refactor: checkpoint layer2 api console changes

deploy/rbac/executor-multi-ns.yaml

@@ -0,0 +1,46 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fission-executor-multi-ns
+  labels:
+    app: fission-executor
+rules:
+# Fission CRD — читать environment/function/package в любом NS
+- apiGroups: ["fission.io"]
+  resources: ["environments", "functions", "packages", "httptriggers"]
+  verbs: ["get", "list", "watch"]
+# Pods — executor создаёт и управляет подами функций (poolmgr/newdeploy)
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+# Services — executor создаёт сервисы для функций
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+# ConfigMaps/Secrets — для конфигурации функций
+- apiGroups: [""]
+  resources: ["configmaps", "secrets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+# ServiceAccounts — для чтения SA функций
+- apiGroups: [""]
+  resources: ["serviceaccounts"]
+  verbs: ["get", "list", "watch"]
+# Deployments/ReplicaSets — newdeploy executor тип
+- apiGroups: ["apps"]
+  resources: ["deployments", "replicasets"]
+  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: fission-executor-multi-ns
+  labels:
+    app: fission-executor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: fission-executor-multi-ns
+subjects:
+- kind: ServiceAccount
+  name: fission-executor
+  namespace: fission