Extract out permissions for fission.io componenets per-component (#2570)

* Extract out permissions for fission.io components per-component

* PR review changes

* Fix file names

* Fix the filename for the router

charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-buildermgr-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-buildermgr-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-buildermgr
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-buildermgr-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/buildermgr/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-buildermgr
+  name: {{ .Release.Name }}-buildermgr
 rules:
 - apiGroups:
   - ""
@@ -33,20 +33,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/buildermgr/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-buildermgr
+  name: {{ .Release.Name }}-buildermgr
 subjects:
   - kind: ServiceAccount
     name: fission-buildermgr
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-buildermgr
+  name: {{ .Release.Name }}-buildermgr
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/controller/clusterrole-fission-cr.yaml

@@ -0,0 +1,37 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-controller-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-controller-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-controller
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-controller-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/controller/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-controller
+  name: {{ .Release.Name }}-controller
 rules:
 - apiGroups:
   - ""
@@ -39,22 +39,3 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete

charts/fission-all/templates/controller/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-controller
+  name: {{ .Release.Name }}-controller
 subjects:
   - kind: ServiceAccount
     name: fission-controller
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-controller
+  name: {{ .Release.Name }}-controller
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/clusterrole-fission-cr.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-executor-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-executor-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-executor
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-executor-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-executor
+  name: {{ .Release.Name }}-executor
 rules:
 - apiGroups:
   - ""
@@ -42,20 +42,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - autoscaling
   resources:

charts/fission-all/templates/executor/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-executor
+  name: {{ .Release.Name }}-executor
 subjects:
   - kind: ServiceAccount
     name: fission-executor
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-executor
+  name: {{ .Release.Name }}-executor
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/fluentbit/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-fluentbit
+  name: {{ .Release.Name }}-fluentbit
 rules:
 - apiGroups:
   - ""

charts/fission-all/templates/fluentbit/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-fluentbit
+  name: {{ .Release.Name }}-fluentbit
 subjects:
   - kind: ServiceAccount
     name: fission-fluentbit
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-fluentbit
+  name: {{ .Release.Name }}-fluentbit
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-kubewatcher-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-kubewatcher-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-kubewatcher
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-kubewatcher-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/kubewatcher/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-kubewatcher
+  name: {{ .Release.Name }}-kubewatcher
 rules:
 - apiGroups:
   - ""
@@ -36,21 +36,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - kuberneteswatchtriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-kubewatcher
+  name: {{ .Release.Name }}-kubewatcher
 subjects:
   - kind: ServiceAccount
     name: fission-kubewatcher
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-kubewatcher
+  name: {{ .Release.Name }}-kubewatcher
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-kafka-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-kafka-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-kafka
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-kafka-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-kafka
+  name: {{ .Release.Name }}-kafka
 rules:
 - apiGroups:
   - ""
@@ -42,21 +42,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - messagequeuetriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-kafka
+  name: {{ .Release.Name }}-kafka
 subjects:
   - kind: ServiceAccount
     name: fission-kafka
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-kafka
+  name: {{ .Release.Name }}-kafka
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-keda-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-keda-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-keda
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-keda-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-keda/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-keda
+  name: {{ .Release.Name }}-keda
 rules:
 - apiGroups:
   - ""
@@ -42,21 +42,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - messagequeuetriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-keda
+  name: {{ .Release.Name }}-keda
 subjects:
   - kind: ServiceAccount
     name: fission-keda
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-keda
+  name: {{ .Release.Name }}-keda
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml

@@ -0,0 +1,38 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-fission-cr-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-fission-cr-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+subjects:
+  - kind: ServiceAccount
+    name: fission-preupgrade
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-fission-cr-preupgrade
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-preupgrade
+  name: {{ .Release.Name }}-preupgrade
   annotations:
     helm.sh/hook: pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation
@@ -15,16 +15,3 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - list

charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml

@@ -1,7 +1,7 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-preupgrade
+  name: {{ .Release.Name }}-preupgrade
   annotations:
     helm.sh/hook: pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation
@@ -11,5 +11,5 @@ subjects:
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-preupgrade
+  name: {{ .Release.Name }}-preupgrade
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/router/clusterrole-fission-cr.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-router-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-router-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-router
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-router-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/router/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-router
+  name: {{ .Release.Name }}-router
 rules:
 - apiGroups:
   - ""
@@ -40,21 +40,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - httptriggers
-  - packages
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/router/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-router
+  name: {{ .Release.Name }}-router
 subjects:
   - kind: ServiceAccount
     name: fission-router
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-router
+  name: {{ .Release.Name }}-router
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml

@@ -0,0 +1,25 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-storagesvc-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-storagesvc-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-storagesvc
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-storagesvc-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/storagesvc/clusterrole.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fission-cr-storagesvc
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - packages
-  verbs:
-  - get
-  - list

charts/fission-all/templates/storagesvc/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-fission-cr-storagesvc
-subjects:
-  - kind: ServiceAccount
-    name: fission-storagesvc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-storagesvc
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/timer/clusterrole-fission-cr.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-timer-fission-cr
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-timer-fission-cr
+subjects:
+  - kind: ServiceAccount
+    name: fission-timer
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-timer-fission-cr
+  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/timer/clusterrole.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-timer
+  name: {{ .Release.Name }}-timer
 rules:
 - apiGroups:
   - ""
@@ -20,21 +20,6 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - fission.io
-  resources:
-  - environments
-  - functions
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

charts/fission-all/templates/timer/clusterrolebinding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-timer
+  name: {{ .Release.Name }}-timer
 subjects:
   - kind: ServiceAccount
     name: fission-timer
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-timer
+  name: {{ .Release.Name }}-timer
   apiGroup: rbac.authorization.k8s.io