Create role and rolebinding for event-fetcher in multiple namespaces (#2669)

* create event-fetcher role and rolebinding in all namespace

* code review changes

* changed rolebinding name

charts/fission-all/templates/_function-access-role.tpl

@@ -13,12 +13,6 @@ rules:
   - secrets
   verbs:
   - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
 - apiGroups:
   - fission.io
   resources:
@@ -45,6 +39,30 @@ rules:
   - secrets
   verbs:
   - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
 {{- end -}}
 
 {{- define "fissionFunction.rolebindings" }}
@@ -61,7 +79,11 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher
-    namespace: {{template "fission-function-ns" . }}
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -75,5 +97,27 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-builder
-    namespace: {{ template "fission-builder-ns" . }}
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
 {{- end -}}

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,24 +4,6 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ template "fission-function-ns" . }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - "events"
-  verbs:
-  - "get"
-  - "list"
-  - "watch"
-  - "create"
-  - "update"
-  - "patch"
 
 {{- if not .Values.singleDefaultNamespace }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -4,20 +4,6 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ template "fission-function-ns" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ template "fission-function-ns" . }}
 
 {{- if not .Values.singleDefaultNamespace }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}

pkg/fetcher/fetcher.go

@@ -767,22 +767,21 @@ func (fetcher *Fetcher) WsStartHandler(w http.ResponseWriter, r *http.Request) {
 		logger.Error("Error creating recorder", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	pods, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).List(ctx, metav1.ListOptions{
-		FieldSelector: "metadata.name=" + fetcher.Info.Name,
-	})
+
+	pod, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).Get(ctx, fetcher.Info.Name, metav1.GetOptions{})
 	if err != nil {
 		logger.Error("Failed to get the pod", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	for _, pod := range pods.Items {
-		ref, err := reference.GetReference(scheme.Scheme, &pod)
-		if err != nil {
-			logger.Error("Could not get reference for pod", zap.Error(err))
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-		rec.Event(ref, corev1.EventTypeNormal, "WsConnectionStarted", "Websocket connection has been formed on this pod")
-		logger.Info("Sent websocket initiation event")
+
+	ref, err := reference.GetReference(scheme.Scheme, pod)
+	if err != nil {
+		logger.Error("Could not get reference for pod", zap.Error(err))
+		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
+	rec.Event(ref, corev1.EventTypeNormal, "WsConnectionStarted", "Websocket connection has been formed on this pod")
+	logger.Info("Sent websocket initiation event")
+
 	w.WriteHeader(http.StatusOK)
 }
 
@@ -801,24 +800,22 @@ func (fetcher *Fetcher) WsEndHandler(w http.ResponseWriter, r *http.Request) {
 		logger.Error("Error creating recorder", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	pods, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).List(ctx, metav1.ListOptions{
-		FieldSelector: "metadata.name=" + fetcher.Info.Name,
-	})
+	pod, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).Get(ctx, fetcher.Info.Name, metav1.GetOptions{})
 	if err != nil {
 		logger.Error("Failed to get the pod", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	for _, pod := range pods.Items {
-		// There will only be one time since we've used field selector
-		ref, err := reference.GetReference(scheme.Scheme, &pod)
-		if err != nil {
-			logger.Error("Could not get reference for pod", zap.Error(err))
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-		// We could use Eventf and supply the amount of time the connection was inactive although, in case of multiple connections, it doesn't make sense
-		rec.Event(ref, corev1.EventTypeNormal, "NoActiveConnections", "Connection has been inactive")
-		logger.Info("Sent no active connections event")
+
+	// There will only be one time since we've used field selector
+	ref, err := reference.GetReference(scheme.Scheme, pod)
+	if err != nil {
+		logger.Error("Could not get reference for pod", zap.Error(err))
+		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
+	// We could use Eventf and supply the amount of time the connection was inactive although, in case of multiple connections, it doesn't make sense
+	rec.Event(ref, corev1.EventTypeNormal, "NoActiveConnections", "Connection has been inactive")
+	logger.Info("Sent no active connections event")
+
 	w.WriteHeader(http.StatusOK)
 }