diff --git a/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml b/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..d747c5ef --- /dev/null +++ b/charts/fission-all/templates/buildermgr/clusterrole-fission-cr.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-buildermgr-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-buildermgr-fission-cr +subjects: + - kind: ServiceAccount + name: fission-buildermgr + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-buildermgr-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/buildermgr/clusterrole.yaml b/charts/fission-all/templates/buildermgr/clusterrole.yaml index 11606aba..b78efc66 100644 --- a/charts/fission-all/templates/buildermgr/clusterrole.yaml +++ b/charts/fission-all/templates/buildermgr/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr rules: - apiGroups: - "" @@ -33,20 +33,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml index 7bbb0371..07e353ec 100644 --- a/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml +++ b/charts/fission-all/templates/buildermgr/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr subjects: - kind: ServiceAccount name: fission-buildermgr namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-buildermgr + name: {{ .Release.Name }}-buildermgr apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml b/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..eea08970 --- /dev/null +++ b/charts/fission-all/templates/controller/clusterrole-fission-cr.yaml @@ -0,0 +1,37 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-controller-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-controller-fission-cr +subjects: + - kind: ServiceAccount + name: fission-controller + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-controller-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/controller/clusterrole.yaml b/charts/fission-all/templates/controller/clusterrole.yaml index b005e10f..6c13a5d6 100644 --- a/charts/fission-all/templates/controller/clusterrole.yaml +++ b/charts/fission-all/templates/controller/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller rules: - apiGroups: - "" @@ -39,22 +39,3 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete diff --git a/charts/fission-all/templates/controller/clusterrolebinding.yaml b/charts/fission-all/templates/controller/clusterrolebinding.yaml index a0ae98e1..174312df 100644 --- a/charts/fission-all/templates/controller/clusterrolebinding.yaml +++ b/charts/fission-all/templates/controller/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller subjects: - kind: ServiceAccount name: fission-controller namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-controller + name: {{ .Release.Name }}-controller apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml b/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..89293dc8 --- /dev/null +++ b/charts/fission-all/templates/executor/clusterrole-fission-cr.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-executor-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-executor-fission-cr +subjects: + - kind: ServiceAccount + name: fission-executor + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-executor-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/executor/clusterrole.yaml b/charts/fission-all/templates/executor/clusterrole.yaml index 0ad0d383..8782093e 100644 --- a/charts/fission-all/templates/executor/clusterrole.yaml +++ b/charts/fission-all/templates/executor/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor rules: - apiGroups: - "" @@ -42,20 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - autoscaling resources: diff --git a/charts/fission-all/templates/executor/clusterrolebinding.yaml b/charts/fission-all/templates/executor/clusterrolebinding.yaml index a059df90..c5a79874 100644 --- a/charts/fission-all/templates/executor/clusterrolebinding.yaml +++ b/charts/fission-all/templates/executor/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor subjects: - kind: ServiceAccount name: fission-executor namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-executor + name: {{ .Release.Name }}-executor apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/fluentbit/clusterrole.yaml b/charts/fission-all/templates/fluentbit/clusterrole.yaml index 1e314f66..c8eeadf9 100644 --- a/charts/fission-all/templates/fluentbit/clusterrole.yaml +++ b/charts/fission-all/templates/fluentbit/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit rules: - apiGroups: - "" diff --git a/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml index 272d6b4b..5ce5495d 100644 --- a/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml +++ b/charts/fission-all/templates/fluentbit/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit subjects: - kind: ServiceAccount name: fission-fluentbit namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-fluentbit + name: {{ .Release.Name }}-fluentbit apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml b/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..ef7014c3 --- /dev/null +++ b/charts/fission-all/templates/kubewatcher/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-kubewatcher-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - kuberneteswatchtriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-kubewatcher-fission-cr +subjects: + - kind: ServiceAccount + name: fission-kubewatcher + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-kubewatcher-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/kubewatcher/clusterrole.yaml b/charts/fission-all/templates/kubewatcher/clusterrole.yaml index 0b2b0cb3..1d18291f 100644 --- a/charts/fission-all/templates/kubewatcher/clusterrole.yaml +++ b/charts/fission-all/templates/kubewatcher/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher rules: - apiGroups: - "" @@ -36,21 +36,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - kuberneteswatchtriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml index 16bd686b..0831690a 100644 --- a/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml +++ b/charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher subjects: - kind: ServiceAccount name: fission-kubewatcher namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-kubewatcher + name: {{ .Release.Name }}-kubewatcher apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..419672d0 --- /dev/null +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-kafka-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-kafka-fission-cr +subjects: + - kind: ServiceAccount + name: fission-kafka + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-kafka-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml index 6c02b299..f78b3e70 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka rules: - apiGroups: - "" @@ -42,21 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml index 2435861b..7e6f175f 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka subjects: - kind: ServiceAccount name: fission-kafka namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-kafka + name: {{ .Release.Name }}-kafka apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml