diff --git a/.github/workflows/upgrade_test.yaml b/.github/workflows/upgrade_test.yaml index f8d77cb5..c179e289 100644 --- a/.github/workflows/upgrade_test.yaml +++ b/.github/workflows/upgrade_test.yaml @@ -91,6 +91,11 @@ jobs: run: | command -v fission && fission support dump + - name: Kind export logs + if: ${{ always() }} + run: | + kind export logs --name kind kind-logs + - name: Archive fission dump if: ${{ failure() }} uses: actions/upload-artifact@v2 @@ -98,3 +103,11 @@ jobs: name: fission-dump path: fission-dump/*.zip retention-days: 5 + + - name: Archive kind logs + if: ${{ always() }} + uses: actions/upload-artifact@v2 + with: + name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }} + path: kind-logs/* + retention-days: 5 diff --git a/charts/fission-all/templates/analytics/nonhelm-install-job.yaml b/charts/fission-all/templates/analytics/nonhelm-install-job.yaml index 77449975..3a055f95 100644 --- a/charts/fission-all/templates/analytics/nonhelm-install-job.yaml +++ b/charts/fission-all/templates/analytics/nonhelm-install-job.yaml @@ -37,5 +37,4 @@ spec: env: - name: GA_TRACKING_ID value: "{{ .Values.gaTrackingID }}" - serviceAccountName: fission-svc {{- end }} diff --git a/charts/fission-all/templates/analytics/post-install-job.yaml b/charts/fission-all/templates/analytics/post-install-job.yaml index d78c4c56..8bdd689c 100644 --- a/charts/fission-all/templates/analytics/post-install-job.yaml +++ b/charts/fission-all/templates/analytics/post-install-job.yaml @@ -47,5 +47,4 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc {{- end }} diff --git a/charts/fission-all/templates/analytics/post-upgrade-job.yaml b/charts/fission-all/templates/analytics/post-upgrade-job.yaml index 313f6c17..86c9abcb 100644 --- a/charts/fission-all/templates/analytics/post-upgrade-job.yaml +++ b/charts/fission-all/templates/analytics/post-upgrade-job.yaml @@ -47,5 +47,4 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc {{- end }} diff --git a/charts/fission-all/templates/buildermgr/clusterrole.yaml b/charts/fission-all/templates/buildermgr/clusterrole.yaml new file mode 100644 index 00000000..bf5dd6f9 --- /dev/null +++ b/charts/fission-all/templates/buildermgr/clusterrole.yaml @@ -0,0 +1,94 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-buildermgr +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml new file mode 100644 index 00000000..7bbb0371 --- /dev/null +++ b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-buildermgr +subjects: + - kind: ServiceAccount + name: fission-buildermgr + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-buildermgr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/buildermgr/deployment.yaml b/charts/fission-all/templates/buildermgr/deployment.yaml index 9b81fc05..1d67708a 100644 --- a/charts/fission-all/templates/buildermgr/deployment.yaml +++ b/charts/fission-all/templates/buildermgr/deployment.yaml @@ -67,7 +67,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-buildermgr {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} diff --git a/charts/fission-all/templates/buildermgr/serviceaccount.yaml b/charts/fission-all/templates/buildermgr/serviceaccount.yaml new file mode 100644 index 00000000..0127793c --- /dev/null +++ b/charts/fission-all/templates/buildermgr/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-buildermgr + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/controller/clusterrole.yaml b/charts/fission-all/templates/controller/clusterrole.yaml new file mode 100644 index 00000000..f01d10e7 --- /dev/null +++ b/charts/fission-all/templates/controller/clusterrole.yaml @@ -0,0 +1,82 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-controller +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/controller/clusterrolebinding.yaml b/charts/fission-all/templates/controller/clusterrolebinding.yaml new file mode 100644 index 00000000..a0ae98e1 --- /dev/null +++ b/charts/fission-all/templates/controller/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-controller +subjects: + - kind: ServiceAccount + name: fission-controller + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-controller + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/deployment.yaml b/charts/fission-all/templates/controller/deployment.yaml index 3fdcdfe1..d5ee524d 100644 --- a/charts/fission-all/templates/controller/deployment.yaml +++ b/charts/fission-all/templates/controller/deployment.yaml @@ -78,7 +78,7 @@ spec: name: pprof {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-controller volumes: - name: config-volume configMap: diff --git a/charts/fission-all/templates/controller/serviceaccount.yaml b/charts/fission-all/templates/controller/serviceaccount.yaml new file mode 100644 index 00000000..ffd71a94 --- /dev/null +++ b/charts/fission-all/templates/controller/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-controller + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/executor/clusterrole.yaml b/charts/fission-all/templates/executor/clusterrole.yaml new file mode 100644 index 00000000..379cb0d4 --- /dev/null +++ b/charts/fission-all/templates/executor/clusterrole.yaml @@ -0,0 +1,101 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-executor +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +- apiGroups: + - metrics.k8s.io + resources: + - pods + verbs: + - get + - list diff --git a/charts/fission-all/templates/executor/clusterrolebinding.yaml b/charts/fission-all/templates/executor/clusterrolebinding.yaml new file mode 100644 index 00000000..a059df90 --- /dev/null +++ b/charts/fission-all/templates/executor/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-executor +subjects: + - kind: ServiceAccount + name: fission-executor + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-executor + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/deployment.yaml b/charts/fission-all/templates/executor/deployment.yaml index a782df41..b3f6e937 100644 --- a/charts/fission-all/templates/executor/deployment.yaml +++ b/charts/fission-all/templates/executor/deployment.yaml @@ -108,7 +108,7 @@ spec: {{- else if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-executor {{- if .Values.executor.priorityClassName }} priorityClassName: {{ .Values.executor.priorityClassName }} {{- else if .Values.priorityClassName }} diff --git a/charts/fission-all/templates/executor/serviceaccount.yaml b/charts/fission-all/templates/executor/serviceaccount.yaml new file mode 100644 index 00000000..5207694d --- /dev/null +++ b/charts/fission-all/templates/executor/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-executor + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/fluentbit/clusterrole.yaml b/charts/fission-all/templates/fluentbit/clusterrole.yaml new file mode 100644 index 00000000..1e314f66 --- /dev/null +++ b/charts/fission-all/templates/fluentbit/clusterrole.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-fluentbit +rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch diff --git a/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml new file mode 100644 index 00000000..272d6b4b --- /dev/null +++ b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-fluentbit +subjects: + - kind: ServiceAccount + name: fission-fluentbit + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-fluentbit + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/fluentbit/fluentbit.yaml b/charts/fission-all/templates/fluentbit/fluentbit.yaml index 6b361bb6..959ecc4d 100644 --- a/charts/fission-all/templates/fluentbit/fluentbit.yaml +++ b/charts/fission-all/templates/fluentbit/fluentbit.yaml @@ -173,7 +173,7 @@ spec: - name: fluentbit-config mountPath: /fluent-bit/etc/ readOnly: true - serviceAccountName: fission-svc + serviceAccountName: fission-fluentbit volumes: - name: container-log hostPath: diff --git a/charts/fission-all/templates/fluentbit/serviceaccount.yaml b/charts/fission-all/templates/fluentbit/serviceaccount.yaml new file mode 100644 index 00000000..3ff76a68 --- /dev/null +++ b/charts/fission-all/templates/fluentbit/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-fluentbit + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/kubewatcher/clusterrole.yaml b/charts/fission-all/templates/kubewatcher/clusterrole.yaml new file mode 100644 index 00000000..ebbd87b5 --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/clusterrole.yaml @@ -0,0 +1,102 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-kubewatcher +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml new file mode 100644 index 00000000..16bd686b --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-kubewatcher +subjects: + - kind: ServiceAccount + name: fission-kubewatcher + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-kubewatcher + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/deployment.yaml b/charts/fission-all/templates/kubewatcher/deployment.yaml index b50aefbf..2dc47352 100644 --- a/charts/fission-all/templates/kubewatcher/deployment.yaml +++ b/charts/fission-all/templates/kubewatcher/deployment.yaml @@ -38,7 +38,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-kubewatcher {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} diff --git a/charts/fission-all/templates/kubewatcher/serviceaccount.yaml b/charts/fission-all/templates/kubewatcher/serviceaccount.yaml new file mode 100644 index 00000000..d73060ca --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-kubewatcher + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml new file mode 100644 index 00000000..7acd47fa --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml @@ -0,0 +1,94 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-kafka +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml new file mode 100644 index 00000000..2435861b --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-kafka +subjects: + - kind: ServiceAccount + name: fission-kafka + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-kafka + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/deployment.yaml b/charts/fission-all/templates/mqt-fission-kafka/deployment.yaml index eff9d364..a8367c0f 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/deployment.