feat(iot): деплой IoT MVP — Dockerfile, RBAC, EMQX fix, operator v0.1.50, mqtt-bridge, doc/iot

deployments/k8s/rbac.yaml

@@ -1,4 +1,4 @@
-# Изменено: 2026-03-20 (добавлен Service CRD sless.kube5s.ru — services + status + finalizers)
+# Изменено: 2026-04-04 — добавлены IoT CRD права (iot.kube5s.ru)
 # RBAC для sless оператора.
 # ServiceAccount + ClusterRole + ClusterRoleBinding.
 # ClusterRole нужен (не namespaced Role) потому что оператор создаёт
@@ -15,7 +15,7 @@ kind: ClusterRole
 metadata:
   name: sless-operator
 rules:
-  # Наши CRD
+  # Наши CRD (sless.kube5s.ru)
   - apiGroups: ["sless.kube5s.ru"]
     resources: ["functions", "triggers", "functionjobs", "services"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
@@ -25,6 +25,17 @@ rules:
   - apiGroups: ["sless.kube5s.ru"]
     resources: ["functions/finalizers", "triggers/finalizers", "functionjobs/finalizers", "services/finalizers"]
     verbs: ["update"]
+  # IoT CRD (iot.kube5s.ru) — IoTDevice lifecycle + Secret генерация в контроллере
+  # Права нужны во всех namespace где пользователи создают IoT-устройства
+  - apiGroups: ["iot.kube5s.ru"]
+    resources: ["iotdevices"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["iot.kube5s.ru"]
+    resources: ["iotdevices/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["iot.kube5s.ru"]
+    resources: ["iotdevices/finalizers"]
+    verbs: ["update"]
   # Deployments для функций
   - apiGroups: ["apps"]
     resources: ["deployments"]