“Naeel”
0aaeb47b3b
- FunctionJobReconciler: added KubeClient field (kubernetes.Interface) - getJobPodOutput(): reads pod logs via typed client after job succeeds - main.go: inject kubernetes.NewForConfigOrDie into FunctionJobReconciler - rbac.yaml: add pods/pods/log get/list/watch permissions - examples/simple-python/: job->function chain demo (Python) - examples/simple-node/: job->function chain demo (Node.js) sless_job.X.message now contains the return value of the function
73 lines
2.7 KiB
YAML
73 lines
2.7 KiB
YAML
# Изменено: 2026-03-09 (добавлен доступ к pods/log для feature B)
|
|
# RBAC для sless оператора.
|
|
# ServiceAccount + ClusterRole + ClusterRoleBinding.
|
|
# ClusterRole нужен (не namespaced Role) потому что оператор создаёт
|
|
# ресурсы в нескольких namespace (sless + sless-fn-*)
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sless-operator
|
|
namespace: sless
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: sless-operator
|
|
rules:
|
|
# Наши CRD
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions", "triggers", "functionjobs"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/status", "triggers/status", "functionjobs/status"]
|
|
verbs: ["get", "update", "patch"]
|
|
- apiGroups: ["sless.kube5s.ru"]
|
|
resources: ["functions/finalizers", "triggers/finalizers", "functionjobs/finalizers"]
|
|
verbs: ["update"]
|
|
# Deployments для функций
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Jobs для kaniko builder
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs", "cronjobs"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Services + Ingress для HTTP триггеров
|
|
- apiGroups: [""]
|
|
resources: ["services", "namespaces"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Secrets — pull-секрет копируется в sless-fn-* namespace при создании функций
|
|
# list/watch нужны для controller-runtime cache (информер на secrets)
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Events для operator-sdk
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
# Pods + logs — чтение stdout завершённых Job-подов (feature B: status.Message = return value функции)
|
|
- apiGroups: [""]
|
|
resources: ["pods", "pods/log"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Lease для leader election
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: sless-operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: sless-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sless-operator
|
|
namespace: sless
|