Add role required by fetcher pod to fetch events & pods in helm chart (#2048)

* Add role required by fetcher pod to fetch events & pods in helm chart

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Add prometheus repo in Github PR flow

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

.github/workflows/push_pr.yaml

@@ -52,7 +52,7 @@ jobs:
       run: ./hack/runtests.sh
     
     - name: Helm update
-      run: helm repo add helm https://charts.helm.sh/stable 
+      run: helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
       
     - name: Install Skaffold 
       run: |

charts/fission-all/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: prometheus
+  repository: https://prometheus-community.github.io/helm-charts
+  version: 13.2.1
+digest: sha256:136360a97bdc11f1933d75bab77728acc75dd9583257b973cb3336b6d136c9b6
+generated: "2021-05-27T18:51:04.509283+05:30"

charts/fission-all/templates/deployment.yaml

@@ -1112,3 +1112,31 @@ spec:
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}
 {{- end }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .Values.functionNamespace }}
+  name: event-fetcher
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["pods"]
+  verbs: ["get", "watch", "list"]
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["events"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fission-fetcher-pod-reader
+  namespace: {{ .Values.functionNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: event-fetcher
+subjects:
+- kind: ServiceAccount
+  name: fission-fetcher
+  namespace: {{ .Values.functionNamespace }}

charts/fission-core/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: prometheus
+  repository: https://prometheus-community.github.io/helm-charts
+  version: 13.2.1
+digest: sha256:136360a97bdc11f1933d75bab77728acc75dd9583257b973cb3336b6d136c9b6
+generated: "2021-05-31T21:04:26.076006+05:30"

charts/fission-core/templates/deployment.yaml

@@ -500,4 +500,32 @@ spec:
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}
-{{- end }}
+{{- end }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .Values.functionNamespace }}
+  name: event-fetcher
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["pods"]
+  verbs: ["get", "watch", "list"]
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["events"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fission-fetcher-pod-reader
+  namespace: {{ .Values.functionNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: event-fetcher
+subjects:
+- kind: ServiceAccount
+  name: fission-fetcher
+  namespace: {{ .Values.functionNamespace }}

fetcher-pod-sa.yaml

@@ -1,30 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: fission-function
-  name: event-fetcher
-rules:
-- apiGroups: [""] # "" indicates the core API group
-  resources: ["pods"]
-  verbs: ["get", "watch", "list"]
-- apiGroups: [""] # "" indicates the core API group
-  resources: ["events"]
-  verbs: ["*"]
-
---- 
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: fission-fetcher-pod-reader
-  namespace: fission-function
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: event-fetcher
-subjects:
-- kind: ServiceAccount
-  name: fission-fetcher
-  namespace: fission-function
---- 
-