Create role and rolebinding for event-fetcher in multiple namespaces (#2669)

* create event-fetcher role and rolebinding in all namespace

* code review changes

* changed rolebinding name

charts/fission-all/templates/_function-access-role.tpl

@@ -13,12 +13,6 @@ rules:
   - secrets
   verbs:
   - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
 - apiGroups:
   - fission.io
   resources:
@@ -45,6 +39,30 @@ rules:
   - secrets
   verbs:
   - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
 {{- end -}}
 
 {{- define "fissionFunction.rolebindings" }}
@@ -61,7 +79,11 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher
-    namespace: {{template "fission-function-ns" . }}
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -75,5 +97,27 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-builder
-    namespace: {{ template "fission-builder-ns" . }}
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
 {{- end -}}

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,24 +4,6 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ template "fission-function-ns" . }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - "events"
-  verbs:
-  - "get"
-  - "list"
-  - "watch"
-  - "create"
-  - "update"
-  - "patch"
 
 {{- if not .Values.singleDefaultNamespace }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -4,20 +4,6 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ template "fission-function-ns" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ template "fission-function-ns" . }}
 
 {{- if not .Values.singleDefaultNamespace }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}