From 33ee17729f05b2005961384ff5de22384c254dfa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= Date: Sat, 7 Mar 2026 08:57:54 +0400 Subject: [PATCH] =?UTF-8?q?docs:=20=D0=BE=D0=B1=D0=BD=D0=BE=D0=B2=D0=B8?= =?UTF-8?q?=D1=82=D1=8C=20progress.md=20=D0=BF=D0=BE=20=D1=84=D0=B0=D0=BA?= =?UTF-8?q?=D1=82=D0=B8=D1=87=D0=B5=D1=81=D0=BA=D0=BE=D0=BC=D1=83=20=D1=81?= =?UTF-8?q?=D0=BE=D1=81=D1=82=D0=BE=D1=8F=D0=BD=D0=B8=D1=8E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - отражён реальный статус всех компонентов кода - отражено состояние кластера (CRD, RBAC, postgres) - добавлен список что ещё не сделано - добавлены deployments/k8s/rbac.yaml, postgres.yaml --- .gitignore | 1 + deployments/k8s/postgres.yaml | 57 +++++++++++++++++++++++++++++++ deployments/k8s/rbac.yaml | 63 +++++++++++++++++++++++++++++++++++ doc/progress.md | 59 ++++++++++++++++++++++++-------- 4 files changed, 166 insertions(+), 14 deletions(-) create mode 100644 deployments/k8s/postgres.yaml create mode 100644 deployments/k8s/rbac.yaml diff --git a/.gitignore b/.gitignore index 4aeb6f8..4ccb3de 100644 --- a/.gitignore +++ b/.gitignore @@ -10,6 +10,7 @@ *.dylib bin testbin/* +hack/local.env Dockerfile.cross # Test binary, build with `go test -c` diff --git a/deployments/k8s/postgres.yaml b/deployments/k8s/postgres.yaml new file mode 100644 index 0000000..520a6ac --- /dev/null +++ b/deployments/k8s/postgres.yaml @@ -0,0 +1,57 @@ +# Изменено: 2026-03-07 +# PostgreSQL для хранения логов вызовов функций. +# Для dev/test — без PersistentVolume, данные ephemeral. +# В prod заменить на managed PostgreSQL от провайдера. +--- +apiVersion: v1 +kind: Secret +metadata: + name: postgres-secret + namespace: sless +stringData: + POSTGRES_PASSWORD: "sless-pg-password" + POSTGRES_USER: "sless" + POSTGRES_DB: "sless" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: postgres + namespace: sless +spec: + replicas: 1 + selector: + matchLabels: + app: postgres + template: + metadata: + labels: + app: postgres + spec: + containers: + - name: postgres + image: postgres:16-alpine + ports: + - containerPort: 5432 + envFrom: + - secretRef: + name: postgres-secret + resources: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "256Mi" + cpu: "500m" +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres + namespace: sless +spec: + selector: + app: postgres + ports: + - port: 5432 + targetPort: 5432 diff --git a/deployments/k8s/rbac.yaml b/deployments/k8s/rbac.yaml new file mode 100644 index 0000000..eb220e1 --- /dev/null +++ b/deployments/k8s/rbac.yaml @@ -0,0 +1,63 @@ +# Изменено: 2026-03-07 +# RBAC для sless оператора. +# ServiceAccount + ClusterRole + ClusterRoleBinding. +# ClusterRole нужен (не namespaced Role) потому что оператор создаёт +# ресурсы в нескольких namespace (sless + sless-fn-*) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: sless-operator + namespace: sless +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: sless-operator +rules: + # Наши CRD + - apiGroups: ["sless.kube5s.ru"] + resources: ["functions", "triggers"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["sless.kube5s.ru"] + resources: ["functions/status", "triggers/status"] + verbs: ["get", "update", "patch"] + - apiGroups: ["sless.kube5s.ru"] + resources: ["functions/finalizers", "triggers/finalizers"] + verbs: ["update"] + # Deployments для функций + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + # Jobs для kaniko builder + - apiGroups: ["batch"] + resources: ["jobs", "cronjobs"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + # Services + Ingress для HTTP триггеров + - apiGroups: [""] + resources: ["services", "namespaces"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + # Events для operator-sdk + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] + # Lease для leader election + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: sless-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: sless-operator +subjects: + - kind: ServiceAccount + name: sless-operator + namespace: sless diff --git a/doc/progress.md b/doc/progress.md index 94db9b6..b5b0a52 100644 --- a/doc/progress.md +++ b/doc/progress.md @@ -1,31 +1,62 @@ # Прогресс разработки +Последнее обновление: 2026-03-07 + ## Статусы: ✅ готово | 🔄 в процессе | ⏳ не начато --- ## v1 — Базовый сервис +### Код + | # | Компонент | Статус | Заметки | |---|-----------|--------|---------| -| 1 | Структура проекта, go mod init | ✅ | operator-sdk init, CRD: Function, Trigger | -| 2 | internal/config | ⏳ | | -| 3 | internal/model | ⏳ | | -| 4 | Миграции PostgreSQL | ⏳ | | -| 5 | internal/storage/postgres | ⏳ | | -| 6 | internal/api — роутер + хендлеры | ⏳ | | -| 7 | internal/storage/s3 | ⏳ | | -| 8 | internal/builder | ⏳ | | -| 9 | internal/runner (k8s) | ⏳ | | -| 10 | docker-compose.yml (local dev) | ⏳ | | -| 11 | deployments/k8s манифесты | ⏳ | | +| 1 | Структура проекта, operator-sdk init | ✅ | module: gitea-naeel.giteak8s.services.ngcloud.ru/naeel/sless | +| 2 | CRD types: Function, Trigger | ✅ | api/v1alpha1/, zz_generated.deepcopy.go | +| 3 | internal/config | ✅ | config.go, Load() из env vars, добавлены IngressHost + APIToken | +| 4 | Миграции PostgreSQL | ✅ | migrations/001_initial.sql — таблица invocations | +| 5 | internal/storage/postgres | ✅ | store.go: SaveInvocation, ListInvocations, RunMigrations | +| 6 | internal/storage/s3 | ✅ | client.go: Upload, Download, Delete, EnsureBucket (Ceph S3) | +| 7 | internal/builder | ✅ | builder.go: kaniko Jobs для сборки образов функций | +| 8 | controllers/function_controller.go | ✅ | Pending→Building(kaniko)→Ready/Failed, Deployment, finalizer | +| 9 | controllers/trigger_controller.go | ✅ | HTTP→Service+Ingress, Cron→CronJob, finalizer | +| 10 | internal/api/router.go | ✅ | gorilla/mux, /v1/namespaces/{ns}/... | +| 11 | internal/api/handler/ | ✅ | functions.go, triggers.go, invocations.go, handler.go (slog) | +| 12 | internal/api/middleware/ | ✅ | auth.go (Bearer token), logging.go (slog) | +| 13 | main.go | ✅ | operator manager + HTTP сервер параллельно, wire всех зависимостей | + +### Кластер (namespace: sless) + +| # | Ресурс | Статус | Заметки | +|---|--------|--------|---------| +| 1 | namespace sless | ✅ | создан | +| 2 | CRD functions.sless.kube5s.ru | ✅ | установлен из config/crd/bases/ | +| 3 | CRD triggers.sless.kube5s.ru | ✅ | установлен из config/crd/bases/ | +| 4 | ServiceAccount sless-operator | ✅ | deployments/k8s/rbac.yaml | +| 5 | ClusterRole + ClusterRoleBinding | ✅ | deployments/k8s/rbac.yaml | +| 6 | PostgreSQL Deployment + Service | ✅ | deployments/k8s/postgres.yaml, Running | +| 7 | Secret postgres-secret | ✅ | в namespace sless | + +### Что ещё не сделано + +| # | Компонент | Статус | Заметки | +|---|-----------|--------|---------| +| 1 | Запуск оператора локально | ⏳ | source hack/local.env && go run main.go | +| 2 | Проверка подключения к Ceph S3 из кластера | ⏳ | endpoint: s3.msk-1.ngcloud.ru | +| 3 | Endpoint загрузки кода функции (upload zip) | ⏳ | POST /v1/…/upload | +| 4 | deployments/k8s/operator.yaml | ⏳ | Deployment оператора в кластере | +| 5 | hack/test.sh — curl smoke-тесты | ⏳ | | +| 6 | Terraform provider — ресурс serverless_function | ⏳ | отдельная репа | + +--- ## v2 — Расширения | # | Компонент | Статус | Заметки | |---|-----------|--------|---------| | 1 | RabbitMQ event triggers | ⏳ | | -| 2 | Keycloak / облачный auth | ⏳ | | +| 2 | Облачный auth (nubes.ru token validation) | ⏳ | v1 — статический токен | | 3 | Метрики → Victoria Metrics | ⏳ | | -| 4 | Интеграция с облачными PostgreSQL/Redis | ⏳ | | -| 5 | Мониторинг UI | ⏳ | | +| 4 | Managed PostgreSQL от провайдера | ⏳ | сейчас postgres в k8s | +| 5 | Pre-warm для cron триггеров | ⏳ | TriggerSpec.PreWarmSeconds — поле есть, логика не реализована |