Adding fission-rbac.yml for (#183)

Set up RBAC role bindings to allow fission to create pods in the fission-function namespace.
2017-05-17 16:27:10 -07:00
parent a8c6347ed0
commit 6185e842b5
1 changed files with 174 additions and 0 deletions
@@ -0,0 +1,174 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: fission
  labels:
    name: fission
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: fission-function
  labels:
    name: fission-function
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: fission-svc
  namespace: fission
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1alpha1
 metadata:
  name: fission-admin
  namespace: fission
 subjects:
  - kind: ServiceAccount
    name: fission-svc
    namespace: fission
 roleRef:
  kind: ClusterRole
  name: admin
  apiGroup: rbac.authorization.k8s.io
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1alpha1
 metadata:
  name: fission-function-admin
  namespace: fission-function
 subjects:
  - kind: ServiceAccount
    name: fission-svc
    namespace: fission
 roleRef:
  kind: ClusterRole
  name: admin
  apiGroup: rbac.authorization.k8s.io
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: controller
  namespace: fission
 spec:
  replicas: 1
  template:
    metadata:
      labels:
        svc: controller
    spec:
      containers:
        - name: controller
          image: fission/fission-bundle:alpha20170328
          command: ["/fission-bundle"]
          args: ["--controllerPort", "8888", "--filepath", "/filestore"]
      serviceAccountName: fission-svc
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: router
  namespace: fission
 spec:
  replicas: 1
  template:
    metadata:
      labels:
        svc: router
    spec:
      containers:
      - name: router
        image: fission/fission-bundle:alpha20170328
        command: ["/fission-bundle"]
        args: ["--routerPort", "8888"]
      serviceAccountName: fission-svc
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: poolmgr
  namespace: fission
  labels:
    svc: poolmgr
 spec:
  ports:
  - port: 80
    targetPort: 8888
  selector:
    svc: poolmgr
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: poolmgr
  namespace: fission
 spec:
  replicas: 1
  template:
    metadata:
      labels:
        svc: poolmgr
    spec:
      containers:
      - name: poolmgr
        image: fission/fission-bundle:alpha20170328
        command: ["/fission-bundle"]
        args: ["--poolmgrPort", "8888"]
      serviceAccountName: fission-svc
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: kubewatcher
  namespace: fission
 spec:
  replicas: 1
  template:
    metadata:
      labels:
        svc: kubewatcher
    spec:
      containers:
      - name: kubewatcher
        image: fission/fission-bundle:alpha20170328
        command: ["/fission-bundle"]
        args: ["--kubewatcher"]
      serviceAccountName: fission-svc
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: etcd
  namespace: fission
  labels:
    svc: etcd
 spec:
  ports:
  - port: 2379
    targetPort: 2379
  selector:
    svc: etcd
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: etcd
  namespace: fission
 spec:
  replicas: 1
  template:
    metadata:
      labels:
        svc: etcd
    spec:
      containers:
      - name: etcd
        image: quay.io/coreos/etcd
        imagePullPolicy: IfNotPresent
        env:
        - name: ETCD_LISTEN_CLIENT_URLS
          value: http://0.0.0.0:2379
        - name: ETCD_ADVERTISE_CLIENT_URLS
          value: http://etcd:2379
      serviceAccountName: fission-svc