b/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..caa808fc --- /dev/null +++ b/charts/fission-all/templates/mqt-keda/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-keda-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - messagequeuetriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-keda-fission-cr +subjects: + - kind: ServiceAccount + name: fission-keda + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-keda-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/mqt-keda/clusterrole.yaml b/charts/fission-all/templates/mqt-keda/clusterrole.yaml index abebfbc3..a99ce2f2 100644 --- a/charts/fission-all/templates/mqt-keda/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda rules: - apiGroups: - "" @@ -42,21 +42,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - messagequeuetriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml index 86fe321b..ff9f010b 100644 --- a/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda subjects: - kind: ServiceAccount name: fission-keda namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-keda + name: {{ .Release.Name }}-keda apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..faf99bde --- /dev/null +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole-fission-cr.yaml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-2" +rules: +- apiGroups: + - fission.io + resources: + - canaryconfigs + - environments + - functions + - httptriggers + - kuberneteswatchtriggers + - messagequeuetriggers + - packages + - timetriggers + verbs: + - list +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-fission-cr-preupgrade + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation +subjects: + - kind: ServiceAccount + name: fission-preupgrade + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-fission-cr-preupgrade + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml index 66f213c3..beb4e09e 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation @@ -15,16 +15,3 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - list diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml index 17d0bb62..92b1fef0 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml @@ -1,7 +1,7 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation @@ -11,5 +11,5 @@ subjects: namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-preupgrade + name: {{ .Release.Name }}-preupgrade apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/clusterrole-fission-cr.yaml b/charts/fission-all/templates/router/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..5fdd822a --- /dev/null +++ b/charts/fission-all/templates/router/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-router-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - httptriggers + - packages + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-router-fission-cr +subjects: + - kind: ServiceAccount + name: fission-router + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-router-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/router/clusterrole.yaml b/charts/fission-all/templates/router/clusterrole.yaml index 1a9ee74a..5a551c19 100644 --- a/charts/fission-all/templates/router/clusterrole.yaml +++ b/charts/fission-all/templates/router/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router rules: - apiGroups: - "" @@ -40,21 +40,6 @@ rules: - get - list - watch -- apiGroups: - - fission.io - resources: - - environments - - functions - - httptriggers - - packages - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/router/clusterrolebinding.yaml b/charts/fission-all/templates/router/clusterrolebinding.yaml index bd053b04..a455a71d 100644 --- a/charts/fission-all/templates/router/clusterrolebinding.yaml +++ b/charts/fission-all/templates/router/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router subjects: - kind: ServiceAccount name: fission-router namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-router + name: {{ .Release.Name }}-router apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml b/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..bba0f56a --- /dev/null +++ b/charts/fission-all/templates/storagesvc/clusterrole-fission-cr.yaml @@ -0,0 +1,25 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-storagesvc-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - get + - list +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-storagesvc-fission-cr +subjects: + - kind: ServiceAccount + name: fission-storagesvc + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-storagesvc-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/storagesvc/clusterrole.yaml b/charts/fission-all/templates/storagesvc/clusterrole.yaml deleted file mode 100644 index 20b525aa..00000000 --- a/charts/fission-all/templates/storagesvc/clusterrole.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ .Release.Name }}-fission-cr-storagesvc -rules: -- apiGroups: - - fission.io - resources: - - packages - verbs: - - get - - list diff --git a/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml b/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml deleted file mode 100644 index 7ca3c9f7..00000000 --- a/charts/fission-all/templates/storagesvc/clusterrolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-fission-cr-storagesvc -subjects: - - kind: ServiceAccount - name: fission-storagesvc - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-storagesvc - apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml b/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml new file mode 100644 index 00000000..e2d89fe3 --- /dev/null +++ b/charts/fission-all/templates/timer/clusterrole-fission-cr.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Name }}-timer-fission-cr +rules: +- apiGroups: + - fission.io + resources: + - environments + - functions + - packages + - timetriggers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-timer-fission-cr +subjects: + - kind: ServiceAccount + name: fission-timer + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Release.Name }}-timer-fission-cr + apiGroup: rbac.authorization.k8s.io diff --git a/charts/fission-all/templates/timer/clusterrole.yaml b/charts/fission-all/templates/timer/clusterrole.yaml index cf6fdc30..b20e2c28 100644 --- a/charts/fission-all/templates/timer/clusterrole.yaml +++ b/charts/fission-all/templates/timer/clusterrole.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer rules: - apiGroups: - "" @@ -20,21 +20,6 @@ rules: - list - watch - patch -- apiGroups: - - fission.io - resources: - - environments - - functions - - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: diff --git a/charts/fission-all/templates/timer/clusterrolebinding.yaml b/charts/fission-all/templates/timer/clusterrolebinding.yaml index eefdf433..f4f8acdb 100644 --- a/charts/fission-all/templates/timer/clusterrolebinding.yaml +++ b/charts/fission-all/templates/timer/clusterrolebinding.yaml @@ -1,12 +1,12 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer subjects: - kind: ServiceAccount name: fission-timer namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }}-fission-cr-timer + name: {{ .Release.Name }}-timer apiGroup: rbac.authorization.k8s.io