apiVersion: v1
kind: ServiceAccount
metadata:
  name: fission-console
  namespace: fission
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fission-console
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
  - apiGroups: ["fission.io"]
    resources: ["environments", "packages", "functions", "httptriggers", "timetriggers"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fission-console
subjects:
  - kind: ServiceAccount
    name: fission-console
    namespace: fission
roleRef:
  kind: ClusterRole
  name: fission-console
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: fission-console
  namespace: fission
  labels:
    app: fission-console
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fission-console
  template:
    metadata:
      labels:
        app: fission-console
    spec:
      serviceAccountName: fission-console
      containers:
        - name: console
          image: naeel/fission-console:v1.3.96
          imagePullPolicy: Always
          ports:
            - containerPort: 8090
          env:
            - name: FISSION_NAMESPACE
              value: "default"
            - name: FISSION_ROUTER_URL
              value: "http://router.fission.svc.cluster.local"
            - name: PORT
              value: "8090"
            - name: FISSION_HTTP_TIMEOUT
              value: "30s"
            - name: FISSION_INVOKE_TIMEOUT
              value: "60s"
            - name: FISSION_AUTH_USERNAME
              valueFrom:
                secretKeyRef:
                  name: router
                  key: username
            - name: FISSION_AUTH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: router
                  key: password
            - name: FISSION_STORAGESVC_URL
              value: "http://storagesvc.fission.svc.cluster.local"
            - name: BILLING_DSN
              value: "postgres://super:BQUF5ruECa1ZFlq4wYt3gPJUEmtBMkA9QNK4MM5Sd8al4ArMDlmT16DIKHYBPyif@postgresqlk8s-master.dc5db45d-f8b4-4fd0-ad33-ec4dd017f2d5.svc.cluster.local:5432/sqsdb"
            - name: GRAFANA_INTERNAL_URL
              value: "http://grafana.grafana.svc.cluster.local:3000"
            - name: GRAFANA_PUBLIC_URL
              value: "https://fission.kube5s.ru/grafana"
            - name: GRAFANA_ADMIN_USER
              value: "admin"
            - name: GRAFANA_ADMIN_PASS
              value: "GrafanaAdmin2026!"
          livenessProbe:
            httpGet:
              path: /health
              port: 8090
            initialDelaySeconds: 5
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /health
              port: 8090
            initialDelaySeconds: 3
            periodSeconds: 10
          resources:
            requests:
              cpu: 20m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: fission-console
  namespace: fission
spec:
  selector:
    app: fission-console
  ports:
    - port: 8090
      targetPort: 8090
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: fission-console
  namespace: fission
  annotations:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  rules:
    - host: fission.kube5s.ru
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: fission-console
                port:
                  number: 8090
          - path: /fn
            pathType: Prefix
            backend:
              service:
                name: fission-console
                port:
                  number: 8090
          - path: /console
            pathType: Prefix
            backend:
              service:
                name: fission-console
                port:
                  number: 8090
          # ⛔ /cron НЕ ПРИНАДЛЕЖИТ console. Ingress /cron → metrics-collector:8091 (metrics-collector/deploy/metrics-collector.yaml)
          # ⛔ НЕ ДОБАВЛЯТЬ /cron сюда — это сломает независимость сервисов.
  tls:
    - hosts:
        - fission.kube5s.ru
      secretName: fission-tls