apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fission-executor-multi-ns
  labels:
    app: fission-executor
rules:
# Fission CRD — читать environment/function/package в любом NS
- apiGroups: ["fission.io"]
  resources: ["environments", "functions", "packages", "httptriggers"]
  verbs: ["get", "list", "watch"]
# Pods — executor создаёт и управляет подами функций (poolmgr/newdeploy)
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
# Services — executor создаёт сервисы для функций
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
# ConfigMaps/Secrets — для конфигурации функций
- apiGroups: [""]
  resources: ["configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
# ServiceAccounts — для чтения SA функций
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["get", "list", "watch"]
# Deployments/ReplicaSets — newdeploy executor тип
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fission-executor-multi-ns
  labels:
    app: fission-executor
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: fission-executor-multi-ns
subjects:
- kind: ServiceAccount
  name: fission-executor
  namespace: fission