# Создан: 2026-04-07
# sqs-operator.yaml — деплой SQS Operator в Kubernetes.
# Содержит: Namespace, ServiceAccount, ClusterRole, ClusterRoleBinding,
#           ConfigMap (конфиг), Deployment (оператор).
# CRD QueueService применяется отдельно через config/crd/bases/
---
apiVersion: v1
kind: Namespace
metadata:
  name: sqs-operator
  labels:
    app.kubernetes.io/managed-by: sqs-operator
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sqs-operator
  namespace: sqs-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sqs-operator-role
rules:
  # QueueService CRD
  - apiGroups: ["sqs.kube5s.ru"]
    resources: ["queueservices"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["sqs.kube5s.ru"]
    resources: ["queueservices/status"]
    verbs: ["get", "update", "patch"]
  - apiGroups: ["sqs.kube5s.ru"]
    resources: ["queueservices/finalizers"]
    verbs: ["update"]
  # Deployments, Services, ConfigMaps, Secrets, PVCs — для создания ресурсов тенанта
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["services", "configmaps", "secrets", "persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Namespaces — создание sless-fn-{tenant} если не существует
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch", "create"]
  # Ingress
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Leader election
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sqs-operator-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sqs-operator-role
subjects:
  - kind: ServiceAccount
    name: sqs-operator
    namespace: sqs-operator
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sqs-operator-config
  namespace: sqs-operator
data:
  # Публичный хост — настраивается при деплое в облако (dev → prod)
  SQS_EXTERNAL_HOST: "sqs.kube5s.ru"
  # Образ ElasticMQ — переопределяет встроенный дефолт в контроллере
  SQS_ELASTICMQ_IMAGE: "softwaremill/elasticmq-native:1.7.1"
  OPERATOR_NAMESPACE: "sqs-operator"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sqs-operator
  namespace: sqs-operator
  labels:
    app.kubernetes.io/name: sqs-operator
    app.kubernetes.io/component: operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: sqs-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sqs-operator
        app.kubernetes.io/component: operator
    spec:
      serviceAccountName: sqs-operator
      containers:
        - name: manager
          image: pearlharbor.registryk8s.services.ngcloud.ru/naeel/sqs-operator:v0.1.0
          imagePullPolicy: Always
          command: ["/manager"]
          ports:
            - containerPort: 8080
              name: metrics
              protocol: TCP
            - containerPort: 8081
              name: health
              protocol: TCP
          envFrom:
            - configMapRef:
                name: sqs-operator-config
          resources:
            requests:
              cpu: "20m"
              memory: "32Mi"
            limits:
              cpu: "200m"
              memory: "128Mi"
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
      imagePullSecrets:
        - name: sless-registry-auth