# Изменено: 2026-03-07
# RBAC для sless оператора.
# ServiceAccount + ClusterRole + ClusterRoleBinding.
# ClusterRole нужен (не namespaced Role) потому что оператор создаёт
# ресурсы в нескольких namespace (sless + sless-fn-*)
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sless-operator
  namespace: sless
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sless-operator
rules:
  # Наши CRD
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions", "triggers"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions/status", "triggers/status"]
    verbs: ["get", "update", "patch"]
  - apiGroups: ["sless.kube5s.ru"]
    resources: ["functions/finalizers", "triggers/finalizers"]
    verbs: ["update"]
  # Deployments для функций
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Jobs для kaniko builder
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Services + Ingress для HTTP триггеров
  - apiGroups: [""]
    resources: ["services", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Events для operator-sdk
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
  # Lease для leader election
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sless-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sless-operator
subjects:
  - kind: ServiceAccount
    name: sless-operator
    namespace: sless