diff --git a/charts/fission-all/templates/_function-access-role.tpl b/charts/fission-all/templates/_function-access-role.tpl new file mode 100644 index 00000000..2485136f --- /dev/null +++ b/charts/fission-all/templates/_function-access-role.tpl @@ -0,0 +1,79 @@ +{{- define "fissionFunction.roles" }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Release.Name }}-fission-fetcher + namespace: {{ .namespace }} +rules: +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - get +- apiGroups: + - "" + resources: + - pods + verbs: + - list +- apiGroups: + - fission.io + resources: + - packages + verbs: + - "get" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Release.Name }}-fission-builder + namespace: {{ .namespace }} +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - "get" +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - get +{{- end -}} + +{{- define "fissionFunction.rolebindings" }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Release.Name }}-fission-fetcher + namespace: {{ .namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Release.Name }}-fission-fetcher +subjects: + - kind: ServiceAccount + name: fission-fetcher + namespace: {{ .Values.functionNamespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Release.Name }}-fission-builder + namespace: {{ .namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Release.Name }}-fission-builder +subjects: + - kind: ServiceAccount + name: fission-builder + namespace: {{ .Values.builderNamespace }} +{{- end -}} diff --git a/charts/fission-all/templates/misc-functions/role.yaml b/charts/fission-all/templates/misc-functions/role.yaml index fe35e30b..46241b11 100644 --- a/charts/fission-all/templates/misc-functions/role.yaml +++ b/charts/fission-all/templates/misc-functions/role.yaml @@ -1,28 +1,9 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-fission-fetcher - namespace: {{ .Values.defaultNamespace }} -rules: -- apiGroups: - - "" - resources: - - configmaps - - secrets - verbs: - - get -- apiGroups: - - "" - resources: - - pods - verbs: - - list -- apiGroups: - - fission.io - resources: - - packages - verbs: - - "get" +{{/* +Passing namespace as an argument to the "fissionFunction.roles" template. +Need to use merge function to pass in the current scope so that ".Release" values +can be used + */}} +{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -41,23 +22,9 @@ rules: - "create" - "update" - "patch" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-fission-builder - namespace: {{ .Values.defaultNamespace }} -rules: -- apiGroups: - - fission.io - resources: - - packages - verbs: - - "get" -- apiGroups: - - "" - resources: - - configmaps - - secrets - verbs: - - get + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }} +{{- end }} +{{- end }} diff --git a/charts/fission-all/templates/misc-functions/rolebinding.yaml b/charts/fission-all/templates/misc-functions/rolebinding.yaml index 0f756f16..019c7b1a 100644 --- a/charts/fission-all/templates/misc-functions/rolebinding.yaml +++ b/charts/fission-all/templates/misc-functions/rolebinding.yaml @@ -1,16 +1,9 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ .Release.Name }}-fission-fetcher - namespace: {{ .Values.defaultNamespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ .Release.Name }}-fission-fetcher -subjects: - - kind: ServiceAccount - name: fission-fetcher - namespace: {{ .Values.functionNamespace }} +{{/* +Passing namespace as an argument to the "fissionFunction.rolebindings" template. +Need to use merge function to pass in the current scope so that ".Release" values +can be used + */}} +{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -25,17 +18,9 @@ subjects: - kind: ServiceAccount name: fission-fetcher namespace: {{ .Values.functionNamespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ .Release.Name }}-fission-builder - namespace: {{ .Values.defaultNamespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ .Release.Name }}-fission-builder -subjects: - - kind: ServiceAccount - name: fission-builder - namespace: {{ .Values.builderNamespace }} + +{{- if not .Values.singleDefaultNamespace }} +{{- range $namespace := $.Values.additionalFissionNamespaces }} +{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }} +{{- end }} +{{- end }}