From 604cc2cae0a16e49152911751bedf188121befdd Mon Sep 17 00:00:00 2001 From: Soam Vasani Date: Wed, 9 Aug 2017 23:52:13 -0700 Subject: [PATCH] Helm chart updates (#273) Remove hardcoded "fission" namespace in various places. Remove etcd deployment and service, since we use K8s APIs now. Add ClusterRoleBinding for the fission service account, to allow fission components to access TPRs. We currently make the service account a cluster admin. This is more permissive than it should be; we should define a specific role for just fission resources. --- charts/fission-all/templates/deployment.yaml | 101 +++++++++++------- charts/fission-all/templates/svc.yaml | 3 +- charts/fission-all/values.yaml | 6 +- charts/fission-core/templates/deployment.yaml | 80 +++++++------- 4 files changed, 108 insertions(+), 82 deletions(-) diff --git a/charts/fission-all/templates/deployment.yaml b/charts/fission-all/templates/deployment.yaml index d96fa4f7e..f2bbd01ea 100644 --- a/charts/fission-all/templates/deployment.yaml +++ b/charts/fission-all/templates/deployment.yaml @@ -14,7 +14,7 @@ metadata: apiVersion: v1 kind: ProjectRequest metadata: - name: fission-function + name: {{ .Values.functionNamespace }} labels: name: fission-function @@ -23,7 +23,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} --- apiVersion: v1 @@ -58,13 +58,13 @@ groupNames: null kind: RoleBinding metadata: name: fission:fission-admin - namespace: fission-function + namespace: {{ .Values.functionNamespace }} roleRef: name: fission:fission-admin subjects: - kind: ServiceAccount name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} userNames: - system:serviceaccount:fission:fission-admin @@ -85,19 +85,19 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole name: admin @@ -108,16 +108,30 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: fission-function-admin - namespace: fission-function + namespace: {{ .Values.functionNamespace }} subjects: - kind: ServiceAccount - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole name: admin apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fission-tpr +subjects: +- kind: ServiceAccount + name: fission-svc + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + {{ end }} --- @@ -138,7 +152,8 @@ spec: - name: controller image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] - args: ["--controllerPort", "8888", "--filepath", "/filestore"] + args: ["--controllerPort", "8888"] + serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 @@ -159,6 +174,7 @@ spec: image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] args: ["--routerPort", "8888"] + serviceAccount: fission-svc --- apiVersion: v1 @@ -194,8 +210,8 @@ spec: - name: poolmgr image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] - args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}"] - serviceAccount: fission-admin + args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}", "--fission-namespace", "{{ .Release.Namespace }}"] + serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 @@ -216,7 +232,7 @@ spec: image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] args: ["--kubewatcher"] - serviceAccount: fission-admin + serviceAccount: fission-svc --- apiVersion: v1 @@ -367,7 +383,7 @@ spec: - name: fission-log mountPath: /var/log/fission readOnly: false - serviceAccount: fission-admin + serviceAccount: fission-svc volumes: - name: container-log hostPath: @@ -398,28 +414,34 @@ spec: image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] args: ["--timer"] + serviceAccount: fission-svc ---- -apiVersion: extensions/v1beta1 -kind: Deployment -metadata: - name: fission-ui - labels: - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" -spec: - replicas: 1 - template: - metadata: - labels: - svc: fission-ui - spec: - containers: - - name: nginx - image: {{ .Values.fissionUiImage }} - - name: kubectl-proxy - image: lachlanevenson/k8s-kubectl - args: ["proxy", "--port", "8001", "--address", "127.0.0.1"] - serviceAccount: fission-admin +# +# This is commented out until fission-ui allows configuring the +# namespace. Right now it just crashes if Release.Namespace != +# "fission". +# +#--- +#apiVersion: extensions/v1beta1 +#kind: Deployment +#metadata: +# name: fission-ui +# labels: +# chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" +#spec: +# replicas: 1 +# template: +# metadata: +# labels: +# svc: fission-ui +# spec: +# containers: +# - name: nginx +# image: {{ .Values.fissionUiImage }} +# - name: kubectl-proxy +# image: lachlanevenson/k8s-kubectl +# args: ["proxy", "--port", "8001", "--address", "127.0.0.1"] +# serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 @@ -467,4 +489,5 @@ spec: - name: MESSAGE_QUEUE_TYPE value: nats-streaming - name: MESSAGE_QUEUE_URL - value: nats://{{ .Values.nats.authToken }}@nats-streaming:4222 \ No newline at end of file + value: nats://{{ .Values.nats.authToken }}@nats-streaming:4222 + serviceAccount: fission-svc diff --git a/charts/fission-all/templates/svc.yaml b/charts/fission-all/templates/svc.yaml index 437b9f364..5f633c9b8 100644 --- a/charts/fission-all/templates/svc.yaml +++ b/charts/fission-all/templates/svc.yaml @@ -63,4 +63,5 @@ spec: targetPort: 4222 nodePort: 31316 selector: - svc: nats-streaming \ No newline at end of file + svc: nats-streaming + diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index c93cf1df5..8443ecc97 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -9,6 +9,9 @@ serviceType: LoadBalancer ## Fission image repostiroy image: fission/fission-bundle +## Image pull policy +pullPolicy: ifNotPresent + ## Fission image version imageTag: nightly20170705 @@ -37,4 +40,5 @@ fissionUiImage: fission/fission-ui:0.1.0 ### NATS Streaming nats: authToken: "defaultFissionAuthToken" - clusterID: "fissionMQTrigger" \ No newline at end of file + clusterID: "fissionMQTrigger" + diff --git a/charts/fission-core/templates/deployment.yaml b/charts/fission-core/templates/deployment.yaml index 740934e80..5a7ea1898 100644 --- a/charts/fission-core/templates/deployment.yaml +++ b/charts/fission-core/templates/deployment.yaml @@ -14,7 +14,7 @@ metadata: apiVersion: v1 kind: ProjectRequest metadata: - name: fission-function + name: {{ .Values.functionNamespace }} labels: name: fission-function @@ -23,7 +23,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} --- apiVersion: v1 @@ -58,13 +58,13 @@ groupNames: null kind: RoleBinding metadata: name: fission:fission-admin - namespace: fission-function + namespace: {{ .Values.functionNamespace }} roleRef: name: fission:fission-admin subjects: - kind: ServiceAccount name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} userNames: - system:serviceaccount:fission:fission-admin @@ -85,19 +85,19 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: fission-admin - namespace: fission + namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole name: admin @@ -108,16 +108,30 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: fission-function-admin - namespace: fission-function + namespace: {{ .Values.functionNamespace }} subjects: - kind: ServiceAccount - name: fission-admin - namespace: fission + name: fission-svc + namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole name: admin apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fission-tpr +subjects: +- kind: ServiceAccount + name: fission-svc + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + {{ end }} --- @@ -138,7 +152,8 @@ spec: - name: controller image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] - args: ["--controllerPort", "8888", "--filepath", "/filestore"] + args: ["--controllerPort", "8888"] + serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 @@ -159,6 +174,7 @@ spec: image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] args: ["--routerPort", "8888"] + serviceAccount: fission-svc --- apiVersion: v1 @@ -194,8 +210,8 @@ spec: - name: poolmgr image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] - args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}"] - serviceAccount: fission-admin + args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}", "--fission-namespace", "{{ .Release.Namespace }}"] + serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 @@ -216,29 +232,13 @@ spec: image: "{{ .Values.image }}:{{ .Values.imageTag }}" command: ["/fission-bundle"] args: ["--kubewatcher"] - serviceAccount: fission-admin - ---- -apiVersion: v1 -kind: Service -metadata: - name: etcd - labels: - svc: etcd - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" -spec: - type: ClusterIP - ports: - - port: 2379 - targetPort: 2379 - selector: - svc: etcd + serviceAccount: fission-svc --- apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: etcd + name: timer labels: chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" spec: @@ -246,13 +246,11 @@ spec: template: metadata: labels: - svc: etcd + svc: timer spec: containers: - - name: etcd - image: quay.io/coreos/etcd - env: - - name: ETCD_LISTEN_CLIENT_URLS - value: http://0.0.0.0:2379 - - name: ETCD_ADVERTISE_CLIENT_URLS - value: http://etcd:2379 + - name: timer + image: "{{ .Values.image }}:{{ .Values.imageTag }}" + command: ["/fission-bundle"] + args: ["--timer"] + serviceAccount: fission-svc