byType('cloudkms.googleapis.com/CryptoKey').map(cryptoKeyId).filter(Boolean), 'gcp');
+  push('KMSCryptoKey', await kccField('KMSCryptoKey', namespace, (i) => {
+    const ref = (i.spec && i.spec.keyRingRef) || {};
+    const m = (ref.external || '').match(/\/locations\/([^/]+)\/keyRings\/([^/]+)$/);
+    return m ? `${m[1]}/${m[2]}/${resourceId(i)}` : null;
+  }), 'kcc');
+
+  // --- HTTP(S) LB, що часто стоїть перед Cloud Run ---------------------------
+  push('ComputeBackendService', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/BackendService', 'backendServices'), 'gcp');
+  push('ComputeBackendService', await kccField('ComputeBackendService', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  const isServerlessNeg = (a) => (a.additionalAttributes && a.additionalAttributes.networkEndpointType) === 'SERVERLESS'
+    || (a.resource && a.resource.data && a.resource.data.networkEndpointType) === 'SERVERLESS';
+  push('ComputeNetworkEndpointGroup', byType('compute.googleapis.com/NetworkEndpointGroup')
+    .filter(isServerlessNeg).map((a) => assetGlobalOrScopedId(a, 'networkEndpointGroups')).filter(Boolean), 'gcp');
+  push('ComputeNetworkEndpointGroup', await kccField('ComputeNetworkEndpointGroup', namespace, (i) => {
+    const type = i.spec && i.spec.networkEndpointType;
+    return type === 'SERVERLESS' ? kccScopedId(i, { defaultLocation: 'global' }) : null;
+  }), 'kcc');
+  push('ComputeURLMap', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/UrlMap', 'urlMaps'), 'gcp');
+  push('ComputeURLMap', await kccField('ComputeURLMap', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeTargetHTTPSProxy', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/TargetHttpsProxy', 'targetHttpsProxies'), 'gcp');
+  push('ComputeTargetHTTPSProxy', await kccField('ComputeTargetHTTPSProxy', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeGlobalForwardingRule', byType('compute.googleapis.com/ForwardingRule')
+    .map((a) => assetGlobalOrScopedId(a, 'forwardingRules')).filter((id) => id && id.startsWith('global/')), 'gcp');
+  push('ComputeGlobalForwardingRule', await kccField('ComputeGlobalForwardingRule', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })), 'kcc');
+  push('ComputeSSLCertificate', liveGlobalOrScopedIds(assets, 'compute.googleapis.com/SslCertificate', 'sslCertificates'), 'gcp');
+  const sslKcc = await Promise.all([
+    kccField('ComputeSSLCertificate', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })),
+    kccField('ComputeManagedSSLCertificate', namespace, (i) => kccScopedId(i, { defaultLocation: 'global' })),
+  ]);
+  push('ComputeSSLCertificate', sslKcc.flat(), 'kcc');
+
   // --- IAMPolicyMember ---------------------------------------------------------
   // search-all-iam-policies — усі біндинги проєкту одразу, на будь-якому
   // типі ресурсу, не тільки на трьох раніше підтримуваних (Project/SA/AR).
@@ -395,12 +490,15 @@ export async function collectNamespace(namespace, { includeSystem = false } = {}
   }
   push('IAMPolicyMember', liveIam, 'gcp');
 
-  const kccPolicyItems = kubectlJson('get', 'iampolicymembers.iam.cnrm.cloud.google.com', '-n', namespace);
-  push('IAMPolicyMember', ((kccPolicyItems && kccPolicyItems.items) || []).map((item) => {
-    const rid = kccPolicyMemberId(item, project);
-    const spec = item.spec || {};
-    return `${rid}/${spec.role}/${spec.member}`;
-  }), 'kcc');
+  const runServiceRefs = new Map(runServiceItems.map((i) => [i.metadata && i.metadata.name, kccScopedId(i)]));
+  push('IAMPolicyMember', await kccField(
+    'IAMPolicyMember', namespace,
+    (item) => {
+      const rid = kccPolicyMemberId(item, project, runServiceRefs);
+      const spec = item.spec || {};
+      return `${rid}/${spec.role}/${spec.member}`;
+    },
+  ), 'kcc');
 
   return { namespace, project, resources, diagnostics };
 }
@@ -420,21 +518,22 @@ The mechanism kcc-inventory is built on, callable on its own: per KCC
 namespace (namespace carrying the annotation
 cnrm.cloud.google.com/project-id), lists every resource found live in the
 GCP project (source: gcp) and every one declared as a Config Connector
-custom resource in that namespace (source: kcc), for IAMServiceAccount,
-IAMServiceAccountKey, ArtifactRegistryRepository, ContainerCluster,
-ContainerNodePool, StorageBucket, ComputeAddress, DNSManagedZone,
-DNSRecordSet, and IAMPolicyMember. No drift/orphan diff — that's
+custom resource in that namespace. It covers IAM, Artifact Registry, GKE,
+Cloud Run (services and jobs), Scheduler, Eventarc, Pub/Sub, Secret Manager,
+VPC Access, selected network/LB resources, KMS, Cloud DNS, and
+IAMPolicyMember. No drift/orphan diff — that's
 \`cfr kcc-inventory\`.
 
