Role and RoleBinding for fission-fetcher and fission-builder for user configured namespaces (#2574)

* Role and RoleBinding for fission-fetcher and fission-builder can be created in additional namespaces * Added template file for fetcher and builder role and rolebinding
2022-10-19 18:06:17 +05:30
parent 827baea974
commit 7eeb3ead66
3 changed files with 103 additions and 72 deletions
@@ -0,0 +1,79 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    namespace: {{ .Values.functionNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}
+{{- end -}}