From 5db09a899adc578078be944a006375b20bb1a417 Mon Sep 17 00:00:00 2001
From: Shubham Bansal <62992590+shubham-bansal96@users.noreply.github.com>
Date: Tue, 17 Jan 2023 22:15:04 +0530
Subject: [PATCH] Create roles for custom resource in function and builder
 namespace (#2695)

* create roles for custom resource in function and builder namespace
* Create roles for CR for builder in function and builder namespace
* convert warn to info to remove error stack trace
---
 .../templates/_fission-kubernetes-roles.tpl          |  9 +++++++++
 .../templates/buildermgr/role-fission-cr.yaml        |  6 ++++++
 .../templates/executor/role-fission-cr.yaml          |  6 ++++++
 charts/fission-all/values.yaml                       |  3 +--
 pkg/utils/serviceaccount.go                          | 12 +++++++++---
 5 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/charts/fission-all/templates/_fission-kubernetes-roles.tpl b/charts/fission-all/templates/_fission-kubernetes-roles.tpl
index d946146d..818f18c6 100644
--- a/charts/fission-all/templates/_fission-kubernetes-roles.tpl
+++ b/charts/fission-all/templates/_fission-kubernetes-roles.tpl
@@ -12,6 +12,15 @@ rules:
   - list
   - watch
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
diff --git a/charts/fission-all/templates/buildermgr/role-fission-cr.yaml b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml
index eacaa1ca..e595a3a3 100644
--- a/charts/fission-all/templates/buildermgr/role-fission-cr.yaml
+++ b/charts/fission-all/templates/buildermgr/role-fission-cr.yaml
@@ -5,3 +5,9 @@
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/fission-all/templates/executor/role-fission-cr.yaml b/charts/fission-all/templates/executor/role-fission-cr.yaml
index d434e275..346d7de7 100644
--- a/charts/fission-all/templates/executor/role-fission-cr.yaml
+++ b/charts/fission-all/templates/executor/role-fission-cr.yaml
@@ -5,3 +5,9 @@
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml
index 8f8b5e16..b40a5fee 100644
--- a/charts/fission-all/values.yaml
+++ b/charts/fission-all/values.yaml
@@ -63,8 +63,7 @@ routerPort: 31314
 
 ## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
-## more than one namespace to be used for Fission custom resources.
+## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources.
 ##
 defaultNamespace: default
 
diff --git a/pkg/utils/serviceaccount.go b/pkg/utils/serviceaccount.go
index 19216309..124fdcf3 100644
--- a/pkg/utils/serviceaccount.go
+++ b/pkg/utils/serviceaccount.go
@@ -145,11 +145,17 @@ func setupSAAndRoleBindings(ctx context.Context, client kubernetes.Interface, lo
 	for _, permission := range ps.permissions {
 		permission.exists, err = checkPermission(ctx, client, SAObj, permission.gvr, permission.verb)
 		if err != nil {
-			//  some error occurred while checking permission
-			//  now assume permission not exists and will add this permission in rules, insted of return
-			logger.Error("error while checking permission", zap.Error(err))
+			//  some error occurred while checking permission, log error as warning message and continue to create new permissions
+			logger.Info(err.Error())
 		}
 		if !permission.exists {
+			logger.Info("creating new permission",
+				zap.String("service_account", SAObj.Name),
+				zap.String("namespace", SAObj.Namespace),
+				zap.String("group", permission.gvr.Group),
+				zap.String("resource", permission.gvr.Resource),
+				zap.String("verb", permission.verb))
+
 			rules = append(rules, rbac.PolicyRule{
 				APIGroups: []string{permission.gvr.Group},
 				Resources: []string{permission.gvr.Resource},