Separate service accounts for each fission component (#2560)

* Separate service accounts for each component
* Permission changes per component
* Fixed fluentbit permissions
* added hooks to pre-upgrade service account and role
* Adjusted hook weights for pre-upgrade hook
* Replaced * with explicit permissions

charts/fission-all/templates/controller/clusterrole.yaml

@@ -0,0 +1,82 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-fission-cr-controller
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - namespaces
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind

charts/fission-all/templates/controller/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-fission-cr-controller
+subjects:
+  - kind: ServiceAccount
+    name: fission-controller
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-fission-cr-controller
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/controller/deployment.yaml

@@ -78,7 +78,7 @@ spec:
             name: pprof
         {{- end }}
   
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-controller
       volumes:
       - name: config-volume
         configMap:

charts/fission-all/templates/controller/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-controller
+  namespace: {{ .Release.Namespace }}