apiVersion: v1
kind: ServiceAccount
metadata:
  name: snapshot-publisher
  namespace: showcase
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: snapshot-reader
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "services", "persistentvolumeclaims"]
    verbs: ["get", "list"]   # no watch, no write, no secrets
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: snapshot-publisher-can-read
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: snapshot-reader
subjects:
  - kind: ServiceAccount
    name: snapshot-publisher
    namespace: showcase

apiVersion: batch/v1
kind: CronJob
metadata:
  name: snapshot-publisher
  namespace: showcase
spec:
  schedule: "*/30 * * * *"     # every 30 min while the cluster is up; tune to taste
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 2
  jobTemplate:
    spec:
      backoffLimit: 1
      template:
        spec:
          serviceAccountName: snapshot-publisher
          restartPolicy: Never
          containers:
            - name: publish
              # A small image you build: kubectl + jq + git + check-jsonschema.
              # Start from bitnami/kubectl and add the rest, or use an alpine + apk add.
              image: ghcr.io/pragalvaxfrez/snapshot-publisher:0.1.0
              command: ["/bin/sh", "/scripts/publish.sh"]
              env:
                - name: PUSH_TARGET
                  value: "git"   # or "r2"
                - name: GIT_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: snapshot-push-credential   # a SealedSecret in git, see below
                      key: token
              volumeMounts:
                - name: scripts
                  mountPath: /scripts
                - name: schema
                  mountPath: /schema
          volumes:
            - name: scripts
              configMap: { name: snapshot-publisher-scripts }
            - name: schema
              configMap: { name: snapshot-schema-v1 }   # holds snapshot.schema.v1.json

#!/bin/sh
set -eu
 
# 1. Read state read-only (in-cluster ServiceAccount token is used automatically).
kubectl get nodes  -o json > /tmp/nodes.json
kubectl get ns     -o json > /tmp/ns.json
kubectl get svc -A -o json > /tmp/svc.json
kubectl get pvc -A -o json > /tmp/pvc.json
 
NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
# 2. Build the public doc by SELECTING safe fields (allowlist). Node names are aliased here,
#    IPs are never read out. Versions come from the node objects, no talosctl needed.
#    (Illustrative jq; node aliasing and service curation get fleshed out when you build it.)
jq -n \
  --arg now "$NOW" \
  --slurpfile nodes /tmp/nodes.json \
  --slurpfile ns /tmp/ns.json \
  '{
     schemaVersion: "1.0.0",
     generatedAt: $now,
     generator: { name: "devata-snapshot-publisher", version: "0.1.0",
                  method: "read-only Kubernetes API via a scoped ServiceAccount" },
     freshness: { clusterPowered: true, maxAgeHours: 24 },
     cluster: {
       name: "devata",
       distribution: "Talos Linux",
       osVersion: ($nodes[0].items[0].status.nodeInfo.osImage),
       kubernetesVersion: ($nodes[0].items[0].status.nodeInfo.kubeletVersion),
       gitops: "manual Helm", ingress: "Gateway API CRDs installed; no controller wired",
       secretsManagement: "none yet", publicExposure: "none; behind CGNAT, outbound-only"
     },
     totals: {
       nodes: ($nodes[0].items | length),
       vcpu:  ([$nodes[0].items[].status.capacity.cpu | tonumber] | add),
       namespaces: ($ns[0].items | length)
     },
     nodes: [ $nodes[0].items | to_entries[] | {
       id: (if (.value.metadata.labels["node-role.kubernetes.io/control-plane"] != null)
            then "cp-\(.key+1)" else "worker-\(.key)" end),
       role: (if (.value.metadata.labels["node-role.kubernetes.io/control-plane"] != null)
              then "control-plane" else "worker" end),
       status: (if ([.value.status.conditions[] | select(.type=="Ready") | .status] | first) == "True"
                then "Ready" else "NotReady" end)
       # vcpu/memoryGiB/ageDays added the same way; IP and real name are never selected
     } ]
     # services / observability / storage / gpu added by the same select-only pattern
   }' > /tmp/snapshot.json
 
# 3. Validate against the schema. Refuse to push on failure.
check-jsonschema --schemafile /schema/snapshot.schema.v1.json /tmp/snapshot.json
 
# 4. Push outbound. Option A, commit to a dedicated data repo (recommended default).
if [ "$PUSH_TARGET" = "git" ]; then
  git clone --depth 1 "https://x-access-token:${GIT_TOKEN}@github.com/PragalvaXFREZ/devata-snapshot.git" /tmp/repo
  cp /tmp/snapshot.json /tmp/repo/snapshot.json
  cd /tmp/repo
  git config user.email "publisher@devata.local"
  git config user.name "devata snapshot publisher"
  git add snapshot.json
  git commit -m "snapshot ${NOW}" || { echo "no change"; exit 0; }   # skip empty commits
  git push origin HEAD:main
fi
 
# Option B, PUT to Cloudflare R2 (S3 API). Sketch only:
# aws s3 cp /tmp/snapshot.json s3://devata-snapshot/snapshot.json --endpoint-url "$R2_ENDPOINT"