rbac: allow router namespace watch in multi-tenant mode

deploy/multitenant/rbac.yaml

@@ -1,11 +1,13 @@
 # deploy/multitenant/rbac.yaml
 #
-# RBAC required for the Fission multi-tenant NSWatcher.
+# RBAC required for the Fission multi-tenant NSWatcher components.
 #
-# The fission-executor ServiceAccount must be allowed to list and watch Namespaces
+# Both fission-executor and fission-router must be allowed to list and watch
-# at the cluster scope so that NSWatcher can detect newly-labeled Namespaces.
+# Namespaces at the cluster scope so that their NSWatchers can detect newly-
+# labeled Namespaces.
 #
-# This is a read-only ClusterRole — no write permissions are granted.
+# The executor also needs additional write permissions to provision the
+# fission-fetcher ServiceAccount/Role/RoleBinding in new namespaces.
 # Apply once per cluster after installing Fission:
 #
 #   kubectl apply -f deploy/multitenant/rbac.yaml
@@ -41,6 +43,36 @@ subjects:
     name: fission-executor
     namespace: fission
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fission-router-ns-watcher
+  labels:
+    app.kubernetes.io/name: fission
+    app.kubernetes.io/component: router
+    app.kubernetes.io/part-of: fission-multitenant
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: fission-router-ns-watcher
+  labels:
+    app.kubernetes.io/name: fission
+    app.kubernetes.io/component: router
+    app.kubernetes.io/part-of: fission-multitenant
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: fission-router-ns-watcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-router
+    namespace: fission
+---
 # ClusterRole: allows fission-executor to create/update fission-fetcher SA,
 # Role and RoleBinding in any user namespace managed by NSWatcher.
 #

doc/thinking/2026-04-26-rbac-fix.md

@@ -106,3 +106,30 @@ User "system:serviceaccount:fission:fission-executor" cannot create resource
 2. Создать новый test NS
 3. Убедиться, что `Role` и `RoleBinding` для `fission-fetcher` создаются
 4. Повторить `test_layer1.sh`
+
+---
+
+## Следующий найденный blocker — router RBAC
+
+После полного executor RBAC fix `test_layer1.sh` изменил симптом:
+- раньше шаг 5 падал с `500` и timeout на `executor /v2/getServiceForFunction`
+- теперь шаг 5 падает с постоянным `404`
+
+Лог router:
+```
+Failed to watch err="failed to list *v1.Namespace: namespaces is forbidden:
+User \"system:serviceaccount:fission:fission-router\" cannot list resource
+\"namespaces\" in API group \"\" at the cluster scope"
+```
+
+### Вывод
+Executor-path уже починен, но router NSWatcher не работает, потому что у SA
+`fission-router` нет cluster-scope прав `list/watch` на `namespaces`.
+
+### Исправление
+Добавить в `deploy/multitenant/rbac.yaml` ещё один набор ресурсов:
+- `ClusterRole/fission-router-ns-watcher`
+- `ClusterRoleBinding/fission-router-ns-watcher`
+
+С правами:
+- core `namespaces`: `list`, `watch`