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/deployment.yaml @@ -67,7 +67,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-kafka {{- if .Values.kafka.authentication.tls.enabled }} volumes: - name: kafka-secrets diff --git a/charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml b/charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml new file mode 100644 index 00000000..c0d0f81d --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-kafka + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/common/clusterrole.yaml b/charts/fission-all/templates/mqt-keda/clusterrole.yaml similarity index 77% rename from charts/fission-all/templates/common/clusterrole.yaml rename to charts/fission-all/templates/mqt-keda/clusterrole.yaml index 290243fa..5965e2ff 100644 --- a/charts/fission-all/templates/common/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-admin + name: {{ .Release.Name }}-fission-cr-keda rules: - apiGroups: - "" @@ -28,21 +28,13 @@ rules: - deployments/scale - replicasets verbs: - - '*' -- apiGroups: - - batch - resources: - - jobs - verbs: + - create - get - list - watch -- apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - '*' + - update + - patch + - delete - apiGroups: - apiextensions.k8s.io resources: @@ -63,19 +55,37 @@ rules: - packages - timetriggers verbs: - - '*' + - create + - get + - list + - watch + - update + - patch + - delete - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - - '*' + - create + - get + - list + - watch + - update + - patch + - delete - apiGroups: - rbac.authorization.k8s.io resources: - rolebindings verbs: - - '*' + - create + - get + - list + - watch + - update + - patch + - delete - apiGroups: - rbac.authorization.k8s.io resources: @@ -92,7 +102,13 @@ rules: - triggerauthentications - triggerauthentications/status verbs: - - '*' + - create + - get + - list + - watch + - update + - patch + - delete {{- if .Values.mqt_keda.enabled }} - apiGroups: - keda.k8s.io @@ -104,7 +120,13 @@ rules: - triggerauthentications - triggerauthentications/status verbs: - - '*' + - create + - get + - list + - watch + - update + - patch + - delete {{- end }} - apiGroups: - metrics.k8s.io diff --git a/charts/fission-all/templates/common/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml similarity index 66% rename from charts/fission-all/templates/common/clusterrolebinding.yaml rename to charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml index 2801a4ad..86fe321b 100644 --- a/charts/fission-all/templates/common/clusterrolebinding.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-admin + name: {{ .Release.Name }}-fission-cr-keda subjects: - kind: ServiceAccount - name: fission-svc + name: fission-keda namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-admin + name: {{ .Release.Name }}-fission-cr-keda apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/deployment.yaml b/charts/fission-all/templates/mqt-keda/deployment.yaml index 6a59f11a..6a4aed5a 100644 --- a/charts/fission-all/templates/mqt-keda/deployment.yaml +++ b/charts/fission-all/templates/mqt-keda/deployment.yaml @@ -55,7 +55,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-keda {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} diff --git a/charts/fission-all/templates/common/serviceaccount.yaml b/charts/fission-all/templates/mqt-keda/serviceaccount.yaml similarity index 80% rename from charts/fission-all/templates/common/serviceaccount.yaml rename to charts/fission-all/templates/mqt-keda/serviceaccount.yaml index b0b1a807..3e97d6e2 100644 --- a/charts/fission-all/templates/common/serviceaccount.yaml +++ b/charts/fission-all/templates/mqt-keda/serviceaccount.yaml @@ -1,5 +1,5 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: fission-svc + name: fission-keda namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml new file mode 100644 index 00000000..66f213c3 --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml @@ -0,0 +1,30 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-2" +rules: +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - list diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml new file mode 100644 index 00000000..17d0bb62 --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml @@ -0,0 +1,15 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation +subjects: + - kind: ServiceAccount + name: fission-preupgrade + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-preupgrade + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml b/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml index aafcea74..78f829e0 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml @@ -15,6 +15,7 @@ metadata: # job is considered part of the release. "helm.sh/hook": pre-upgrade "helm.sh/hook-delete-policy": hook-succeeded + "helm.sh/hook-weight": "1" spec: backoffLimit: 0 template: @@ -41,5 +42,5 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-preupgrade {{- end }} diff --git a/charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml b/charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml new file mode 100644 index 00000000..fa3cf00c --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-preupgrade + namespace: {{ .Release.Namespace }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-1" diff --git a/charts/fission-all/templates/router/clusterrole.yaml b/charts/fission-all/templates/router/clusterrole.yaml new file mode 100644 index 00000000..0b66ece3 --- /dev/null +++ b/charts/fission-all/templates/router/clusterrole.yaml @@ -0,0 +1,106 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-router +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/router/clusterrolebinding.yaml b/charts/fission-all/templates/router/clusterrolebinding.yaml new file mode 100644 index 00000000..bd053b04 --- /dev/null +++ b/charts/fission-all/templates/router/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-router +subjects: + - kind: ServiceAccount + name: fission-router + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-router + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/deployment.yaml b/charts/fission-all/templates/router/deployment.yaml index 15d38dd5..ff6bbffe 100644 --- a/charts/fission-all/templates/router/deployment.yaml +++ b/charts/fission-all/templates/router/deployment.yaml @@ -122,7 +122,7 @@ spec: {{- else if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-router volumes: - name: config-volume configMap: diff --git a/charts/fission-all/templates/router/serviceaccount.yaml b/charts/fission-all/templates/router/serviceaccount.yaml new file mode 100644 index 00000000..2dafe7ee --- /dev/null +++ b/charts/fission-all/templates/router/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-router + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/storagesvc/clusterrole.yaml b/charts/fission-all/templates/storagesvc/clusterrole.yaml new file mode 100644 index 00000000..20b525aa --- /dev/null +++ b/charts/fission-all/templates/storagesvc/clusterrole.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-storagesvc +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - get + - list diff --git a/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml b/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml new file mode 100644 index 00000000..7ca3c9f7 --- /dev/null +++ b/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-storagesvc +subjects: + - kind: ServiceAccount + name: fission-storagesvc + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-storagesvc + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/deployment.yaml b/charts/fission-all/templates/storagesvc/deployment.yaml index 534478f7..03208beb 100644 --- a/charts/fission-all/templates/storagesvc/deployment.yaml +++ b/charts/fission-all/templates/storagesvc/deployment.yaml @@ -96,7 +96,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-storagesvc {{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }} volumes: - name: fission-storage diff --git a/charts/fission-all/templates/storagesvc/serviceaccount.yaml b/charts/fission-all/templates/storagesvc/serviceaccount.yaml new file mode 100644 index 00000000..c508eb56 --- /dev/null +++ b/charts/fission-all/templates/storagesvc/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-storagesvc + namespace: {{ .Release.Namespace }} diff --git a/charts/fission-all/templates/timer/clusterrole.yaml b/charts/fission-all/templates/timer/clusterrole.yaml new file mode 100644 index 00000000..a4343983 --- /dev/null +++ b/charts/fission-all/templates/timer/clusterrole.yaml @@ -0,0 +1,94 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-timer +rules: +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - services + - serviceaccounts + - replicationcontrollers + - namespaces + - events + verbs: + - create + - delete + - get + - list + - watch + - patch +- apiGroups: + - apps + resources: + - deployments + - deployments/scale + - replicasets + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind diff --git a/charts/fission-all/templates/timer/clusterrolebinding.yaml b/charts/fission-all/templates/timer/clusterrolebinding.yaml new file mode 100644 index 00000000..eefdf433 --- /dev/null +++ b/charts/fission-all/templates/timer/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-timer +subjects: + - kind: ServiceAccount + name: fission-timer + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-timer + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/deployment.yaml b/charts/fission-all/templates/timer/deployment.yaml index 62357a79..c413f4c5 100644 --- a/charts/fission-all/templates/timer/deployment.yaml +++ b/charts/fission-all/templates/timer/deployment.yaml @@ -38,7 +38,7 @@ spec: {{- if .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} {{- end }} - serviceAccountName: fission-svc + serviceAccountName: fission-timer {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} diff --git a/charts/fission-all/templates/timer/serviceaccount.yaml b/charts/fission-all/templates/timer/serviceaccount.yaml new file mode 100644 index 00000000..4f61a392 --- /dev/null +++ b/charts/fission-all/templates/timer/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-timer + namespace: {{ .Release.Namespace }}