Separate service accounts for each fission component (#2560)

* Separate service accounts for each component
* Permission changes per component
* Fixed fluentbit permissions
* added hooks to pre-upgrade service account and role
* Adjusted hook weights for pre-upgrade hook
* Replaced * with explicit permissions

charts/fission-all/templates/fluentbit/clusterrole.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-fission-cr-fluentbit
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

charts/fission-all/templates/fluentbit/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-fission-cr-fluentbit
+subjects:
+  - kind: ServiceAccount
+    name: fission-fluentbit
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-fission-cr-fluentbit
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/fluentbit/fluentbit.yaml

@@ -173,7 +173,7 @@ spec:
             - name: fluentbit-config
               mountPath: /fluent-bit/etc/
               readOnly: true
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-fluentbit
       volumes:
         - name: container-log
           hostPath:

charts/fission-all/templates/fluentbit/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fluentbit
+  namespace: {{ .Release.Namespace }}