apiVersion: v1
kind: ServiceAccount
metadata:
  name: fission-admin-console
  namespace: fission
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fission-admin-console
rules:
  # читать ВСЕ namespaces (для отображения клиентов)
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list"]
  # читать секреты в клиентских namespaces (для списка пользователей)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  # читать pods (для метрик потребления)
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  # читать Fission CRD
  - apiGroups: ["fission.io"]
    resources: ["environments", "packages", "functions", "httptriggers", "timetriggers"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fission-admin-console
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: fission-admin-console
subjects:
  - kind: ServiceAccount
    name: fission-admin-console
    namespace: fission
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: fission-admin-console
  namespace: fission
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fission-admin-console
  template:
    metadata:
      labels:
        app: fission-admin-console
    spec:
      serviceAccountName: fission-admin-console
      containers:
        - name: fission-admin-console
          image: naeel/fission-admin-console:v0.1.1
          imagePullPolicy: Always
          ports:
            - containerPort: 8091
          env:
            - name: ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: fission-admin-token
                  key: token
            - name: S3_ENDPOINT
              value: "https://s3.msk-1.ngcloud.ru"
            - name: S3_BUCKET
              value: "sless-functions"
            - name: S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: fission-s3-credentials
                  key: access_key
            - name: S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: fission-s3-credentials
                  key: secret_key
---
apiVersion: v1
kind: Service
metadata:
  name: fission-admin-console
  namespace: fission
spec:
  selector:
    app: fission-admin-console
  ports:
    - port: 8091
      targetPort: 8091
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: fission-admin-console
  namespace: fission
  annotations:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
    - host: fission.kube5s.ru
      http:
        paths:
          - backend:
              service:
                name: fission-admin-console
                port:
                  number: 8091
            path: /admin
            pathType: Prefix
  tls:
    - hosts:
        - fission.kube5s.ru
      secretName: fission-tls