kuber/.kuberrc.ts

import type { KuberConfig } from "./types";
import { LABELS } from "./const";

export default {
  project: "kuber-system",

  postRender(resources, context) {
    const metadata = {
      namespace: context.project,
      labels: LABELS,
    };

    resources.push(
      {
        apiVersion: "v1",
        kind: "ServiceAccount",
        metadata: { ...metadata, name: "kuber-server" },
      },
      {
        apiVersion: "rbac.authorization.k8s.io/v1",
        kind: "Role",
        metadata: { ...metadata, name: "kuber-server-auth" },
        rules: [
          {
            apiGroups: [""],
            resources: ["secrets", "configmaps", "pods", "pods/log"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: [""],
            resources: ["serviceaccounts"],
            resourceNames: ["kuber-server"],
            verbs: ["get", "update", "patch"],
          },
          {
            apiGroups: ["rbac.authorization.k8s.io"],
            resources: ["roles", "rolebindings"],
            resourceNames: ["kuber-server-auth"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["batch"],
            resources: ["jobs"],
            verbs: ["get", "list", "watch", "create", "delete"],
          },
          {
            apiGroups: ["coordination.k8s.io"],
            resources: ["leases"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
        ],
      },
      {
        apiVersion: "rbac.authorization.k8s.io/v1",
        kind: "RoleBinding",
        metadata: { ...metadata, name: "kuber-server-auth" },
        roleRef: {
          apiGroup: "rbac.authorization.k8s.io",
          kind: "Role",
          name: "kuber-server-auth",
        },
        subjects: [
          {
            kind: "ServiceAccount",
            name: "kuber-server",
            namespace: context.project,
          },
        ],
      },
      {
        apiVersion: "rbac.authorization.k8s.io/v1",
        kind: "ClusterRole",
        metadata: { name: "kuber-server-manager", labels: LABELS },
        rules: [
          {
            apiGroups: [""],
            resources: ["namespaces"],
            verbs: ["get", "list", "create", "patch", "delete"],
          },
          {
            apiGroups: [""],
            resources: [
              "services",
              "configmaps",
              "secrets",
              "persistentvolumeclaims",
            ],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: [""],
            resources: ["pods", "pods/log"],
            verbs: ["get", "list", "watch"],
          },
          {
            apiGroups: [""],
            resources: ["pods/exec"],
            verbs: ["get", "create"],
          },
          {
            apiGroups: ["apps"],
            resources: [
              "deployments",
              "replicasets",
              "statefulsets",
              "daemonsets",
            ],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["batch"],
            resources: ["jobs", "cronjobs"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["networking.k8s.io"],
            resources: ["ingresses", "networkpolicies"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["autoscaling"],
            resources: ["horizontalpodautoscalers"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["policy"],
            resources: ["poddisruptionbudgets"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["storage.k8s.io"],
            resources: ["storageclasses"],
            verbs: ["get", "list", "create", "patch"],
          },
          {
            apiGroups: ["traefik.io"],
            resources: ["ingressroutes", "middlewares"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["postgresql.cnpg.io"],
            resources: ["clusters"],
            verbs: ["get", "list", "patch"],
          },
          {
            apiGroups: ["postgresql.cnpg.io"],
            resources: ["databases"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["garage.rajsingh.info"],
            resources: ["garagebuckets", "garagekeys"],
            verbs: [
              "get",
              "list",
              "watch",
              "create",
              "update",
              "patch",
              "delete",
            ],
          },
          {
            apiGroups: ["rbac.authorization.k8s.io"],
            resources: ["clusterroles", "clusterrolebindings"],
            resourceNames: ["kuber-server-manager"],
            verbs: ["get", "update", "patch"],
          },
        ],
      },
      {
        apiVersion: "rbac.authorization.k8s.io/v1",
        kind: "ClusterRoleBinding",
        metadata: { name: "kuber-server-manager", labels: LABELS },
        roleRef: {
          apiGroup: "rbac.authorization.k8s.io",
          kind: "ClusterRole",
          name: "kuber-server-manager",
        },
        subjects: [
          {
            kind: "ServiceAccount",
            name: "kuber-server",
            namespace: context.project,
          },
        ],
      },
    );

    const password = process.env.KUBER_BOOTSTRAP_PASSWORD;
    if (password) {
      resources.push({
        apiVersion: "v1",
        kind: "Secret",
        metadata: { ...metadata, name: "kuber-bootstrap" },
        type: "Opaque",
        stringData: { password },
      });
    }
  },
} satisfies KuberConfig;