Fixed: Allow to disable owner references for cross namespace access with builder and function namespace (#3024)

* Add DISABLE_OWNER_REFERENCES env variable to executor and buildermgr deployment.
Use this env var to decide adding ownerReferences to K8s resources created by fission CRD.
* Resolve review comments
* Fix lint failure

---------

Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -51,6 +51,8 @@ spec:
           value: {{ .Values.fetcher.resource.mem.limits | quote }}
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
         - name: HELM_RELEASE_NAME

charts/fission-all/templates/executor/deployment.yaml

@@ -76,6 +76,8 @@ spec:
           value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
         - name: SERVICEACCOUNT_CHECK_INTERVAL
           value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
         {{- end}}  
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
         {{- include "kube_client.envs" . | indent 8 }}

charts/fission-all/values.yaml

@@ -88,6 +88,13 @@ additionalFissionNamespaces: []
 ##
 createNamespace: true
 
+## disableOwnerReference decides to set OwnerReference to K8s resources like deployment, services, hpa etc. created by Fission.
+## If set to true, the K8s resources created by Fission will not have OwnerReference set.
+## Set to false if you want to add OwnerReference to K8s resources created by Fission.
+##
+## Set to true if you are using cross namespace meaning `builderNamespace` and `functionNamespace` are set.
+disableOwnerReference: false
+
 ## enableIstio indicates whether to enable istio integration.
 ##
 enableIstio: false

pkg/buildermgr/envwatcher.go

@@ -74,6 +74,7 @@ type (
 		useIstio               bool
 		podSpecPatch           *apiv1.PodSpec
 		envWatchInformer       map[string]k8sCache.SharedIndexInformer
+		enableOwnerReferences  bool
 	}
 )
 
@@ -108,6 +109,7 @@ func makeEnvironmentWatcher(
 		fetcherConfig:          fetcherConfig,
 		podSpecPatch:           podSpecPatch,
 		envWatchInformer:       utils.GetInformersForNamespaces(fissionClient, time.Minute*30, fv1.EnvironmentResource),
+		enableOwnerReferences:  utils.IsOwnerReferencesEnabled(),
 	}
 
 	err := envWatcher.EnvWatchEventHandlers(ctx)
@@ -325,18 +327,22 @@ func (envw *environmentWatcher) getBuilderServiceList(ctx context.Context, sel m
 func (envw *environmentWatcher) createBuilderService(ctx context.Context, env *fv1.Environment, ns string) (*apiv1.Service, error) {
 	name := fmt.Sprintf("%v-%v", env.ObjectMeta.Name, env.ObjectMeta.ResourceVersion)
 	sel := envw.getLabels(env.ObjectMeta.Name, ns, env.ObjectMeta.ResourceVersion)
+	var ownerReferences []metav1.OwnerReference
+	if envw.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(env, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Environment",
+			}),
+		}
+	}
 	service := apiv1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Namespace: ns,
+			Namespace:       ns,
-			Name:      name,
+			Name:            name,
-			Labels:    sel,
+			Labels:          sel,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(env, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Environment",
-				}),
-			},
 		},
 		Spec: apiv1.ServiceSpec{
 			Selector: sel,
@@ -443,18 +449,23 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
 
 	pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
 
+	var ownerReferences []metav1.OwnerReference
+	if envw.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(env, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Environment",
+			}),
+		}
+	}
+
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Namespace: ns,
+			Namespace:       ns,
-			Name:      name,
+			Name:            name,
-			Labels:    sel,
+			Labels:          sel,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(env, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Environment",
-				}),
-			},
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: &replicas,

pkg/executor/executortype/container/containermgr.go

@@ -88,6 +88,8 @@ type (
 
 		hpaops                     *hpautils.HpaOperations
 		objectReaperIntervalSecond time.Duration
+
+		enableOwnerReferences bool
 	}
 )
 
