Role and RoleBinding for fission-fetcher and fission-builder for user configured namespaces (#2574)

* Role and RoleBinding for fission-fetcher and fission-builder can be created in additional namespaces
* Added template file for fetcher and builder role and rolebinding

charts/fission-all/templates/_function-access-role.tpl

@@ -0,0 +1,79 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    namespace: {{ .Values.functionNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}
+{{- end -}}

charts/fission-all/templates/misc-functions/role.yaml

@@ -1,28 +1,9 @@
-apiVersion: rbac.authorization.k8s.io/v1
+{{/* 
-kind: Role
+Passing namespace as an argument to the "fissionFunction.roles" template.
-metadata:
+Need to use merge function to pass in the current scope so that ".Release" values
-  name: {{ .Release.Name }}-fission-fetcher
+can be used
-  namespace: {{ .Values.defaultNamespace }}
+ */}}
-rules:
+{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
-- apiGroups:
-  - fission.io
-  resources:
-  - packages
-  verbs:
-  - "get"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -41,23 +22,9 @@ rules:
   - "create"
   - "update"
   - "patch"
----
+
-apiVersion: rbac.authorization.k8s.io/v1
+{{- if not .Values.singleDefaultNamespace }}
-kind: Role
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
-metadata:
+{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
-  name: {{ .Release.Name }}-fission-builder
+{{- end }}
-  namespace: {{ .Values.defaultNamespace }}
+{{- end }}
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - packages
-  verbs:
-  - "get"
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -1,16 +1,9 @@
-apiVersion: rbac.authorization.k8s.io/v1
+{{/* 
-kind: RoleBinding
+Passing namespace as an argument to the "fissionFunction.rolebindings" template.
-metadata:
+Need to use merge function to pass in the current scope so that ".Release" values
-  name: {{ .Release.Name }}-fission-fetcher
+can be used
-  namespace: {{ .Values.defaultNamespace }}
+ */}}
-roleRef:
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -25,17 +18,9 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
----
+
-apiVersion: rbac.authorization.k8s.io/v1
+{{- if not .Values.singleDefaultNamespace }}
-kind: RoleBinding
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
-metadata:
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
-  name: {{ .Release.Name }}-fission-builder
+{{- end }}
-  namespace: {{ .Values.defaultNamespace }}
+{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}