Rbac resources per release for multiple installation on same cluster (#2302)

* Change RBAC resource names work for multiple Fission release
* Fetch secret configmap and package cluster role based on the release name
* Remove default namespace hardcoding from helm chart

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -46,6 +46,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        - name: HELM_RELEASE_NAME
+          value: {{ .Release.Name | quote }}
         {{- include "opentracing.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         {{- if .Values.terminationMessagePath }}

charts/fission-all/templates/common/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: fission-cr-admin
+  name: {{ .Release.Name }}-fission-cr-admin
 rules:
 - apiGroups:
   - ""

charts/fission-all/templates/common/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: fission-cr-admin
+  name: {{ .Release.Name }}-fission-cr-admin
 subjects:
   - kind: ServiceAccount
     name: fission-svc
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: fission-cr-admin
+  name: {{ .Release.Name }}-fission-cr-admin
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/deployment.yaml

@@ -54,6 +54,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        - name: HELM_RELEASE_NAME
+          value: {{ .Release.Name | quote }}
         {{- include "opentracing.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         readinessProbe:

charts/fission-all/templates/misc-functions/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: secret-configmap-getter
+  name: {{ .Release.Name }}-secret-configmap-getter
 rules:
   - apiGroups:
       - "*"
@@ -17,7 +17,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: package-getter
+  name: {{ .Release.Name }}-package-getter
 rules:
   - apiGroups:
       - "*"

charts/fission-all/templates/misc-functions/role.yaml

@@ -1,8 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: fission-fetcher
-  namespace: default
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .Values.defaultNamespace }}
 rules:
   - apiGroups:
       - ""
@@ -38,8 +38,8 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: fission-builder
-  namespace: default
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
 rules:
   - apiGroups:
       - fission.io
@@ -60,7 +60,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   namespace: {{ .Values.functionNamespace }}
-  name: event-fetcher
+  name: {{ .Release.Name }}-event-fetcher
 rules:
   - apiGroups: [""] # "" indicates the core API group
     resources: ["pods"]

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -1,12 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: fission-fetcher
-  namespace: default
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .Values.defaultNamespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: fission-fetcher
+  name: {{ .Release.Name }}-fission-fetcher
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher
@@ -16,12 +16,12 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: fission-builder
-  namespace: default
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: fission-builder
+  name: {{ .Release.Name }}-fission-builder
 subjects:
   - kind: ServiceAccount
     name: fission-builder
@@ -31,12 +31,12 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: fission-fetcher-pod-reader
+  name: {{ .Release.Name }}-fission-fetcher-pod-reader
   namespace: {{ .Values.functionNamespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: event-fetcher
+  name: {{ .Release.Name }}-event-fetcher
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher

charts/fission-all/values.yaml

@@ -68,6 +68,10 @@ functionNamespace: fission-function
 ##
 builderNamespace: fission-builder
 
+## defaultNamespace represents the default namespace in Kubernetes.
+##
+defaultNamespace: default
+
 ## createNamespace decides to create namespaces by the chart.
 ## If set to true, functionNamespace and builderNamespace namespaces mentioned above will be created by the chart.
 ## Set to false if you want to create the namespaces manually.