@@ -131,6 +133,8 @@ func MakeContainer(
 		deplListerSynced:           make(map[string]k8sCache.InformerSynced),
 		svcLister:                  make(map[string]corelisters.ServiceLister),
 		svcListerSynced:            make(map[string]k8sCache.InformerSynced),
+
+		enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
 	}
 
 	for ns, informerFactory := range cnmInformerFactory {

pkg/executor/executortype/container/deployment.go

@@ -265,18 +265,22 @@ func (cn *Container) getDeploymentSpec(ctx context.Context, fn *fv1.Function, ta
 
 	pod.Spec = *(util.ApplyImagePullSecret("", pod.Spec))
 
+	var ownerReferences []metav1.OwnerReference
+	if cn.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        deployName,
+			Name:            deployName,
-			Labels:      deployLabels,
+			Labels:          deployLabels,
-			Annotations: deployAnnotations,
+			Annotations:     deployAnnotations,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(fn, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Function",
-				}),
-			},
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: &replicas,

pkg/executor/executortype/container/svc.go

@@ -50,18 +50,23 @@ func (cn *Container) createOrGetSvc(ctx context.Context, fn *fv1.Function, deplo
 		return nil, err
 	}
 	logger := otelUtils.LoggerWithTraceID(ctx, cn.logger)
+	var ownerReferences []metav1.OwnerReference
+	if cn.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
+
 	service := &apiv1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        svcName,
+			Name:            svcName,
-			Labels:      deployLabels,
+			Labels:          deployLabels,
-			Annotations: deployAnnotations,
+			Annotations:     deployAnnotations,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(fn, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Function",
-				}),
-			},
 		},
 		Spec: apiv1.ServiceSpec{
 			Ports: []apiv1.ServicePort{

pkg/executor/executortype/newdeploy/newdeploy.go

@@ -246,18 +246,23 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
 
 	pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
 
+	var ownerReferences []metav1.OwnerReference
+	if deploy.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
+
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        deployName,
+			Name:            deployName,
-			Labels:      deployLabels,
+			Labels:          deployLabels,
-			Annotations: deployAnnotations,
+			Annotations:     deployAnnotations,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(fn, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Function",
-				}),
-			},
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: &replicas,
@@ -334,18 +339,23 @@ func (deploy *NewDeploy) getResources(env *fv1.Environment, fn *fv1.Function) ap
 
 func (deploy *NewDeploy) createOrGetSvc(ctx context.Context, fn *fv1.Function, deployLabels map[string]string, deployAnnotations map[string]string, svcName string, svcNamespace string) (*apiv1.Service, error) {
 	logger := otelUtils.LoggerWithTraceID(ctx, deploy.logger)
+	var ownerReferences []metav1.OwnerReference
+	if deploy.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
+
 	service := &apiv1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        svcName,
+			Name:            svcName,
-			Labels:      deployLabels,
+			Labels:          deployLabels,
-			Annotations: deployAnnotations,
+			Annotations:     deployAnnotations,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(fn, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Function",
-				}),
-			},
 		},
 		Spec: apiv1.ServiceSpec{
 			Ports: []apiv1.ServicePort{

pkg/executor/executortype/newdeploy/newdeploymgr.go

@@ -92,6 +92,8 @@ type (
 
 		podSpecPatch               *apiv1.PodSpec
 		objectReaperIntervalSecond time.Duration
+
+		enableOwnerReferences bool
 	}
 )
 
@@ -139,6 +141,8 @@ func MakeNewDeploy(
 		deplListerSynced: make(map[string]k8sCache.InformerSynced),
 		svcLister:        make(map[string]corelisters.ServiceLister),
 		svcListerSynced:  make(map[string]k8sCache.InformerSynced),
+
+		enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
 	}
 
 	for ns, informerFactory := range ndmInformerFactory {

pkg/executor/executortype/poolmgr/gp.go

@@ -79,6 +79,7 @@ type (
 		poolInstanceID           string // small random string to uniquify pod names
 		instanceID               string // poolmgr instance id
 		podSpecPatch             *apiv1.PodSpec
+		enableOwnerReferences    bool
 		// TODO: move this field into fsCache
 		podFSVCMap sync.Map
 	}
@@ -131,6 +132,7 @@ func MakeGenericPool(
 		instanceID:               instanceID,
 		podFSVCMap:               sync.Map{},
 		podSpecPatch:             podSpecPatch,
+		enableOwnerReferences:    utils.IsOwnerReferencesEnabled(),
 		lock:                     sync.Mutex{},
 	}
 

