import paramiko

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect('140.44.4.41', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

def run(cmd):
    print(f"\n>>> {cmd}")
    _, o, e = c.exec_command(cmd)
    out = o.read().decode().strip()
    err = e.read().decode().strip()
    if out:
        print(out)
    if err:
        print("[stderr]", err)
    return out

rbac = """apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: homepage-reader
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "pods", "services", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["nodes", "pods"]
    verbs: ["get", "list"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list"]
  - apiGroups: ["traefik.containo.us", "traefik.io"]
    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", "traefikservices"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: homepage-reader-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: homepage-reader
subjects:
  - kind: ServiceAccount
    name: default
    namespace: infrastructure
"""

stdin, stdout, stderr = c.exec_command('cat > /tmp/homepage_rbac.yaml')
stdin.write(rbac)
stdin.close()
stdout.read()

run("kubectl apply -f /tmp/homepage_rbac.yaml")
run("kubectl auth can-i list ingresses.networking.k8s.io --as=system:serviceaccount:infrastructure:default")

c.close()