Create roles for custom resource in function and builder namespace (#2695)

* create roles for custom resource in function and builder namespace
* Create roles for CR for builder in function and builder namespace
* convert warn to info to remove error stack trace

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -12,6 +12,15 @@ rules:
   - list
   - watch
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -5,3 +5,9 @@
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -5,3 +5,9 @@
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/values.yaml

@@ -63,8 +63,7 @@ routerPort: 31314
 
 ## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
-## more than one namespace to be used for Fission custom resources.
+## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources.
 ##
 defaultNamespace: default
 

pkg/utils/serviceaccount.go

@@ -145,11 +145,17 @@ func setupSAAndRoleBindings(ctx context.Context, client kubernetes.Interface, lo
 	for _, permission := range ps.permissions {
 		permission.exists, err = checkPermission(ctx, client, SAObj, permission.gvr, permission.verb)
 		if err != nil {
-			//  some error occurred while checking permission
-			//  now assume permission not exists and will add this permission in rules, insted of return
-			logger.Error("error while checking permission", zap.Error(err))
+			//  some error occurred while checking permission, log error as warning message and continue to create new permissions
+			logger.Info(err.Error())
 		}
 		if !permission.exists {
+			logger.Info("creating new permission",
+				zap.String("service_account", SAObj.Name),
+				zap.String("namespace", SAObj.Namespace),
+				zap.String("group", permission.gvr.Group),
+				zap.String("resource", permission.gvr.Resource),
+				zap.String("verb", permission.verb))
+
 			rules = append(rules, rbac.PolicyRule{
 				APIGroups: []string{permission.gvr.Group},
 				Resources: []string{permission.gvr.Resource},