pkg/executor/executortype/poolmgr/gp_deployment.go

@@ -59,17 +59,22 @@ func getPoolName(env *fv1.Environment) string {
 func (gp *GenericPool) genDeploymentMeta(env *fv1.Environment) metav1.ObjectMeta {
 	deployLabels := gp.getEnvironmentPoolLabels(env)
 	deployAnnotations := gp.getDeployAnnotations(env)
-	return metav1.ObjectMeta{
+
-		Name:        getPoolName(env),
+	var ownerReferences []metav1.OwnerReference
-		Labels:      deployLabels,
+	if gp.enableOwnerReferences {
-		Annotations: deployAnnotations,
+		ownerReferences = []metav1.OwnerReference{
-		OwnerReferences: []metav1.OwnerReference{
 			*metav1.NewControllerRef(env, schema.GroupVersionKind{
 				Group:   "fission.io",
 				Version: "v1",
 				Kind:    "Environment",
 			}),
-		},
+		}
+	}
+	return metav1.ObjectMeta{
+		Name:            getPoolName(env),
+		Labels:          deployLabels,
+		Annotations:     deployAnnotations,
+		OwnerReferences: ownerReferences,
 	}
 }
 

pkg/executor/util/hpa/hpa.go

@@ -29,6 +29,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
+	"github.com/fission/fission/pkg/utils"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
 
@@ -39,16 +40,18 @@ const (
 )
 
 type HpaOperations struct {
-	logger           *zap.Logger
+	logger                *zap.Logger
-	kubernetesClient kubernetes.Interface
+	kubernetesClient      kubernetes.Interface
-	instanceID       string
+	instanceID            string
+	enableOwnerReferences bool
 }
 
 func NewHpaOperations(logger *zap.Logger, kubernetesClient kubernetes.Interface, instanceID string) *HpaOperations {
 	return &HpaOperations{
-		logger:           logger,
+		logger:                logger,
-		kubernetesClient: kubernetesClient,
+		kubernetesClient:      kubernetesClient,
-		instanceID:       instanceID,
+		instanceID:            instanceID,
+		enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
 	}
 }
 
@@ -99,18 +102,23 @@ func (hpaops *HpaOperations) CreateOrGetHpa(ctx context.Context, fn *fv1.Functio
 		hpaMetrics = append(hpaMetrics, execStrategy.Metrics...)
 	}
 
+	var ownerReferences []metav1.OwnerReference
+	if hpaops.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
+
 	hpa := &asv2.HorizontalPodAutoscaler{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        hpaName,
+			Name:            hpaName,
-			Labels:      deployLabels,
+			Labels:          deployLabels,
-			Annotations: deployAnnotations,
+			Annotations:     deployAnnotations,
-			OwnerReferences: []metav1.OwnerReference{
+			OwnerReferences: ownerReferences,
-				*metav1.NewControllerRef(fn, schema.GroupVersionKind{
-					Group:   "fission.io",
-					Version: "v1",
-					Kind:    "Function",
-				}),
-			},
 		},
 		Spec: asv2.HorizontalPodAutoscalerSpec{
 			ScaleTargetRef: getScaleTargetRef(depl),

pkg/utils/utils.go

@@ -39,6 +39,10 @@ import (
 	"github.com/fission/fission/pkg/utils/uuid"
 )
 
+const (
+	ENV_DISABLE_OWNER_REFERENCES string = "DISABLE_OWNER_REFERENCES"
+)
+
 func UrlForFunction(name, namespace string) string {
 	prefix := "/fission-function"
 	if namespace != metav1.NamespaceDefault {
@@ -296,3 +300,8 @@ func DeleteOldPackages(pkgPath, pkgType string) error {
 
 	return nil
 }
+
+func IsOwnerReferencesEnabled() bool {
+	disableOwnerReference, _ := strconv.ParseBool(os.Getenv(ENV_DISABLE_OWNER_REFERENCES))
+	return !disableOwnerReference
+}