69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
# Изменено: 2026-03-07
|
|
# RBAC для sless оператора.
|
|
# ServiceAccount + ClusterRole + ClusterRoleBinding.
|
|
# ClusterRole нужен (не namespaced Role) потому что оператор создаёт
|
|
# ресурсы в нескольких namespace (sless + sless-fn-*)
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sless-operator
|
|
namespace: sless
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: sless-operator
|
|
rules:
|
|
# Наши CRD
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions", "triggers", "functionjobs"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/status", "triggers/status", "functionjobs/status"]
|
|
verbs: ["get", "update", "patch"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/finalizers", "triggers/finalizers", "functionjobs/finalizers"]
|
|
verbs: ["update"]
|
|
# Deployments для функций
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Jobs для kaniko builder
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs", "cronjobs"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Services + Ingress для HTTP триггеров
|
|
- apiGroups: [""]
|
|
resources: ["services", "namespaces"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Secrets — pull-секрет копируется в sless-fn-* namespace при создании функций
|
|
# list/watch нужны для controller-runtime cache (информер на secrets)
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Events для operator-sdk
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
# Lease для leader election
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: sless-operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: sless-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sless-operator
|
|
namespace: sless
|