84 lines
3.4 KiB
YAML
84 lines
3.4 KiB
YAML
# Изменено: 2026-04-04 — добавлены IoT CRD права (iot.kube5s.ru)
|
|
# RBAC для sless оператора.
|
|
# ServiceAccount + ClusterRole + ClusterRoleBinding.
|
|
# ClusterRole нужен (не namespaced Role) потому что оператор создаёт
|
|
# ресурсы в нескольких namespace (sless + sless-fn-*)
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sless-operator
|
|
namespace: sless
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: sless-operator
|
|
rules:
|
|
# Наши CRD (sless.kube5s.ru)
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions", "triggers", "functionjobs", "services"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/status", "triggers/status", "functionjobs/status", "services/status"]
|
|
verbs: ["get", "update", "patch"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/finalizers", "triggers/finalizers", "functionjobs/finalizers", "services/finalizers"]
|
|
verbs: ["update"]
|
|
# IoT CRD (iot.kube5s.ru) — IoTDevice lifecycle + Secret генерация в контроллере
|
|
# Права нужны во всех namespace где пользователи создают IoT-устройства
|
|
- apiGroups: ["iot.kube5s.ru"]
|
|
resources: ["iotdevices"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: ["iot.kube5s.ru"]
|
|
resources: ["iotdevices/status"]
|
|
verbs: ["get", "update", "patch"]
|
|
- apiGroups: ["iot.kube5s.ru"]
|
|
resources: ["iotdevices/finalizers"]
|
|
verbs: ["update"]
|
|
# Deployments для функций
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Jobs для kaniko builder
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs", "cronjobs"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Services + Ingress для HTTP триггеров
|
|
- apiGroups: [""]
|
|
resources: ["services", "namespaces"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Secrets — pull-секрет копируется в sless-fn-* namespace при создании функций
|
|
# list/watch нужны для controller-runtime cache (информер на secrets)
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Events для operator-sdk
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
# Pods + logs — чтение stdout завершённых Job-подов (feature B: status.Message = return value функции)
|
|
- apiGroups: [""]
|
|
resources: ["pods", "pods/log"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Lease для leader election
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: sless-operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: sless-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sless-operator
|
|
namespace: sless
|