From 6bca24a3f5e6570f5c87d5c580b57a303474b256 Mon Sep 17 00:00:00 2001 From: Ta-Ching Chen Date: Sat, 19 Aug 2017 06:01:21 +0800 Subject: [PATCH] Fix fetcher failed to access TPR if RBAC is enabled (#288) --- charts/fission-all/templates/deployment.yaml | 21 +++++++++++++++++++ charts/fission-core/templates/deployment.yaml | 21 +++++++++++++++++++ fission-rbac.yaml | 19 +++++++++++++++++ poolmgr/gp.go | 1 + 4 files changed, 62 insertions(+) diff --git a/charts/fission-all/templates/deployment.yaml b/charts/fission-all/templates/deployment.yaml index f2801e7a..dfd86ec5 100644 --- a/charts/fission-all/templates/deployment.yaml +++ b/charts/fission-all/templates/deployment.yaml @@ -132,6 +132,27 @@ roleRef: name: cluster-admin apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-fetcher + namespace: {{ .Values.functionNamespace }} + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fission-fetcher-tpr +subjects: +- kind: ServiceAccount + name: fission-fetcher + namespace: {{ .Values.functionNamespace }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + {{ end }} --- diff --git a/charts/fission-core/templates/deployment.yaml b/charts/fission-core/templates/deployment.yaml index 5a7ea189..41b5682f 100644 --- a/charts/fission-core/templates/deployment.yaml +++ b/charts/fission-core/templates/deployment.yaml @@ -132,6 +132,27 @@ roleRef: name: cluster-admin apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-fetcher + namespace: {{ .Values.functionNamespace }} + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fission-fetcher-tpr +subjects: +- kind: ServiceAccount + name: fission-fetcher + namespace: {{ .Values.functionNamespace }} +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + {{ end }} --- diff --git a/fission-rbac.yaml b/fission-rbac.yaml index dc5ebc9f..07aa3f56 100644 --- a/fission-rbac.yaml +++ b/fission-rbac.yaml @@ -46,6 +46,25 @@ roleRef: name: admin apiGroup: rbac.authorization.k8s.io --- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fission-fetcher + namespace: fission-function +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: fission-fetcher-tpr +subjects: +- kind: ServiceAccount + name: fission-fetcher + namespace: fission-function +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io +--- apiVersion: extensions/v1beta1 kind: Deployment metadata: diff --git a/poolmgr/gp.go b/poolmgr/gp.go index 9a0bdf57..99dab819 100644 --- a/poolmgr/gp.go +++ b/poolmgr/gp.go @@ -387,6 +387,7 @@ func (gp *GenericPool) createPool() error { Command: []string{"/fetcher", sharedMountPath}, }, }, + ServiceAccountName: "fission-fetcher", }, }, },