From 101cdd5b25817c0375b57d991a12b901173c78ca Mon Sep 17 00:00:00 2001 From: Runit Misra <32189847+runitmisra@users.noreply.github.com> Date: Mon, 17 Oct 2022 14:01:19 +0530 Subject: [PATCH] Extract out permissions for fission.io componenets per-component (#2570) * Extract out permissions for fission.io components per-component * PR review changes * Fix file names * Fix the filename for the router --- .../buildermgr/clusterrole-fission-cr.yaml | 32 ++++++++++++++++ .../templates/buildermgr/clusterrole.yaml | 16 +------- .../buildermgr/clusterrolebinding.yaml | 4 +- .../controller/clusterrole-fission-cr.yaml | 37 ++++++++++++++++++ .../templates/controller/clusterrole.yaml | 21 +--------- .../controller/clusterrolebinding.yaml | 4 +- .../executor/clusterrole-fission-cr.yaml | 32 ++++++++++++++++ .../templates/executor/clusterrole.yaml | 16 +------- .../executor/clusterrolebinding.yaml | 4 +- .../templates/fluentbit/clusterrole.yaml | 2 +- .../fluentbit/clusterrolebinding.yaml | 4 +- .../kubewatcher/clusterrole-fission-cr.yaml | 33 ++++++++++++++++ .../templates/kubewatcher/clusterrole.yaml | 17 +-------- .../kubewatcher/clusterrolebinding.yaml | 4 +- .../clusterrole-fission-cr.yaml | 33 ++++++++++++++++ .../mqt-fission-kafka/clusterrole.yaml | 17 +-------- .../mqt-fission-kafka/clusterrolebinding.yaml | 4 +- .../mqt-keda/clusterrole-fission-cr.yaml | 33 ++++++++++++++++ .../templates/mqt-keda/clusterrole.yaml | 17 +-------- .../mqt-keda/clusterrolebinding.yaml | 4 +- .../clusterrole-fission-cr.yaml | 38 +++++++++++++++++++ .../pre-upgrade-checks/clusterrole.yaml | 15 +------- .../clusterrolebinding.yaml | 4 +- .../router/clusterrole-fission-cr.yaml | 33 ++++++++++++++++ .../templates/router/clusterrole.yaml | 17 +-------- .../templates/router/clusterrolebinding.yaml | 4 +- .../storagesvc/clusterrole-fission-cr.yaml | 25 ++++++++++++ .../templates/storagesvc/clusterrole.yaml | 12 ------ .../storagesvc/clusterrolebinding.yaml | 12 ------ .../timer/clusterrole-fission-cr.yaml | 33 ++++++++++++++++ .../templates/timer/clusterrole.yaml | 17 +-------- .../templates/timer/clusterrolebinding.yaml | 4 +- 32 files changed, 359 insertions(+), 189 deletions(-) create mode 100644 charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/controller/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/executor/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/router/clusterrole-fission-cr.yaml create mode 100644 charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml delete mode 100644 charts/fission-all/templates/storagesvc/clusterrole.yaml delete mode 100644 charts/fission-all/templates/storagesvc/clusterrolebinding.yaml create mode 100644 charts/fission-all/templates/timer/clusterrole-fission-cr.yaml diff --git a/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml b/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..d747c5ef8 --- /dev/null +++ b/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-buildermgr-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-buildermgr-fission-cr +subjects: + - kind: ServiceAccount + name: fission-buildermgr + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-buildermgr-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/buildermgr/clusterrole.yaml b/charts/fission-all/templates/buildermgr/clusterrole.yaml index 11606aba1..b78efc666 100644 --- a/charts/fission-all/templates/buildermgr/clusterrole.yaml +++ b/charts/fission-all/templates/buildermgr/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr rules: - apiGroups: - "" @@ -33,20 +33,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml index 7bbb03710..07e353ec0 100644 --- a/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml +++ b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr subjects: - kind: ServiceAccount name: fission-buildermgr namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml b/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..eea089701 --- /dev/null +++ b/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml @@ -0,0 +1,37 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-controller-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-controller-fission-cr +subjects: + - kind: ServiceAccount + name: fission-controller + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-controller-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/clusterrole.yaml b/charts/fission-all/templates/controller/clusterrole.yaml index b005e10fb..6c13a5d6b 100644 --- a/charts/fission-all/templates/controller/clusterrole.yaml +++ b/charts/fission-all/templates/controller/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller rules: - apiGroups: - "" @@ -39,22 +39,3 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete diff --git a/charts/fission-all/templates/controller/clusterrolebinding.yaml b/charts/fission-all/templates/controller/clusterrolebinding.yaml index a0ae98e18..174312df1 100644 --- a/charts/fission-all/templates/controller/clusterrolebinding.yaml +++ b/charts/fission-all/templates/controller/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller subjects: - kind: ServiceAccount name: fission-controller namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml b/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..89293dc8d --- /dev/null +++ b/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-executor-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-executor-fission-cr +subjects: + - kind: ServiceAccount + name: fission-executor + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-executor-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/clusterrole.yaml b/charts/fission-all/templates/executor/clusterrole.yaml index 0ad0d3834..8782093e9 100644 --- a/charts/fission-all/templates/executor/clusterrole.yaml +++ b/charts/fission-all/templates/executor/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor rules: - apiGroups: - "" @@ -42,20 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - autoscaling resources: diff --git a/charts/fission-all/templates/executor/clusterrolebinding.yaml b/charts/fission-all/templates/executor/clusterrolebinding.yaml index a059df90b..c5a798745 100644 --- a/charts/fission-all/templates/executor/clusterrolebinding.yaml +++ b/charts/fission-all/templates/executor/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor subjects: - kind: ServiceAccount name: fission-executor namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/fluentbit/clusterrole.yaml b/charts/fission-all/templates/fluentbit/clusterrole.yaml index 1e314f669..c8eeadf90 100644 --- a/charts/fission-all/templates/fluentbit/clusterrole.yaml +++ b/charts/fission-all/templates/fluentbit/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit rules: - apiGroups: - "" diff --git a/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml index 272d6b4b6..5ce5495db 100644 --- a/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml +++ b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit subjects: - kind: ServiceAccount name: fission-fluentbit namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml b/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..ef7014c38 --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-kubewatcher-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - kuberneteswatchtriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-kubewatcher-fission-cr +subjects: + - kind: ServiceAccount + name: fission-kubewatcher + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-kubewatcher-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/clusterrole.yaml b/charts/fission-all/templates/kubewatcher/clusterrole.yaml index 0b2b0cb3b..1d18291f6 100644 --- a/charts/fission-all/templates/kubewatcher/clusterrole.yaml +++ b/charts/fission-all/templates/kubewatcher/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher rules: - apiGroups: - "" @@ -36,21 +36,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - kuberneteswatchtriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml index 16bd686b2..0831690a6 100644 --- a/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml +++ b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher subjects: - kind: ServiceAccount name: fission-kubewatcher namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..419672d0b --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-kafka-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-kafka-fission-cr +subjects: + - kind: ServiceAccount + name: fission-kafka + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-kafka-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml index 6c02b299d..f78b3e706 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka rules: - apiGroups: - "" @@ -42,21 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml index 2435861b5..7e6f175f9 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka subjects: - kind: ServiceAccount name: fission-kafka namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..caa808fce --- /dev/null +++ b/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-keda-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-keda-fission-cr +subjects: + - kind: ServiceAccount + name: fission-keda + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-keda-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/clusterrole.yaml b/charts/fission-all/templates/mqt-keda/clusterrole.yaml index abebfbc39..a99ce2f2b 100644 --- a/charts/fission-all/templates/mqt-keda/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda rules: - apiGroups: - "" @@ -42,21 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml index 86fe321b2..ff9f010bf 100644 --- a/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda subjects: - kind: ServiceAccount name: fission-keda namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..faf99bde2 --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-2" +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - list +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation +subjects: + - kind: ServiceAccount + name: fission-preupgrade + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-preupgrade + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml index 66f213c38..beb4e09ec 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation @@ -15,16 +15,3 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - list diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml index 17d0bb626..92b1fef07 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml @@ -1,7 +1,7 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation @@ -11,5 +11,5 @@ subjects: namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/clusterrole-fission-cr.yaml b/charts/fission-all/templates/router/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..5fdd822ac --- /dev/null +++ b/charts/fission-all/templates/router/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-router-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - httptriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-router-fission-cr +subjects: + - kind: ServiceAccount + name: fission-router + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-router-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/clusterrole.yaml b/charts/fission-all/templates/router/clusterrole.yaml index 1a9ee74ab..5a551c19e 100644 --- a/charts/fission-all/templates/router/clusterrole.yaml +++ b/charts/fission-all/templates/router/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router rules: - apiGroups: - "" @@ -40,21 +40,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - httptriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/router/clusterrolebinding.yaml b/charts/fission-all/templates/router/clusterrolebinding.yaml index bd053b04b..a455a71d9 100644 --- a/charts/fission-all/templates/router/clusterrolebinding.yaml +++ b/charts/fission-all/templates/router/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router subjects: - kind: ServiceAccount name: fission-router namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml b/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..bba0f56a3 --- /dev/null +++ b/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml @@ -0,0 +1,25 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-storagesvc-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - get + - list +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-storagesvc-fission-cr +subjects: + - kind: ServiceAccount + name: fission-storagesvc + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-storagesvc-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/clusterrole.yaml b/charts/fission-all/templates/storagesvc/clusterrole.yaml deleted file mode 100644 index 20b525aa9..000000000 --- a/charts/fission-all/templates/storagesvc/clusterrole.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-fission-cr-storagesvc -rules: -- apiGroups: - - fission.io - resources: - - packages - verbs: - - get - - list diff --git a/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml b/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml deleted file mode 100644 index 7ca3c9f7f..000000000 --- a/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-fission-cr-storagesvc -subjects: - - kind: ServiceAccount - name: fission-storagesvc - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-storagesvc - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml b/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml new file mode 100644 index 000000000..e2d89fe3b --- /dev/null +++ b/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-timer-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-timer-fission-cr +subjects: + - kind: ServiceAccount + name: fission-timer + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-timer-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/clusterrole.yaml b/charts/fission-all/templates/timer/clusterrole.yaml index cf6fdc304..b20e2c28a 100644 --- a/charts/fission-all/templates/timer/clusterrole.yaml +++ b/charts/fission-all/templates/timer/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer rules: - apiGroups: - "" @@ -20,21 +20,6 @@ rules: - list - watch - patch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/timer/clusterrolebinding.yaml b/charts/fission-all/templates/timer/clusterrolebinding.yaml index eefdf4335..f4f8acdb3 100644 --- a/charts/fission-all/templates/timer/clusterrolebinding.yaml +++ b/charts/fission-all/templates/timer/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer subjects: - kind: ServiceAccount name: fission-timer namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer apiGroup: rbac.authorization.k8s.io