 By default GCP-managed system noise is filtered out (Google-owned service
 accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
 ACL entries, ...) — pass --include-system to see it anyway.
 
-Requires \`kubectl\` on PATH, pointed at the target cluster (set KUBE_CONTEXT
-to target a specific kubeconfig context explicitly instead of relying on
-the current one). The GCP side talks to Cloud Asset Inventory, IAM, and
-Compute Engine directly over REST via Application Default Credentials —
-no \`gcloud\` CLI needed.
+No \`gcloud\` or \`kubectl\` CLI needed — both the GCP side and the cluster
+side talk REST directly, authenticated with Application Default
+Credentials. Cluster connection details (server, CA) still come from your
+kubeconfig (KUBECONFIG, default ~/.kube/config); set KUBE_CONTEXT to
+target a specific context explicitly instead of relying on
+current-context. Only tested against GKE.
 
 Options:
   --json             Emit {resources, diagnostics} as JSON instead of the
@@ -483,7 +582,7 @@ export async function run(argv) {
 
   let namespaces;
   if (target === '--all') {
-    namespaces = listKccNamespaces();
+    namespaces = await listKccNamespaces();
     if (!namespaces.length) {
       console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
       return 2;

package/lib/k8s-rest.mjs

@@ -0,0 +1,162 @@
+// Тонкий REST-транспорт до Kubernetes API server — заміна шелл-аутів у
+// kubectl CLI, для тих самих причин, що gcp-rest.mjs замінив gcloud: без
+// залежності від встановленого на PATH kubectl.
+//
+// Автентифікація — той самий ADC-токен, що йде на GCP REST-виклики
+// (gcp-rest.mjs:getAccessToken), не токен із самого kubeconfig. GKE
+// приймає OAuth2-токен GCP IAM напряму як bearer — це буквально те, що
+// робить exec-плагін `gke-gcloud-auth-plugin` під капотом kubectl, тільки
+// без окремого бінарника. Тому цей шар навмисно вузький: працює для GKE
+// (єдиний тип кластера, на якому реально стоїть KCC), не претендує бути
+// клієнтом для будь-якого kubeconfig — client-cert- чи Azure/AWS-подібна
+// exec-автентифікація тут не підтримується.
+//
+// server/CA беруться з kubeconfig як завжди (KUBECONFIG, чи
+// ~/.kube/config; контекст — KUBE_CONTEXT, чи current-context файлу).
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import https from 'node:https';
+import { parse as parseYaml } from 'yaml';
+import { getAccessToken } from './gcp-rest.mjs';
+
+function kubeconfigPath() {
+  return process.env.KUBECONFIG || join(homedir(), '.kube', 'config');
+}
+
+let configCache;
+function loadKubeconfig() {
+  if (!configCache) configCache = parseYaml(readFileSync(kubeconfigPath(), 'utf8'));
+  return configCache;
+}
+
+let clusterInfoCache;
+function clusterInfo() {
+  if (clusterInfoCache) return clusterInfoCache;
+
+  const config = loadKubeconfig();
+  const contextName = process.env.KUBE_CONTEXT || config['current-context'];
+  if (!contextName) throw new Error('kubeconfig has no current-context (set KUBE_CONTEXT)');
+
+  const ctxEntry = (config.contexts || []).find((c) => c.name === contextName);
+  if (!ctxEntry) throw new Error(`context "${contextName}" not found in kubeconfig`);
+
+  const clusterName = ctxEntry.context.cluster;
+  const clusterEntry = (config.clusters || []).find((c) => c.name === clusterName);
+  if (!clusterEntry) throw new Error(`cluster "${clusterName}" not found in kubeconfig`);
+
+  const cluster = clusterEntry.cluster;
+  const ca = cluster['certificate-authority-data']
+    ? Buffer.from(cluster['certificate-authority-data'], 'base64')
+    : cluster['certificate-authority']
+      ? readFileSync(cluster['certificate-authority'])
+      : undefined;
+
+  clusterInfoCache = { server: cluster.server, ca, insecureSkipTlsVerify: !!cluster['insecure-skip-tls-verify'] };
+  return clusterInfoCache;
+}
+
+async function requestJson(pathAndQuery) {
+  const { server, ca, insecureSkipTlsVerify } = clusterInfo();
+  const token = await getAccessToken();
+  const url = new URL(pathAndQuery, server);
+
+  return new Promise((resolve, reject) => {
+    const req = https.request(url, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      ca,
+      rejectUnauthorized: !insecureSkipTlsVerify,
+    }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => {
