# Изменено: 2026-03-09 (добавлен доступ к pods/log для feature B)
# RBAC для sless оператора.
# ServiceAccount + ClusterRole + ClusterRoleBinding.
# ClusterRole нужен (не namespaced Role) потому что оператор создаёт
# ресурсы в нескольких namespace (sless + sless-fn-*)
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sless-operator
  namespace: sless
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sless-operator
rules:
  # Наши CRD
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions", "triggers", "functionjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions/status", "triggers/status", "functionjobs/status"]
    verbs: ["get", "update", "patch"]
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions/finalizers", "triggers/finalizers", "functionjobs/finalizers"]
    verbs: ["update"]
  # Deployments для функций
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Jobs для kaniko builder
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Services + Ingress для HTTP триггеров
  - apiGroups: [""]
    resources: ["services", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Secrets — pull-секрет копируется в sless-fn-* namespace при создании функций
  # list/watch нужны для controller-runtime cache (информер на secrets)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Events для operator-sdk
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
  # Pods + logs — чтение stdout завершённых Job-подов (feature B: status.Message = return value функции)
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  # Lease для leader election
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sless-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sless-operator
subjects:
  - kind: ServiceAccount
    name: sless-operator
    namespace: sless