diff --git a/charts/fission-all/templates/_fission-component-roles.tpl b/charts/fission-all/templates/_fission-component-roles.tpl new file mode 100644 index 00000000..bacb9fa7 --- /dev/null +++ b/charts/fission-all/templates/_fission-component-roles.tpl @@ -0,0 +1,172 @@ +{{- define "buildermgr-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "controller-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "executor-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "kubewatcher-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - kuberneteswatchtriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "kafka-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "keda-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "preupgrade-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - list +{{- end }} +{{- define "router-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - httptriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} +{{- define "storagesvc-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - get + - list +{{- end }} +{{- define "timer-rules" }} +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +{{- end }} \ No newline at end of file diff --git a/charts/fission-all/templates/_fission-role-generator.tpl b/charts/fission-all/templates/_fission-role-generator.tpl new file mode 100644 index 00000000..12664b24 --- /dev/null +++ b/charts/fission-all/templates/_fission-role-generator.tpl @@ -0,0 +1,63 @@ +{{- define "fission-role-generator" }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: +{{- if eq "preupgrade" .component }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-2" +{{- end }} + name: "{{ .Release.Name }}-{{ .component }}-fission-cr" + namespace: {{ .namespace }} +{{- if eq "buildermgr" .component }} +{{- include "buildermgr-rules" . }} +{{- end }} +{{- if eq "controller" .component }} +{{- include "controller-rules" . }} +{{- end }} +{{- if eq "executor" .component }} +{{- include "executor-rules" . }} +{{- end }} +{{- if eq "kubewatcher" .component }} +{{- include "kubewatcher-rules" . }} +{{- end }} +{{- if eq "kafka" .component }} +{{- include "kafka-rules" . }} +{{- end }} +{{- if eq "keda" .component }} +{{- include "keda-rules" . }} +{{- end }} +{{- if eq "preupgrade" .component }} +{{- include "preupgrade-rules" . }} +{{- end }} +{{- if eq "router" .component }} +{{- include "router-rules" . }} +{{- end }} +{{- if eq "storagesvc" .component }} +{{- include "storagesvc-rules" . }} +{{- end }} +{{- if eq "timer" .component }} +{{- include "timer-rules" . }} +{{- end }} +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: +{{- if eq "preupgrade" .component }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation +{{- end }} + name: "{{ .Release.Name }}-{{ .component }}-fission-cr" + namespace: {{ .namespace }} +subjects: + - kind: ServiceAccount + name: "fission-{{ .component }}" + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: "{{ .Release.Name }}-{{ .component }}-fission-cr" + apiGroup: rbac.authorization.k8s.io +{{- end }} \ No newline at end of file diff --git a/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml b/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml deleted file mode 100644 index d747c5ef..00000000 --- a/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-buildermgr-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-buildermgr-fission-cr -subjects: - - kind: ServiceAccount - name: fission-buildermgr - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-buildermgr-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/buildermgr/role-fission-cr.yaml b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml new file mode 100644 index 00000000..814ae691 --- /dev/null +++ b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml b/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml deleted file mode 100644 index eea08970..00000000 --- a/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-controller-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-controller-fission-cr -subjects: - - kind: ServiceAccount - name: fission-controller - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-controller-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/role-fission-cr.yaml b/charts/fission-all/templates/controller/role-fission-cr.yaml new file mode 100644 index 00000000..d87dd1a0 --- /dev/null +++ b/charts/fission-all/templates/controller/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml b/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml deleted file mode 100644 index 89293dc8..00000000 --- a/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-executor-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-executor-fission-cr -subjects: - - kind: ServiceAccount - name: fission-executor - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-executor-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/role-fission-cr.yaml b/charts/fission-all/templates/executor/role-fission-cr.yaml new file mode 100644 index 00000000..8070b591 --- /dev/null +++ b/charts/fission-all/templates/executor/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml b/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml deleted file mode 100644 index ef7014c3..00000000 --- a/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-kubewatcher-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - kuberneteswatchtriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-kubewatcher-fission-cr -subjects: - - kind: ServiceAccount - name: fission-kubewatcher - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-kubewatcher-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/role-fission-cr.yaml b/charts/fission-all/templates/kubewatcher/role-fission-cr.yaml new file mode 100644 index 00000000..202a7167 --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml deleted file mode 100644 index 419672d0..00000000 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-kafka-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-kafka-fission-cr -subjects: - - kind: ServiceAccount - name: fission-kafka - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-kafka-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml b/charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml new file mode 100644 index 00000000..d74acec8 --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml deleted file mode 100644 index caa808fc..00000000 --- a/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-keda-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-keda-fission-cr -subjects: - - kind: ServiceAccount - name: fission-keda - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-keda-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/role-fission-cr.yaml b/charts/fission-all/templates/mqt-keda/role-fission-cr.yaml new file mode 100644 index 00000000..b7eec7d9 --- /dev/null +++ b/charts/fission-all/templates/mqt-keda/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml deleted file mode 100644 index faf99bde..00000000 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade - annotations: - helm.sh/hook: pre-upgrade - helm.sh/hook-delete-policy: before-hook-creation - helm.sh/hook-weight: "-2" -rules: -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - list ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade - annotations: - helm.sh/hook: pre-upgrade - helm.sh/hook-delete-policy: before-hook-creation -subjects: - - kind: ServiceAccount - name: fission-preupgrade - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-preupgrade - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml b/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml index 78f829e0..350f6419 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml @@ -36,6 +36,8 @@ spec: imagePullPolicy: {{ .Values.pullPolicy }} command: [ "/pre-upgrade-checks" ] args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"] + env: + {{- include "fission-resource-namespace.envs" . | indent 8 }} {{- if .Values.terminationMessagePath }} terminationMessagePath: {{ .Values.terminationMessagePath }} {{- end }} diff --git a/charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml b/charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml new file mode 100644 index 00000000..d6393b8c --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/router/clusterrole-fission-cr.yaml b/charts/fission-all/templates/router/clusterrole-fission-cr.yaml deleted file mode 100644 index 5fdd822a..00000000 --- a/charts/fission-all/templates/router/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-router-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - httptriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-router-fission-cr -subjects: - - kind: ServiceAccount - name: fission-router - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-router-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/role-fission-cr.yaml b/charts/fission-all/templates/router/role-fission-cr.yaml new file mode 100644 index 00000000..35b40707 --- /dev/null +++ b/charts/fission-all/templates/router/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml b/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml deleted file mode 100644 index bba0f56a..00000000 --- a/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-storagesvc-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - packages - verbs: - - get - - list ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-storagesvc-fission-cr -subjects: - - kind: ServiceAccount - name: fission-storagesvc - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-storagesvc-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/role-fission-cr.yaml b/charts/fission-all/templates/storagesvc/role-fission-cr.yaml new file mode 100644 index 00000000..3f2ff4f8 --- /dev/null +++ b/charts/fission-all/templates/storagesvc/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml b/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml deleted file mode 100644 index e2d89fe3..00000000 --- a/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-timer-fission-cr -rules: -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-timer-fission-cr -subjects: - - kind: ServiceAccount - name: fission-timer - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-timer-fission-cr - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/role-fission-cr.yaml b/charts/fission-all/templates/timer/role-fission-cr.yaml new file mode 100644 index 00000000..3bf05adc --- /dev/null +++ b/charts/fission-all/templates/timer/role-fission-cr.yaml @@ -0,0 +1,7 @@ +{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }} +{{- end }} +{{- end }}