Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Separate service accounts for each fission component (#2560)

Browse Source 
* Separate service accounts for each component
* Permission changes per component
* Fixed fluentbit permissions
* added hooks to pre-upgrade service account and role
* Adjusted hook weights for pre-upgrade hook
* Replaced * with explicit permissions
This commit is contained in:
Runit Misra
2022-10-06 19:17:34 +05:30
committed by GitHub
parent 18225db2bd
commit 0739aca920
48 changed files with 974 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/upgrade_test.yaml
+13
View File
@@ -91,6 +91,11 @@ jobs:
run: | run: |
command -v fission && fission support dump command -v fission && fission support dump
- name: Kind export logs
if: ${{ always() }}
run: |
kind export logs --name kind kind-logs
- name: Archive fission dump - name: Archive fission dump
if: ${{ failure() }} if: ${{ failure() }}
uses: actions/upload-artifact@v2 uses: actions/upload-artifact@v2
@@ -98,3 +103,11 @@ jobs:
name: fission-dump name: fission-dump
path: fission-dump/*.zip path: fission-dump/*.zip
retention-days: 5 retention-days: 5
- name: Archive kind logs
if: ${{ always() }}
uses: actions/upload-artifact@v2
with:
name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
path: kind-logs/*
retention-days: 5
charts/fission-all/templates/analytics/nonhelm-install-job.yaml
-1
View File
@@ -37,5 +37,4 @@ spec:
env: env:
- name: GA_TRACKING_ID - name: GA_TRACKING_ID
value: "{{ .Values.gaTrackingID }}" value: "{{ .Values.gaTrackingID }}"
serviceAccountName: fission-svc
{{- end }} {{- end }}
charts/fission-all/templates/analytics/post-install-job.yaml
-1
View File
@@ -47,5 +47,4 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc
{{- end }} {{- end }}
charts/fission-all/templates/analytics/post-upgrade-job.yaml
-1
View File
@@ -47,5 +47,4 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc
{{- end }} {{- end }}
charts/fission-all/templates/buildermgr/clusterrole.yaml
+94
View File
@@ -0,0 +1,94 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-buildermgr
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/buildermgr/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-buildermgr
subjects:
- kind: ServiceAccount
name: fission-buildermgr
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-buildermgr
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/buildermgr/deployment.yaml
+1 -1
View File
@@ -67,7 +67,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-buildermgr
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
charts/fission-all/templates/buildermgr/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-buildermgr
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/controller/clusterrole.yaml
+82
View File
@@ -0,0 +1,82 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-controller
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/controller/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-controller
subjects:
- kind: ServiceAccount
name: fission-controller
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-controller
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/controller/deployment.yaml
+1 -1
View File
@@ -78,7 +78,7 @@ spec:
name: pprof name: pprof
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-controller
volumes: volumes:
- name: config-volume - name: config-volume
configMap: configMap:
charts/fission-all/templates/controller/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-controller
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/executor/clusterrole.yaml
+101
View File
@@ -0,0 +1,101 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-executor
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
- apiGroups:
- metrics.k8s.io
resources:
- pods
verbs:
- get
- list
charts/fission-all/templates/executor/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-executor
subjects:
- kind: ServiceAccount
name: fission-executor
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-executor
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/executor/deployment.yaml
+1 -1
View File
@@ -108,7 +108,7 @@ spec:
{{- else if .Values.terminationMessagePolicy }} {{- else if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-executor
{{- if .Values.executor.priorityClassName }} {{- if .Values.executor.priorityClassName }}
priorityClassName: {{ .Values.executor.priorityClassName }} priorityClassName: {{ .Values.executor.priorityClassName }}
{{- else if .Values.priorityClassName }} {{- else if .Values.priorityClassName }}
charts/fission-all/templates/executor/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-executor
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/fluentbit/clusterrole.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-fluentbit
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
charts/fission-all/templates/fluentbit/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-fluentbit
subjects:
- kind: ServiceAccount
name: fission-fluentbit
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-fluentbit
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/fluentbit/fluentbit.yaml
+1 -1
View File
@@ -173,7 +173,7 @@ spec:
- name: fluentbit-config - name: fluentbit-config
mountPath: /fluent-bit/etc/ mountPath: /fluent-bit/etc/
readOnly: true readOnly: true
serviceAccountName: fission-svc serviceAccountName: fission-fluentbit
volumes: volumes:
- name: container-log - name: container-log
hostPath: hostPath:
charts/fission-all/templates/fluentbit/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-fluentbit
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/kubewatcher/clusterrole.yaml
+102
View File
@@ -0,0 +1,102 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-kubewatcher
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- batch
resources:
- jobs
verbs:
- get
- list
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-kubewatcher
subjects:
- kind: ServiceAccount
name: fission-kubewatcher
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-kubewatcher
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/kubewatcher/deployment.yaml
+1 -1
View File
@@ -38,7 +38,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-kubewatcher
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
charts/fission-all/templates/kubewatcher/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-kubewatcher
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml
+94
View File
@@ -0,0 +1,94 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-kafka
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-kafka
subjects:
- kind: ServiceAccount
name: fission-kafka
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-kafka
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/mqt-fission-kafka/deployment.yaml
+1 -1
View File
@@ -67,7 +67,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-kafka
{{- if .Values.kafka.authentication.tls.enabled }} {{- if .Values.kafka.authentication.tls.enabled }}
volumes: volumes:
- name: kafka-secrets - name: kafka-secrets
charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-kafka
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/common/clusterrole.yaml → charts/fission-all/templates/mqt-keda/clusterrole.yaml
+40 -18
View File
@@ -1,7 +1,7 @@
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: {{ .Release.Name }}-fission-cr-admin name: {{ .Release.Name }}-fission-cr-keda
rules: rules:
- apiGroups: - apiGroups:
- "" - ""
@@ -28,21 +28,13 @@ rules:
- deployments/scale - deployments/scale
- replicasets - replicasets
verbs: verbs:
- '*' - create
- apiGroups:
- batch
resources:
- jobs
verbs:
- get - get
- list - list
- watch - watch
- apiGroups: - update
- networking.k8s.io - patch
resources: - delete
- ingresses
verbs:
- '*'
- apiGroups: - apiGroups:
- apiextensions.k8s.io - apiextensions.k8s.io
resources: resources:
@@ -63,19 +55,37 @@ rules:
- packages - packages
- timetriggers - timetriggers
verbs: verbs:
- '*' - create
- get
- list
- watch
- update
- patch
- delete
- apiGroups: - apiGroups:
- autoscaling - autoscaling
resources: resources:
- horizontalpodautoscalers - horizontalpodautoscalers
verbs: verbs:
- '*' - create
- get
- list
- watch
- update
- patch
- delete
- apiGroups: - apiGroups:
- rbac.authorization.k8s.io - rbac.authorization.k8s.io
resources: resources:
- rolebindings - rolebindings
verbs: verbs:
- '*' - create
- get
- list
- watch
- update
- patch
- delete
- apiGroups: - apiGroups:
- rbac.authorization.k8s.io - rbac.authorization.k8s.io
resources: resources:
@@ -92,7 +102,13 @@ rules:
- triggerauthentications - triggerauthentications
- triggerauthentications/status - triggerauthentications/status
verbs: verbs:
- '*' - create
- get
- list
- watch
- update
- patch
- delete
{{- if .Values.mqt_keda.enabled }} {{- if .Values.mqt_keda.enabled }}
- apiGroups: - apiGroups:
- keda.k8s.io - keda.k8s.io
@@ -104,7 +120,13 @@ rules:
- triggerauthentications - triggerauthentications
- triggerauthentications/status - triggerauthentications/status
verbs: verbs:
- '*' - create
- get
- list
- watch
- update
- patch
- delete
{{- end }} {{- end }}
- apiGroups: - apiGroups:
- metrics.k8s.io - metrics.k8s.io
charts/fission-all/templates/common/clusterrolebinding.yaml → charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml
+3 -3
View File
@@ -1,12 +1,12 @@
kind: ClusterRoleBinding kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ .Release.Name }}-fission-cr-admin name: {{ .Release.Name }}-fission-cr-keda
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: fission-svc name: fission-keda
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
roleRef: roleRef:
kind: ClusterRole kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-admin name: {{ .Release.Name }}-fission-cr-keda
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/mqt-keda/deployment.yaml
+1 -1
View File
@@ -55,7 +55,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-keda
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
charts/fission-all/templates/common/serviceaccount.yaml → charts/fission-all/templates/mqt-keda/serviceaccount.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
name: fission-svc name: fission-keda
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml
+30
View File
@@ -0,0 +1,30 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-preupgrade
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-2"
rules:
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- list
charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml
+15
View File
@@ -0,0 +1,15 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-preupgrade
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
subjects:
- kind: ServiceAccount
name: fission-preupgrade
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-preupgrade
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml
+2 -1
View File
@@ -15,6 +15,7 @@ metadata:
# job is considered part of the release. # job is considered part of the release.
"helm.sh/hook": pre-upgrade "helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": hook-succeeded "helm.sh/hook-delete-policy": hook-succeeded
"helm.sh/hook-weight": "1"
spec: spec:
backoffLimit: 0 backoffLimit: 0
template: template:
@@ -41,5 +42,5 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-preupgrade
{{- end }} {{- end }}
charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-preupgrade
namespace: {{ .Release.Namespace }}
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-1"
charts/fission-all/templates/router/clusterrole.yaml
+106
View File
@@ -0,0 +1,106 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-router
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/router/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-router
subjects:
- kind: ServiceAccount
name: fission-router
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-router
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/router/deployment.yaml
+1 -1
View File
@@ -122,7 +122,7 @@ spec:
{{- else if .Values.terminationMessagePolicy }} {{- else if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-router
volumes: volumes:
- name: config-volume - name: config-volume
configMap: configMap:
charts/fission-all/templates/router/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-router
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/storagesvc/clusterrole.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-storagesvc
rules:
- apiGroups:
- fission.io
resources:
- packages
verbs:
- get
- list
charts/fission-all/templates/storagesvc/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-storagesvc
subjects:
- kind: ServiceAccount
name: fission-storagesvc
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-storagesvc
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/storagesvc/deployment.yaml
+1 -1
View File
@@ -96,7 +96,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-storagesvc
{{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }} {{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }}
volumes: volumes:
- name: fission-storage - name: fission-storage
charts/fission-all/templates/storagesvc/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-storagesvc
namespace: {{ .Release.Namespace }}
charts/fission-all/templates/timer/clusterrole.yaml
+94
View File
@@ -0,0 +1,94 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-timer
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- namespaces
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- apps
resources:
- deployments
- deployments/scale
- replicasets
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
charts/fission-all/templates/timer/clusterrolebinding.yaml
+12
View File
@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-timer
subjects:
- kind: ServiceAccount
name: fission-timer
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-timer
apiGroup: rbac.authorization.k8s.io
charts/fission-all/templates/timer/deployment.yaml
+1 -1
View File
@@ -38,7 +38,7 @@ spec:
{{- if .Values.terminationMessagePolicy }} {{- if .Values.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }} terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }} {{- end }}
serviceAccountName: fission-svc serviceAccountName: fission-timer
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
charts/fission-all/templates/timer/serviceaccount.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-timer
namespace: {{ .Release.Namespace }}