feat: v2

2026-09-03 11:28:30 +07:00
parent 26c2d0f015
commit 82d0fe3e0d
93 changed files with 19237 additions and 1285 deletions
@@ -0,0 +1,165 @@
+import type { KuberConfig } from "./types";
+import { LABELS } from "./const";
+
+export default {
+  project: "kuber-system",
+
+  postRender(resources, context) {
+    const metadata = {
+      namespace: context.project,
+      labels: LABELS,
+    };
+
+    resources.push(
+      {
+        apiVersion: "v1",
+        kind: "ServiceAccount",
+        metadata: { ...metadata, name: "kuber-server" },
+      },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata: { ...metadata, name: "kuber-server-auth" },
+        rules: [
+          {
+            apiGroups: [""],
+            resources: ["secrets", "configmaps", "pods", "pods/log"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["batch"],
+            resources: ["jobs"],
+            verbs: ["get", "list", "watch", "create", "delete"],
+          },
+          {
+            apiGroups: ["coordination.k8s.io"],
+            resources: ["leases"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+        ],
+      },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata: { ...metadata, name: "kuber-server-auth" },
+        roleRef: {
+          apiGroup: "rbac.authorization.k8s.io",
+          kind: "Role",
+          name: "kuber-server-auth",
+        },
+        subjects: [
+          {
+            kind: "ServiceAccount",
+            name: "kuber-server",
+            namespace: context.project,
+          },
+        ],
+      },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: { name: "kuber-server-manager", labels: LABELS },
+        rules: [
+          {
+            apiGroups: [""],
+            resources: ["namespaces"],
+            verbs: ["get", "list", "create", "patch", "delete"],
+          },
+          {
+            apiGroups: [""],
+            resources: ["services", "configmaps", "secrets", "persistentvolumeclaims"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: [""],
+            resources: ["pods", "pods/log"],
+            verbs: ["get", "list", "watch"],
+          },
+          {
+            apiGroups: [""],
+            resources: ["pods/exec"],
+            verbs: ["get", "create"],
+          },
+          {
+            apiGroups: ["apps"],
+            resources: ["deployments", "replicasets", "statefulsets", "daemonsets"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["batch"],
+            resources: ["jobs", "cronjobs"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["networking.k8s.io"],
+            resources: ["ingresses", "networkpolicies"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["autoscaling"],
+            resources: ["horizontalpodautoscalers"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["policy"],
+            resources: ["poddisruptionbudgets"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["storage.k8s.io"],
+            resources: ["storageclasses"],
+            verbs: ["get", "list", "create", "patch"],
+          },
+          {
+            apiGroups: ["traefik.io"],
+            resources: ["ingressroutes"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["postgresql.cnpg.io"],
+            resources: ["clusters"],
+            verbs: ["get", "list", "patch"],
+          },
+          {
+            apiGroups: ["postgresql.cnpg.io"],
+            resources: ["databases"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+          {
+            apiGroups: ["garage.rajsingh.info"],
+            resources: ["garagebuckets", "garagekeys"],
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+          },
+        ],
+      },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRoleBinding",
+        metadata: { name: "kuber-server-manager", labels: LABELS },
+        roleRef: {
+          apiGroup: "rbac.authorization.k8s.io",
+          kind: "ClusterRole",
+          name: "kuber-server-manager",
+        },
+        subjects: [
+          {
+            kind: "ServiceAccount",
+            name: "kuber-server",
+            namespace: context.project,
+          },
+        ],
+      },
+    );
+
+    const password = process.env.KUBER_BOOTSTRAP_PASSWORD;
+    if (password) {
+      resources.push({
+        apiVersion: "v1",
+        kind: "Secret",
+        metadata: { ...metadata, name: "kuber-bootstrap" },
+        type: "Opaque",
+        stringData: { password },
+      });
+    }
+  },
+} satisfies KuberConfig;