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          const err = new Error(`kubernetes API ${res.statusCode} ${pathAndQuery}: ${body.slice(0, 300)}`);
+          err.status = res.statusCode;
+          reject(err);
+          return;
+        }
+        try {
+          resolve(body ? JSON.parse(body) : null);
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+/**
+ * Один namespace, або null якщо його немає (404) — той самий сигнал, що
+ * раніше давав ненульовий exit-код kubectl.
+ */
+export async function getNamespace(name) {
+  try {
+    return await requestJson(`/api/v1/namespaces/${encodeURIComponent(name)}`);
+  } catch (err) {
+    if (err.status === 404) return null;
+    throw err;
+  }
+}
+
+/**
+ * Усі namespace кластера.
+ */
+export async function listNamespaces() {
+  const data = await requestJson('/api/v1/namespaces');
+  return (data && data.items) || [];
+}
+
+// group + множина для кожного виду KCC-ресурсу, який сканує
+// get-resources.mjs. Версія скрізь v1beta1 — стандарт KCC, не наш вибір.
+export const CRD_GVR = {
+  IAMServiceAccount: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccounts' },
+  IAMServiceAccountKey: { group: 'iam.cnrm.cloud.google.com', plural: 'iamserviceaccountkeys' },
+  ArtifactRegistryRepository: { group: 'artifactregistry.cnrm.cloud.google.com', plural: 'artifactregistryrepositories' },
+  ContainerCluster: { group: 'container.cnrm.cloud.google.com', plural: 'containerclusters' },
+  ContainerNodePool: { group: 'container.cnrm.cloud.google.com', plural: 'containernodepools' },
+  StorageBucket: { group: 'storage.cnrm.cloud.google.com', plural: 'storagebuckets' },
+  ComputeAddress: { group: 'compute.cnrm.cloud.google.com', plural: 'computeaddresses' },
+  DNSManagedZone: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsmanagedzones' },
+  DNSRecordSet: { group: 'dns.cnrm.cloud.google.com', plural: 'dnsrecordsets' },
+  RunService: { group: 'run.cnrm.cloud.google.com', plural: 'runservices' },
+  RunJob: { group: 'run.cnrm.cloud.google.com', plural: 'runjobs' },
+  CloudSchedulerJob: { group: 'cloudscheduler.cnrm.cloud.google.com', plural: 'cloudschedulerjobs' },
+  EventarcTrigger: { group: 'eventarc.cnrm.cloud.google.com', plural: 'eventarctriggers' },
+  PubSubTopic: { group: 'pubsub.cnrm.cloud.google.com', plural: 'pubsubtopics' },
+  PubSubSubscription: { group: 'pubsub.cnrm.cloud.google.com', plural: 'pubsubsubscriptions' },
+  SecretManagerSecret: { group: 'secretmanager.cnrm.cloud.google.com', plural: 'secretmanagersecrets' },
+  VPCAccessConnector: { group: 'vpcaccess.cnrm.cloud.google.com', plural: 'vpcaccessconnectors' },
+  ComputeNetwork: { group: 'compute.cnrm.cloud.google.com', plural: 'computenetworks' },
+  ComputeSubnetwork: { group: 'compute.cnrm.cloud.google.com', plural: 'computesubnetworks' },
+  KMSCryptoKey: { group: 'kms.cnrm.cloud.google.com', plural: 'kmscryptokeys' },
+  ComputeBackendService: { group: 'compute.cnrm.cloud.google.com', plural: 'computebackendservices' },
+  ComputeNetworkEndpointGroup: { group: 'compute.cnrm.cloud.google.com', plural: 'computenetworkendpointgroups' },
+  ComputeURLMap: { group: 'compute.cnrm.cloud.google.com', plural: 'computeurlmaps' },
+  ComputeTargetHTTPSProxy: { group: 'compute.cnrm.cloud.google.com', plural: 'computetargethttpsproxies' },
+  ComputeGlobalForwardingRule: { group: 'compute.cnrm.cloud.google.com', plural: 'computeglobalforwardingrules' },
+  ComputeSSLCertificate: { group: 'compute.cnrm.cloud.google.com', plural: 'computesslcertificates' },
+  ComputeManagedSSLCertificate: { group: 'compute.cnrm.cloud.google.com', plural: 'computemanagedsslcertificates' },
+  IAMPolicyMember: { group: 'iam.cnrm.cloud.google.com', plural: 'iampolicymembers' },
+};
+
+/**
+ * Усі CR даного KCC-виду в namespace. Порожній масив, якщо CRD не
+ * встановлений (404) — той самий сигнал, що раніше давав ненульовий
+ * exit-код kubectl, коли CRD немає в кластері. Інші помилки (401/403/
+ * мережа) кидаються далі.
+ */
+export async function listCustomObjects(kind, namespace) {
+  const { group, plural } = CRD_GVR[kind];
+  try {
+    const data = await requestJson(`/apis/${group}/v1beta1/namespaces/${encodeURIComponent(namespace)}/${plural}`);
+    return (data && data.items) || [];
+  } catch (err) {
+    if (err.status === 404) return [];
+    throw err;
+  }
+}

