156 lines
4.6 KiB
YAML
156 lines
4.6 KiB
YAML
# ⛔⛔⛔ ЛЕГАСИ (2026-08-16) — СТАРЫЙ IoT (k8s-деплой). НЕ ПРИНИМАТЬ ВО ВНИМАНИЕ.
|
|
# Актуальное: HISTORY/2026-08-16-session-log.md
|
|
|
|
# Создано: 2026-04-12
|
|
# Deployment iot-operator — controller-manager (IoTDevice CRD) + REST API на :9090.
|
|
#
|
|
# Компоненты:
|
|
# - ServiceAccount + ClusterRole + ClusterRoleBinding (RBAC для CRD controller)
|
|
# - Deployment: naeel/iot-operator:v0.2.6
|
|
# - Service: ClusterIP :9090 (REST API, MQTT auth/acl, admin UI)
|
|
#
|
|
# iot-operator обслуживает:
|
|
# - IoTDevice CRD reconcilation (controller-runtime)
|
|
# - REST API: устройства, телеметрия, MQTT auth/acl
|
|
# - Admin UI: /iot-admin
|
|
# - Console UI: /console
|
|
#
|
|
# Секреты:
|
|
# iot-postgres-secret — IOT_PG_DSN для managed Postgres
|
|
# iot-sqs-credentials — SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY
|
|
#
|
|
# Применение: kubectl apply -f deployments/k8s/iot-operator.yaml
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: iot-operator
|
|
namespace: sless
|
|
---
|
|
# ClusterRole — права на IoTDevice CRD + Secrets (для MQTT auth)
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: iot-operator-role
|
|
rules:
|
|
# IoTDevice CRD
|
|
- apiGroups: ["iot.kube5s.ru"]
|
|
resources: ["iotdevices", "iotdevices/status", "iotdevices/finalizers"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Secrets — для MQTT auth (чтение device credentials)
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Events — controller-runtime записывает events
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
# Namespaces — для per-tenant DB provisioning
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Leases — leader election (controller-runtime)
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: iot-operator-rolebinding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: iot-operator-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: iot-operator
|
|
namespace: sless
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: iot-operator
|
|
namespace: sless
|
|
labels:
|
|
app: iot-operator
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: iot-operator
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: iot-operator
|
|
spec:
|
|
serviceAccountName: iot-operator
|
|
containers:
|
|
- name: operator
|
|
image: naeel/iot-operator:v0.2.6
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- name: api
|
|
containerPort: 9090
|
|
- name: metrics
|
|
containerPort: 8080
|
|
- name: health
|
|
containerPort: 8081
|
|
envFrom:
|
|
# IOT_PG_DSN — managed Postgres
|
|
- secretRef:
|
|
name: iot-postgres-secret
|
|
# SQS_ENDPOINT, SQS_ACCESS_KEY, SQS_SECRET_KEY — для admin stats
|
|
- secretRef:
|
|
name: iot-sqs-credentials
|
|
env:
|
|
- name: API_PORT
|
|
value: "9090"
|
|
# ADMIN_STATS_TOKEN — токен доступа к /iot-admin/stats
|
|
- name: ADMIN_STATS_TOKEN
|
|
value: "iot-admin-2026"
|
|
# Bridge MQTT credentials — для авторизации внутреннего mqtt-bridge
|
|
- name: MQTT_BRIDGE_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: iot-bridge-credentials
|
|
key: MQTT_USERNAME
|
|
- name: MQTT_BRIDGE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: iot-bridge-credentials
|
|
key: MQTT_PASSWORD
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
resources:
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "256Mi"
|
|
cpu: "500m"
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: iot-operator
|
|
namespace: sless
|
|
spec:
|
|
selector:
|
|
app: iot-operator
|
|
ports:
|
|
- name: api
|
|
port: 9090
|
|
targetPort: 9090
|