pre-upgrade job to verify function references and restricted privileges for fetcher and builder SA (#717)

It is mandatory (from this release onwards) for function to refer to secrets, config-maps and packages in its own namespace to ensure isolation of users sharing the same cluster.
This change runs a pre-upgrade job to verify function references for all functions created prior to this release and fails the upgrade by printing a list of functions that violate this restriction.

test/build_and_test.sh

@@ -26,11 +26,14 @@ TAG=test
 PRUNE_INTERVAL=1 # this variable controls the interval to run archivePruner. The unit is in minutes.
 ROUTER_SERVICE_TYPE=LoadBalancer
 SERVICE_TYPE=LoadBalancer
+PRE_UPGRADE_CHECK_IMAGE=$REPO/pre-upgrade-checks
 
 dump_system_info
 
 build_and_push_fission_bundle $IMAGE:$TAG
 
+build_and_push_pre_upgrade_check_image $PRE_UPGRADE_CHECK_IMAGE:$TAG
+
 build_and_push_fetcher $FETCHER_IMAGE:$TAG
 
 build_and_push_builder $BUILDER_IMAGE:$TAG
@@ -45,4 +48,4 @@ build_and_push_fluentd $FLUENTD_IMAGE:$TAG
 
 build_fission_cli
 
-install_and_test $IMAGE $TAG $FETCHER_IMAGE $TAG $FLUENTD_IMAGE $TAG $PRUNE_INTERVAL $ROUTER_SERVICE_TYPE $SERVICE_TYPE
+install_and_test $IMAGE $TAG $FETCHER_IMAGE $TAG $FLUENTD_IMAGE $TAG $PRUNE_INTERVAL $ROUTER_SERVICE_TYPE $SERVICE_TYPE $PRE_UPGRADE_CHECK_IMAGE

test/test_utils.sh

@@ -54,6 +54,19 @@ gcloud_login() {
     gcloud auth activate-service-account --key-file $KEY
 }
 
+build_and_push_pre_upgrade_check_image() {
+    image_tag=$1
+
+    pushd $ROOT/preupgradechecks
+    ./build.sh
+    docker build -q -t $image_tag .
+
+    gcloud_login
+
+    gcloud docker -- push $image_tag
+    popd
+}
+
 build_and_push_fission_bundle() {
     image_tag=$1
 
@@ -177,11 +190,12 @@ helm_install_fission() {
     pruneInterval="${10}"
     routerServiceType=${11}
     serviceType=${12}
+    preUpgradeCheckImage=${13}
 
     ns=f-$id
     fns=f-func-$id
 
-    helmVars=image=$image,imageTag=$imageTag,fetcherImage=$fetcherImage,fetcherImageTag=$fetcherImageTag,functionNamespace=$fns,controllerPort=$controllerNodeport,routerPort=$routerNodeport,pullPolicy=Always,analytics=false,logger.fluentdImage=$fluentdImage,logger.fluentdImageTag=$fluentdImageTag,pruneInterval=$pruneInterval,routerServiceType=$routerServiceType,serviceType=$serviceType
+    helmVars=image=$image,imageTag=$imageTag,fetcherImage=$fetcherImage,fetcherImageTag=$fetcherImageTag,functionNamespace=$fns,controllerPort=$controllerNodeport,routerPort=$routerNodeport,pullPolicy=Always,analytics=false,logger.fluentdImage=$fluentdImage,logger.fluentdImageTag=$fluentdImageTag,pruneInterval=$pruneInterval,routerServiceType=$routerServiceType,serviceType=$serviceType,preUpgradeChecksImage=$preUpgradeCheckImage
 
     timeout 30 bash -c "helm_setup"
 
@@ -484,6 +498,8 @@ install_and_test() {
     pruneInterval=$7
     routerServiceType=$8
     serviceType=$9
+    preUpgradeCheckImage=${10}
+
 
     controllerPort=31234
     routerPort=31235
@@ -492,7 +508,7 @@ install_and_test() {
     
     id=$(generate_test_id)
     trap "helm_uninstall_fission $id" EXIT
-    helm_install_fission $id $image $imageTag $fetcherImage $fetcherImageTag $controllerPort $routerPort $fluentdImage $fluentdImageTag $pruneInterval $routerServiceType $serviceType
+    helm_install_fission $id $image $imageTag $fetcherImage $fetcherImageTag $controllerPort $routerPort $fluentdImage $fluentdImageTag $pruneInterval $routerServiceType $serviceType $preUpgradeCheckImage
     helm status $id | grep STATUS | grep -i deployed
     if [ $? -ne 0 ]; then
         describe_all_pods $id