Enabling multi-tenancy for fission objects. (#655)

This feature allows creation of fission objects in different namespaces, in addition to retaining the existing behavior of creating fission objects in default namespace if user doesnt provide one. 
It also removes cluster admin roles for fission-fetcher and fission-builder Service Accounts and grants them only those privileges that they need.

charts/fission-all/templates/deployment.yaml

@@ -22,6 +22,37 @@ metadata:
     istio-injection: enabled
     {{- end }}
 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secret-configmap-getter
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - secrets
+  - configmaps
+  verbs:
+  - get
+  - watch
+  - list
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: package-getter
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - packages
+  verbs:
+  - get
+  - watch
+  - list
+
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -44,21 +75,6 @@ roleRef:
   name: admin
   apiGroup: rbac.authorization.k8s.io
 
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-function-admin
-  namespace: {{ .Values.functionNamespace }}
-subjects:
-  - kind: ServiceAccount
-    name: fission-svc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -80,20 +96,6 @@ metadata:
   name: fission-fetcher
   namespace: {{ .Values.functionNamespace }}
 
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-fetcher-crd
-subjects:
-- kind: ServiceAccount
-  name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -101,20 +103,6 @@ metadata:
   name: fission-builder
   namespace: {{ .Values.builderNamespace }}
 
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-builder-crd
-subjects:
-- kind: ServiceAccount
-  name: fission-builder
-  namespace: {{ .Values.builderNamespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment

charts/fission-core/templates/deployment.yaml

@@ -22,6 +22,37 @@ metadata:
     istio-injection: enabled
     {{- end }}
 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secret-configmap-getter
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - secrets
+  - configmaps
+  verbs:
+  - get
+  - watch
+  - list
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: package-getter
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - packages
+  verbs:
+  - get
+  - watch
+  - list
+
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -44,21 +75,6 @@ roleRef:
   name: admin
   apiGroup: rbac.authorization.k8s.io
 
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-function-admin
-  namespace: {{ .Values.functionNamespace }}
-subjects:
-  - kind: ServiceAccount
-    name: fission-svc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -80,20 +96,6 @@ metadata:
   name: fission-fetcher
   namespace: {{ .Values.functionNamespace }}
 
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-fetcher-crd
-subjects:
-- kind: ServiceAccount
-  name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -101,20 +103,6 @@ metadata:
   name: fission-builder
   namespace: {{ .Values.builderNamespace }}
 
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-builder-crd
-subjects:
-- kind: ServiceAccount
-  name: fission-builder
-  namespace: {{ .Values.builderNamespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
 ---
 apiVersion: extensions/v1beta1
 kind: Deployment