diff --git a/charts/fission-all/templates/_fission-kubernetes-roles.tpl b/charts/fission-all/templates/_fission-kubernetes-roles.tpl index d946146d..818f18c6 100644 --- a/charts/fission-all/templates/_fission-kubernetes-roles.tpl +++ b/charts/fission-all/templates/_fission-kubernetes-roles.tpl @@ -12,6 +12,15 @@ rules: - list - watch - patch +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - get + - list + - watch - apiGroups: - apps resources: diff --git a/charts/fission-all/templates/buildermgr/role-fission-cr.yaml b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml index eacaa1ca..e595a3a3 100644 --- a/charts/fission-all/templates/buildermgr/role-fission-cr.yaml +++ b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml @@ -5,3 +5,9 @@ {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }} {{- end }} {{- end }} +{{- if .Values.builderNamespace -}} +{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }} +{{- end }} +{{- if .Values.functionNamespace -}} +{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }} +{{- end }} \ No newline at end of file diff --git a/charts/fission-all/templates/executor/role-fission-cr.yaml b/charts/fission-all/templates/executor/role-fission-cr.yaml index d434e275..346d7de7 100644 --- a/charts/fission-all/templates/executor/role-fission-cr.yaml +++ b/charts/fission-all/templates/executor/role-fission-cr.yaml @@ -5,3 +5,9 @@ {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }} {{- end }} {{- end }} +{{- if .Values.builderNamespace -}} +{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }} +{{- end }} +{{- if .Values.functionNamespace -}} +{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }} +{{- end }} \ No newline at end of file diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index 8f8b5e16..b40a5fee 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -63,8 +63,7 @@ routerPort: 31314 ## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user. ## This is different from the release namespace. -## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want -## more than one namespace to be used for Fission custom resources. +## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources. ## defaultNamespace: default diff --git a/pkg/utils/serviceaccount.go b/pkg/utils/serviceaccount.go index 19216309..124fdcf3 100644 --- a/pkg/utils/serviceaccount.go +++ b/pkg/utils/serviceaccount.go @@ -145,11 +145,17 @@ func setupSAAndRoleBindings(ctx context.Context, client kubernetes.Interface, lo for _, permission := range ps.permissions { permission.exists, err = checkPermission(ctx, client, SAObj, permission.gvr, permission.verb) if err != nil { - // some error occurred while checking permission - // now assume permission not exists and will add this permission in rules, insted of return - logger.Error("error while checking permission", zap.Error(err)) + // some error occurred while checking permission, log error as warning message and continue to create new permissions + logger.Info(err.Error()) } if !permission.exists { + logger.Info("creating new permission", + zap.String("service_account", SAObj.Name), + zap.String("namespace", SAObj.Namespace), + zap.String("group", permission.gvr.Group), + zap.String("resource", permission.gvr.Resource), + zap.String("verb", permission.verb)) + rules = append(rules, rbac.PolicyRule{ APIGroups: []string{permission.gvr.Group}, Resources: []string{permission.gvr.Resource},