Create role/role binding/service account required for builder/function pods (#2667)

* service account changes for fission-builder * moved code into executor * changed default timing to 30 min * code refactor and add new roles for executor * create role if serviceAccountCheck is enabled
2022-12-14 09:06:20 +05:30
parent 5fae765323
commit 16cbb87eab
5 changed files with 343 additions and 0 deletions
@@ -117,6 +117,28 @@ rules:
  - get
  - list
  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
 - apiGroups:
  - apps
  resources: