# Создано: 2026-04-12
# Deployment iot-operator — controller-manager (IoTDevice CRD) + REST API на :9090.
#
# Компоненты:
#   - ServiceAccount + ClusterRole + ClusterRoleBinding (RBAC для CRD controller)
#   - Deployment: naeel/iot-operator:v0.2.0
#   - Service: ClusterIP :9090 (REST API, MQTT auth/acl, admin UI)
#
# iot-operator обслуживает:
#   - IoTDevice CRD reconcilation (controller-runtime)
#   - REST API: устройства, телеметрия, MQTT auth/acl
#   - Admin UI: /iot-admin
#   - Console UI: /console
#
# Секреты:
#   iot-postgres-secret — IOT_PG_DSN для managed Postgres
#   iot-sqs-credentials — SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY
#
# Применение: kubectl apply -f deployments/k8s/iot-operator.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: iot-operator
  namespace: sless
---
# ClusterRole — права на IoTDevice CRD + Secrets (для MQTT auth)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: iot-operator-role
rules:
  # IoTDevice CRD
  - apiGroups: ["iot.kube5s.ru"]
    resources: ["iotdevices", "iotdevices/status", "iotdevices/finalizers"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Secrets — для MQTT auth (чтение device credentials)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Events — controller-runtime записывает events
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
  # Namespaces — для per-tenant DB provisioning
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch"]
  # Leases — leader election (controller-runtime)
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: iot-operator-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: iot-operator-role
subjects:
  - kind: ServiceAccount
    name: iot-operator
    namespace: sless
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: iot-operator
  namespace: sless
  labels:
    app: iot-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iot-operator
  template:
    metadata:
      labels:
        app: iot-operator
    spec:
      serviceAccountName: iot-operator
      containers:
        - name: operator
          image: naeel/iot-operator:v0.2.0
          imagePullPolicy: Always
          ports:
            - name: api
              containerPort: 9090
            - name: metrics
              containerPort: 8080
            - name: health
              containerPort: 8081
          envFrom:
            # IOT_PG_DSN — managed Postgres
            - secretRef:
                name: iot-postgres-secret
            # SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY — для admin stats
            - secretRef:
                name: iot-sqs-credentials
          env:
            - name: API_PORT
              value: "9090"
            # ADMIN_STATS_TOKEN — токен доступа к /iot-admin/stats
            - name: ADMIN_STATS_TOKEN
              value: "iot-admin-2026"
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          resources:
            requests:
              memory: "64Mi"
              cpu: "50m"
            limits:
              memory: "256Mi"
              cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: iot-operator
  namespace: sless
spec:
  selector:
    app: iot-operator
  ports:
    - name: api
      port: 9090
      targetPort: 9090