feat: add homelab deployment configs, documentation, and automation scripts

scripts/setup_homepage_rbac.py

@@ -0,0 +1,61 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect('140.44.4.41', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+def run(cmd):
+    print(f"\n>>> {cmd}")
+    _, o, e = c.exec_command(cmd)
+    out = o.read().decode().strip()
+    err = e.read().decode().strip()
+    if out:
+        print(out)
+    if err:
+        print("[stderr]", err)
+    return out
+
+rbac = """apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage-reader
+rules:
+  - apiGroups: [""]
+    resources: ["nodes", "namespaces", "pods", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["nodes", "pods"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list"]
+  - apiGroups: ["traefik.containo.us", "traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", "traefikservices"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homepage-reader-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage-reader
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: infrastructure
+"""
+
+stdin, stdout, stderr = c.exec_command('cat > /tmp/homepage_rbac.yaml')
+stdin.write(rbac)
+stdin.close()
+stdout.read()
+
+run("kubectl apply -f /tmp/homepage_rbac.yaml")
+run("kubectl auth can-i list ingresses.networking.k8s.io --as=system:serviceaccount:infrastructure:default")
+
+c.close()