deploy: EMQX, iot-operator, managed Postgres, Docker Hub image

- Добавлен EMQX deployment + WS ingress (адаптирован из sless)
- Добавлен iot-operator deployment с RBAC (ServiceAccount, ClusterRole)
- Postgres: заменён self-hosted на managed (dc5db45d namespace)
- Image: naeel/iot-operator:v0.2.0 (Docker Hub)
- Убран imagePullSecrets (Docker Hub публичный)

deployments/k8s/iot-operator.yaml

@@ -0,0 +1,141 @@
+# Создано: 2026-04-12
+# Deployment iot-operator — controller-manager (IoTDevice CRD) + REST API на :9090.
+#
+# Компоненты:
+#   - ServiceAccount + ClusterRole + ClusterRoleBinding (RBAC для CRD controller)
+#   - Deployment: naeel/iot-operator:v0.2.0
+#   - Service: ClusterIP :9090 (REST API, MQTT auth/acl, admin UI)
+#
+# iot-operator обслуживает:
+#   - IoTDevice CRD reconcilation (controller-runtime)
+#   - REST API: устройства, телеметрия, MQTT auth/acl
+#   - Admin UI: /iot-admin
+#   - Console UI: /console
+#
+# Секреты:
+#   iot-postgres-secret — IOT_PG_DSN для managed Postgres
+#   iot-sqs-credentials — SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY
+#
+# Применение: kubectl apply -f deployments/k8s/iot-operator.yaml
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: iot-operator
+  namespace: sless
+---
+# ClusterRole — права на IoTDevice CRD + Secrets (для MQTT auth)
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: iot-operator-role
+rules:
+  # IoTDevice CRD
+  - apiGroups: ["iot.kube5s.ru"]
+    resources: ["iotdevices", "iotdevices/status", "iotdevices/finalizers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Secrets — для MQTT auth (чтение device credentials)
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Events — controller-runtime записывает events
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  # Namespaces — для per-tenant DB provisioning
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch"]
+  # Leases — leader election (controller-runtime)
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: iot-operator-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: iot-operator-role
+subjects:
+  - kind: ServiceAccount
+    name: iot-operator
+    namespace: sless
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: iot-operator
+  namespace: sless
+  labels:
+    app: iot-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: iot-operator
+  template:
+    metadata:
+      labels:
+        app: iot-operator
+    spec:
+      serviceAccountName: iot-operator
+      containers:
+        - name: operator
+          image: naeel/iot-operator:v0.2.0
+          imagePullPolicy: Always
+          ports:
+            - name: api
+              containerPort: 9090
+            - name: metrics
+              containerPort: 8080
+            - name: health
+              containerPort: 8081
+          envFrom:
+            # IOT_PG_DSN — managed Postgres
+            - secretRef:
+                name: iot-postgres-secret
+            # SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY — для admin stats
+            - secretRef:
+                name: iot-sqs-credentials
+          env:
+            - name: API_PORT
+              value: "9090"
+            # ADMIN_STATS_TOKEN — токен доступа к /iot-admin/stats
+            - name: ADMIN_STATS_TOKEN
+              value: "iot-admin-2026"
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: iot-operator
+  namespace: sless
+spec:
+  selector:
+    app: iot-operator
+  ports:
+    - name: api
+      port: 9090
+      targetPort: 9090