From 178cdd42b7bdf3b8ebd59032aa6db35fcf30245a Mon Sep 17 00:00:00 2001
From: Sanket Sudake <sanketsudake@gmail.com>
Date: Fri, 22 Oct 2021 09:54:44 +0530
Subject: [PATCH] Remove admin role from fission-svc service account (#2233)

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
---
 .../templates/common/clusterrole.yaml         | 27 ++++++++++++++-----
 .../templates/common/rolebinding.yaml         | 13 ---------
 2 files changed, 21 insertions(+), 19 deletions(-)
 delete mode 100644 charts/fission-all/templates/common/rolebinding.yaml

diff --git a/charts/fission-all/templates/common/clusterrole.yaml b/charts/fission-all/templates/common/clusterrole.yaml
index c2105c96..50665467 100644
--- a/charts/fission-all/templates/common/clusterrole.yaml
+++ b/charts/fission-all/templates/common/clusterrole.yaml
@@ -11,6 +11,7 @@ rules:
   - secrets
   - services
   - serviceaccounts
+  - replicationcontrollers
   - namespaces
   - events
   verbs:
@@ -28,17 +29,28 @@ rules:
   - replicasets
   verbs:
   - '*'
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - '*'
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
-  - create
-  - delete
   - get
   - list
   - watch
-  - patch
 - apiGroups:
   - fission.io
   resources:
@@ -64,9 +76,12 @@ rules:
   - rolebindings
   verbs:
   - '*'
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["clusterroles"]
-  verbs: ["bind"]
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
 - apiGroups:
   - keda.sh
   resources:
diff --git a/charts/fission-all/templates/common/rolebinding.yaml b/charts/fission-all/templates/common/rolebinding.yaml
deleted file mode 100644
index ae634847..00000000
--- a/charts/fission-all/templates/common/rolebinding.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: fission-admin
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: fission-svc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: admin
-  apiGroup: rbac.authorization.k8s.io