Convert ClusterRoles to Roles for all components for multiple namespaces (#2584)

*  Convert ClusterRoles to Roles for all components for multiple namespaces
* Added templates for rules and role generator to dynamically generate roles for each component
*  Fix role-generator component templating
* Enable namespaces variable for preupgradechecks

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Runit Misra
2022-11-12 20:36:17 +05:30
committed by GitHub
co-authored by shaunak_deshmukh Sanket Sudake
parent 66897cb9d0
commit 31dfc3e4d3
23 changed files with 307 additions and 329 deletions
@@ -1,38 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-fission-cr-preupgrade
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-2"
rules:
- apiGroups:
- fission.io
resources:
- canaryconfigs
- environments
- functions
- httptriggers
- kuberneteswatchtriggers
- messagequeuetriggers
- packages
- timetriggers
verbs:
- list
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Name }}-fission-cr-preupgrade
annotations:
helm.sh/hook: pre-upgrade
helm.sh/hook-delete-policy: before-hook-creation
subjects:
- kind: ServiceAccount
name: fission-preupgrade
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-fission-cr-preupgrade
apiGroup: rbac.authorization.k8s.io
@@ -36,6 +36,8 @@ spec:
imagePullPolicy: {{ .Values.pullPolicy }}
command: [ "/pre-upgrade-checks" ]
args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
env:
{{- include "fission-resource-namespace.envs" . | indent 8 }}
{{- if .Values.terminationMessagePath }}
terminationMessagePath: {{ .Values.terminationMessagePath }}
{{- end }}
@@ -0,0 +1,7 @@
{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
{{- if not .Values.singleDefaultNamespace }}
{{- range $namespace := $.Values.additionalFissionNamespaces }}
{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
{{- end }}
{{- end }}