Convert ClusterRoles to Roles for all components for multiple namespaces (#2584)

*  Convert ClusterRoles to Roles for all components for multiple namespaces
* Added templates for rules and role generator to dynamically generate roles for each component
*  Fix role-generator component templating
* Enable namespaces variable for preupgradechecks

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>

charts/fission-all/templates/_fission-component-roles.tpl

@@ -0,0 +1,172 @@
+{{- define "buildermgr-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "controller-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "executor-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kubewatcher-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kafka-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "keda-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "preupgrade-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+{{- end }}
+{{- define "router-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "storagesvc-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "timer-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}

charts/fission-all/templates/_fission-role-generator.tpl

@@ -0,0 +1,63 @@
+{{- define "fission-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-rules" . }}
+{{- end }}
+{{- if eq "controller" .component }}
+{{- include "controller-rules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-rules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-rules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-rules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-rules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-rules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-rules" . }}
+{{- end }}
+{{- if eq "storagesvc" .component }}
+{{- include "storagesvc-rules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-rules" . }}
+{{- end }}
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml

@@ -1,32 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-buildermgr-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-buildermgr-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-buildermgr
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-buildermgr-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/controller/clusterrole-fission-cr.yaml

@@ -1,37 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-controller-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-controller-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-controller
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-controller-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/controller/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/executor/clusterrole-fission-cr.yaml

@@ -1,32 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-executor-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-executor-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-executor
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-executor-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kubewatcher-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - kuberneteswatchtriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kubewatcher-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-kubewatcher
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kubewatcher-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kafka-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - messagequeuetriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kafka-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-kafka
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kafka-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-keda-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - messagequeuetriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-keda-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-keda
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-keda-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-keda/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml

@@ -1,38 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fission-cr-preupgrade
-  annotations:
-    helm.sh/hook: pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: "-2"
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - list
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-fission-cr-preupgrade
-  annotations:
-    helm.sh/hook: pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation
-subjects:
-  - kind: ServiceAccount
-    name: fission-preupgrade
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-preupgrade
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml

@@ -36,6 +36,8 @@ spec:
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: [ "/pre-upgrade-checks" ]
         args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        env:
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}

charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/clusterrole-fission-cr.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-router-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - httptriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-router-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-router
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-router-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/router/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml

@@ -1,25 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-storagesvc-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - packages
-  verbs:
-  - get
-  - list
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-storagesvc-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-storagesvc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-storagesvc-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/storagesvc/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/timer/clusterrole-fission-cr.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-timer-fission-cr
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-timer-fission-cr
-subjects:
-  - kind: ServiceAccount
-    name: fission-timer
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-timer-fission-cr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/timer/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}