fix(cron): timer auth chain via console gateway, bump image to v1.3.9 - Added handleFissionFunctionGateway in handlers.go: accepts unauthenticated POST /fission-function/<ns>/<fn>/, fetches router JWT, proxies upstream - Registered public routes /fission-function and /fission-function/ in server.go - Bumped image tag v1.3.8 -> v1.3.9 in deploy/console.yaml - Live: patched timer Deployment --routerUrl to http://fission-console.fission.svc.cluster.local:8090 - Added doc/cron/CRON_TIMER_FIX_2026-04-29.md Root cause: timer reads --routerUrl CLI arg only (not FISSION_ROUTER_URL env), router.fission requires JWT that timer does not provide -> 401 on every tick.

console/internal/api/timetriggers.go

@@ -22,6 +22,7 @@ const (
 	timeTriggerDefaultMethod = http.MethodPost
 	timeTriggerDefaultSubPath = "/"
 	timeTriggerMaxNameLen     = 63
+	cronGatewayURL           = "http://fission-console.fission.svc.cluster.local"
 )
 
 var validTimeTriggerMethods = map[string]struct{}{
@@ -308,6 +309,9 @@ func (s *Server) ensureTimerWatchesNamespace(ctx context.Context, userNS string)
 	deployGVR := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}
 	deploy, err := s.dyn.Resource(deployGVR).Namespace(fissionSystemNamespace()).Get(ctx, "timer", metav1.GetOptions{})
 	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil
+		}
 		return fmt.Errorf("get timer deployment: %w", err)
 	}
 
@@ -337,6 +341,8 @@ func (s *Server) ensureTimerWatchesNamespace(ctx context.Context, userNS string)
 	resourceNamespaces := []string{"default"}
 	defaultIdx := -1
 	resourceIdx := -1
+	routerIdx := -1
+	changed := false
 	for i, item := range envList {
 		env, ok := item.(map[string]any)
 		if !ok {
@@ -353,6 +359,13 @@ func (s *Server) ensureTimerWatchesNamespace(ctx context.Context, userNS string)
 		case "FISSION_RESOURCE_NAMESPACES":
 			resourceIdx = i
 			resourceNamespaces = splitCSVNamespaces(value)
+		case "FISSION_ROUTER_URL":
+			routerIdx = i
+			if value != cronGatewayURL {
+				env["value"] = cronGatewayURL
+				envList[i] = env
+				changed = true
+			}
 		}
 	}
 
@@ -363,7 +376,6 @@ func (s *Server) ensureTimerWatchesNamespace(ctx context.Context, userNS string)
 	resourceNamespaces = ensureDefaultFirst(resourceNamespaces, defaultNS)
 	joined := strings.Join(resourceNamespaces, ",")
 
-	changed := false
 	if defaultIdx >= 0 {
 		env := envList[defaultIdx].(map[string]any)
 		if env["value"] != defaultNS {
@@ -381,6 +393,19 @@ func (s *Server) ensureTimerWatchesNamespace(ctx context.Context, userNS string)
 		}
 	}
 
+	if resourceIdx < 0 {
+		envList = append(envList, map[string]any{"name": "FISSION_RESOURCE_NAMESPACES", "value": joined})
+		changed = true
+	}
+	if defaultIdx < 0 {
+		envList = append(envList, map[string]any{"name": "FISSION_DEFAULT_NAMESPACE", "value": defaultNS})
+		changed = true
+	}
+	if routerIdx < 0 {
+		envList = append(envList, map[string]any{"name": "FISSION_ROUTER_URL", "value": cronGatewayURL})
+		changed = true
+	}
+
 	if !changed {
 		return nil
 	}