Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Convert ClusterRoles to Roles for all components for multiple namespaces (#2584)

Browse Source 
*  Convert ClusterRoles to Roles for all components for multiple namespaces
* Added templates for rules and role generator to dynamically generate roles for each component
*  Fix role-generator component templating
* Enable namespaces variable for preupgradechecks

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Runit Misra
2022-11-12 20:36:17 +05:30
committed by GitHub
co-authored by shaunak_deshmukh Sanket Sudake
parent 66897cb9d0
commit 31dfc3e4d3
23 changed files with 307 additions and 329 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/fission-all/templates/_fission-role-generator.tpl
+63
View File
@@ -0,0 +1,63 @@
{{- define "fission-role-generator" }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
{{- if eq "preupgrade" .component }}
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-2"
{{- end }}
name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
namespace: {{ .namespace }}
{{- if eq "buildermgr" .component }}
{{- include "buildermgr-rules" . }}
{{- end }}
{{- if eq "controller" .component }}
{{- include "controller-rules" . }}
{{- end }}
{{- if eq "executor" .component }}
{{- include "executor-rules" . }}
{{- end }}
{{- if eq "kubewatcher" .component }}
{{- include "kubewatcher-rules" . }}
{{- end }}
{{- if eq "kafka" .component }}
{{- include "kafka-rules" . }}
{{- end }}
{{- if eq "keda" .component }}
{{- include "keda-rules" . }}
{{- end }}
{{- if eq "preupgrade" .component }}
{{- include "preupgrade-rules" . }}
{{- end }}
{{- if eq "router" .component }}
{{- include "router-rules" . }}
{{- end }}
{{- if eq "storagesvc" .component }}
{{- include "storagesvc-rules" . }}
{{- end }}
{{- if eq "timer" .component }}
{{- include "timer-rules" . }}
{{- end }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
{{- if eq "preupgrade" .component }}
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
{{- end }}
name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
namespace: {{ .namespace }}
subjects:
- kind: ServiceAccount
name: "fission-{{ .component }}"
namespace: {{ .Release.Namespace }}
roleRef:
kind: Role
name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
apiGroup: rbac.authorization.k8s.io
{{- end }}