package/lib/kcc-inventory.mjs

@@ -14,10 +14,9 @@ Usage:
 Compares, per KCC namespace (namespace carrying the annotation
 cnrm.cloud.google.com/project-id), what actually exists in the GCP project
 against what's declared as Config Connector custom resources in that
-namespace — for IAMServiceAccount, IAMServiceAccountKey,
-ArtifactRegistryRepository, ContainerCluster, ContainerNodePool,
-StorageBucket, ComputeAddress, DNSManagedZone, DNSRecordSet, and
-IAMPolicyMember.
+namespace. It covers IAM, Artifact Registry, GKE, Cloud Run, Scheduler,
+Eventarc, Pub/Sub, Secret Manager, VPC Access, selected network/LB
+resources, KMS, Cloud DNS, and IAMPolicyMember.
 
 Reports two directions per kind:
   DRIFT   — live in GCP, not declared under KCC (adopt it or delete it)
@@ -27,13 +26,17 @@ By default GCP-managed system noise is filtered out (Google-owned service
 accounts, gcr.io shims, GKE-managed node pools/DNS zones, legacy bucket
 ACL entries, ...) — pass --include-system to see it anyway.
 
-Requires \`kubectl\` on PATH, pointed at the target cluster (set KUBE_CONTEXT
-to target a specific kubeconfig context explicitly instead of relying on
-the current one). The GCP side talks to Cloud Asset Inventory, IAM, and
-Compute Engine directly over REST — no \`gcloud\` CLI needed, just
-Application Default Credentials (\`gcloud auth application-default login\`,
-a service account key via GOOGLE_APPLICATION_CREDENTIALS, or the ambient
-credentials on GCE/GKE/Cloud Build).
+No \`gcloud\` or \`kubectl\` CLI needed — both the GCP side (Cloud Asset
+Inventory, IAM, Compute Engine) and the cluster side talk REST directly,
+authenticated with Application Default Credentials (\`gcloud auth
+application-default login\` locally, a service account key via
+GOOGLE_APPLICATION_CREDENTIALS, or the ambient credentials on
+GCE/GKE/Cloud Build). Cluster connection details (server, CA) still come
+from your kubeconfig (KUBECONFIG, default ~/.kube/config); set
+KUBE_CONTEXT to target a specific context explicitly instead of relying
+on current-context. Only tested against GKE — the cluster-side REST calls
+assume a GCP OAuth2 token is a valid bearer token for the API server,
+which isn't true for every cluster type.
 
 Options:
   --json             Emit a JSON array of {kind, id, project, status} instead
@@ -143,7 +146,7 @@ export async function run(argv) {
 
   let namespaces;
   if (target === '--all') {
-    namespaces = listKccNamespaces();
+    namespaces = await listKccNamespaces();
     if (!namespaces.length) {
       console.error('жоден namespace не має cnrm.cloud.google.com/project-id');
       return 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitra/cfr",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "A handful of small k8s/GitOps CLI utilities: `check` verifies every YAML file in a Kustomize directory is listed in kustomization.yaml's explicit resources: (and vice versa); `kcc-inventory` diffs a GCP Config Connector namespace against the live project to find drift; `get-resources` is that same scan without the diff.",
   "keywords": [
     "kustomize",
@@ -36,9 +36,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test test/cli.test.mjs"
+    "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "google-auth-library": "^10.9.1"
+    "google-auth-library": "^10.9.1",
+    "yaml": "^2.9.0"
   }
 }