feat: sqs-operator — CRD QueueService, контроллер, ElasticMQ per-tenant

2026-04-07 13:56:53 +03:00
parent a22a37bef3
commit cbe61d9f62
9 changed files with 1956 additions and 0 deletions
@@ -0,0 +1,138 @@
+# Создан: 2026-04-07
+# sqs-operator.yaml — деплой SQS Operator в Kubernetes.
+# Содержит: Namespace, ServiceAccount, ClusterRole, ClusterRoleBinding,
+#           ConfigMap (конфиг), Deployment (оператор).
+# CRD QueueService применяется отдельно через config/crd/bases/
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sqs-operator
+  labels:
+    app.kubernetes.io/managed-by: sqs-operator
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sqs-operator
+  namespace: sqs-operator
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sqs-operator-role
+rules:
+  # QueueService CRD
+  - apiGroups: ["sqs.kube5s.ru"]
+    resources: ["queueservices"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["sqs.kube5s.ru"]
+    resources: ["queueservices/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["sqs.kube5s.ru"]
+    resources: ["queueservices/finalizers"]
+    verbs: ["update"]
+  # Deployments, Services, ConfigMaps, Secrets, PVCs — для создания ресурсов тенанта
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["services", "configmaps", "secrets", "persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Namespaces — создание sless-fn-{tenant} если не существует
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch", "create"]
+  # Ingress
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Leader election
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sqs-operator-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sqs-operator-role
+subjects:
+  - kind: ServiceAccount
+    name: sqs-operator
+    namespace: sqs-operator
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sqs-operator-config
+  namespace: sqs-operator
+data:
+  # Публичный хост — настраивается при деплое в облако (dev → prod)
+  SQS_EXTERNAL_HOST: "sqs.kube5s.ru"
+  # Образ ElasticMQ — переопределяет встроенный дефолт в контроллере
+  SQS_ELASTICMQ_IMAGE: "softwaremill/elasticmq-native:1.7.1"
+  OPERATOR_NAMESPACE: "sqs-operator"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sqs-operator
+  namespace: sqs-operator
+  labels:
+    app.kubernetes.io/name: sqs-operator
+    app.kubernetes.io/component: operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sqs-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sqs-operator
+        app.kubernetes.io/component: operator
+    spec:
+      serviceAccountName: sqs-operator
+      containers:
+        - name: manager
+          image: pearlharbor.registryk8s.services.ngcloud.ru/naeel/sqs-operator:v0.1.0
+          imagePullPolicy: Always
+          command: ["/manager"]
+          ports:
+            - containerPort: 8080
+              name: metrics
+              protocol: TCP
+            - containerPort: 8081
+              name: health
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: sqs-operator-config
+          resources:
+            requests:
+              cpu: "20m"
+              memory: "32Mi"
+            limits:
+              cpu: "200m"
+              memory: "128Mi"
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      imagePullSecrets:
+        - name: sless-registry-auth