diff --git a/.github/workflows/push_pr.yaml b/.github/workflows/push_pr.yaml index 9fdcc590..a0d1777b 100644 --- a/.github/workflows/push_pr.yaml +++ b/.github/workflows/push_pr.yaml @@ -82,7 +82,7 @@ jobs: skaffold version - name: Install GoReleaser - uses: goreleaser/goreleaser-action@v2 + uses: goreleaser/goreleaser-action@v3 with: install-only: true @@ -130,7 +130,7 @@ jobs: - name: Archive fission dump if: ${{ failure() }} - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }} path: fission-dump/*.zip @@ -138,7 +138,7 @@ jobs: - name: Archive kind logs if: ${{ always() }} - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }} path: kind-logs/* diff --git a/.github/workflows/upgrade_test.yaml b/.github/workflows/upgrade_test.yaml index b16f4e46..7eebc5b8 100644 --- a/.github/workflows/upgrade_test.yaml +++ b/.github/workflows/upgrade_test.yaml @@ -55,7 +55,7 @@ jobs: version: ${{ env.KIND_VERSION }} - name: Install GoReleaser - uses: goreleaser/goreleaser-action@v2 + uses: goreleaser/goreleaser-action@v3 with: install-only: true @@ -101,7 +101,7 @@ jobs: - name: Archive fission dump if: ${{ failure() }} - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: fission-dump path: fission-dump/*.zip @@ -109,7 +109,7 @@ jobs: - name: Archive kind logs if: ${{ always() }} - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }} path: kind-logs/* diff --git a/charts/fission-all/templates/buildermgr/clusterrole.yaml b/charts/fission-all/templates/buildermgr/clusterrole.yaml index b95af5cb..11606aba 100644 --- a/charts/fission-all/templates/buildermgr/clusterrole.yaml +++ b/charts/fission-all/templates/buildermgr/clusterrole.yaml @@ -8,12 +8,8 @@ rules: resources: - configmaps - pods - - secrets - services - serviceaccounts - - replicationcontrollers - - namespaces - - events verbs: - create - delete @@ -25,39 +21,24 @@ rules: - apps resources: - deployments - - deployments/scale - - replicasets verbs: + - list - create + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: - get - list - watch - - update - - patch - - delete - apiGroups: - fission.io resources: - - canaryconfigs - environments - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - packages - - timetriggers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete -- apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers verbs: - create - get diff --git a/charts/fission-all/templates/controller/clusterrole.yaml b/charts/fission-all/templates/controller/clusterrole.yaml index 05514696..b005e10f 100644 --- a/charts/fission-all/templates/controller/clusterrole.yaml +++ b/charts/fission-all/templates/controller/clusterrole.yaml @@ -6,41 +6,39 @@ rules: - apiGroups: - "" resources: - - configmaps - - pods - - secrets - services - - serviceaccounts - - replicationcontrollers - - namespaces - - events verbs: - - create - - delete - - get - list - - watch - - patch - apiGroups: - - apps + - "" resources: - - deployments - - deployments/scale - - replicasets + - configmaps + - secrets verbs: + - get +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get - create +- apiGroups: + - "" + resources: + - pods + verbs: - get - list - watch - - update - - patch - - delete - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions verbs: - get + - list + - watch - apiGroups: - fission.io resources: @@ -60,21 +58,3 @@ rules: - update - patch - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - rolebindings - verbs: - - create - - get - - list - - watch - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - verbs: - - bind diff --git a/charts/fission-all/templates/executor/clusterrole.yaml b/charts/fission-all/templates/executor/clusterrole.yaml index 75df2ff7..0ad0d383 100644 --- a/charts/fission-all/templates/executor/clusterrole.yaml +++ b/charts/fission-all/templates/executor/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -35,17 +34,20 @@ rules: - update - patch - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch - apiGroups: - fission.io resources: - - canaryconfigs - environments - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - packages - - timetriggers verbs: - create - get diff --git a/charts/fission-all/templates/kubewatcher/clusterrole.yaml b/charts/fission-all/templates/kubewatcher/clusterrole.yaml index 5f44393e..0b2b0cb3 100644 --- a/charts/fission-all/templates/kubewatcher/clusterrole.yaml +++ b/charts/fission-all/templates/kubewatcher/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -21,20 +20,6 @@ rules: - list - watch - patch -- apiGroups: - - apps - resources: - - deployments - - deployments/scale - - replicasets - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - batch resources: @@ -44,28 +29,20 @@ rules: - list - watch - apiGroups: - - fission.io + - apiextensions.k8s.io resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers + - customresourcedefinitions verbs: - - create - get - list - watch - - update - - patch - - delete - apiGroups: - - autoscaling + - fission.io resources: - - horizontalpodautoscalers + - environments + - functions + - kuberneteswatchtriggers + - packages verbs: - create - get diff --git a/charts/fission-all/templates/misc-functions/role.yaml b/charts/fission-all/templates/misc-functions/role.yaml index a0c5efbc..fe35e30b 100644 --- a/charts/fission-all/templates/misc-functions/role.yaml +++ b/charts/fission-all/templates/misc-functions/role.yaml @@ -4,57 +4,25 @@ metadata: name: {{ .Release.Name }}-fission-fetcher namespace: {{ .Values.defaultNamespace }} rules: - - apiGroups: - - "" - resources: - - configmaps - - secrets - - pods - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - events - verbs: - - "*" - - apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - "*" - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ .Release.Name }}-fission-builder - namespace: {{ .Values.defaultNamespace }} -rules: - - apiGroups: - - fission.io - resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers - verbs: - - "*" - +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - get +- apiGroups: + - "" + resources: + - pods + verbs: + - list +- apiGroups: + - fission.io + resources: + - packages + verbs: + - "get" --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -62,9 +30,34 @@ metadata: namespace: {{ .Values.functionNamespace }} name: {{ .Release.Name }}-event-fetcher rules: - - apiGroups: [""] # "" indicates the core API group - resources: ["pods"] - verbs: ["get", "watch", "list"] - - apiGroups: [""] # "" indicates the core API group - resources: ["events"] - verbs: ["*"] +- apiGroups: + - "" + resources: + - "events" + verbs: + - "get" + - "list" + - "watch" + - "create" + - "update" + - "patch" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Release.Name }}-fission-builder + namespace: {{ .Values.defaultNamespace }} +rules: +- apiGroups: + - fission.io + resources: + - packages + verbs: + - "get" +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - get diff --git a/charts/fission-all/templates/misc-functions/rolebinding.yaml b/charts/fission-all/templates/misc-functions/rolebinding.yaml index c80af74c..0f756f16 100644 --- a/charts/fission-all/templates/misc-functions/rolebinding.yaml +++ b/charts/fission-all/templates/misc-functions/rolebinding.yaml @@ -11,22 +11,6 @@ subjects: - kind: ServiceAccount name: fission-fetcher namespace: {{ .Values.functionNamespace }} - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ .Release.Name }}-fission-builder - namespace: {{ .Values.defaultNamespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ .Release.Name }}-fission-builder -subjects: - - kind: ServiceAccount - name: fission-builder - namespace: {{ .Values.builderNamespace }} - --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -41,3 +25,17 @@ subjects: - kind: ServiceAccount name: fission-fetcher namespace: {{ .Values.functionNamespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Release.Name }}-fission-builder + namespace: {{ .Values.defaultNamespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Release.Name }}-fission-builder +subjects: + - kind: ServiceAccount + name: fission-builder + namespace: {{ .Values.builderNamespace }} diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml index 98409356..6c02b299 100644 --- a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -36,28 +35,20 @@ rules: - patch - delete - apiGroups: - - fission.io + - apiextensions.k8s.io resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers + - customresourcedefinitions verbs: - - create - get - list - watch - - update - - patch - - delete - apiGroups: - - autoscaling + - fission.io resources: - - horizontalpodautoscalers + - environments + - functions + - messagequeuetriggers + - packages verbs: - create - get diff --git a/charts/fission-all/templates/mqt-keda/clusterrole.yaml b/charts/fission-all/templates/mqt-keda/clusterrole.yaml index f097005b..abebfbc3 100644 --- a/charts/fission-all/templates/mqt-keda/clusterrole.yaml +++ b/charts/fission-all/templates/mqt-keda/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -36,28 +35,20 @@ rules: - patch - delete - apiGroups: - - fission.io + - apiextensions.k8s.io resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers + - customresourcedefinitions verbs: - - create - get - list - watch - - update - - patch - - delete - apiGroups: - - autoscaling + - fission.io resources: - - horizontalpodautoscalers + - environments + - functions + - messagequeuetriggers + - packages verbs: - create - get diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml index 3ce069c3..66f213c3 100644 --- a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml +++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml @@ -13,6 +13,8 @@ rules: - customresourcedefinitions verbs: - get + - list + - watch - apiGroups: - fission.io resources: diff --git a/charts/fission-all/templates/router/clusterrole.yaml b/charts/fission-all/templates/router/clusterrole.yaml index 4eb3c7aa..1a9ee74a 100644 --- a/charts/fission-all/templates/router/clusterrole.yaml +++ b/charts/fission-all/templates/router/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -21,20 +20,6 @@ rules: - list - watch - patch -- apiGroups: - - apps - resources: - - deployments - - deployments/scale - - replicasets - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - networking.k8s.io resources: @@ -48,28 +33,20 @@ rules: - patch - delete - apiGroups: - - fission.io + - apiextensions.k8s.io resources: - - canaryconfigs - - environments - - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - - packages - - timetriggers + - customresourcedefinitions verbs: - - create - get - list - watch - - update - - patch - - delete - apiGroups: - - autoscaling + - fission.io resources: - - horizontalpodautoscalers + - environments + - functions + - httptriggers + - packages verbs: - create - get diff --git a/charts/fission-all/templates/timer/clusterrole.yaml b/charts/fission-all/templates/timer/clusterrole.yaml index 29bb134b..cf6fdc30 100644 --- a/charts/fission-all/templates/timer/clusterrole.yaml +++ b/charts/fission-all/templates/timer/clusterrole.yaml @@ -12,7 +12,6 @@ rules: - services - serviceaccounts - replicationcontrollers - - namespaces - events verbs: - create @@ -21,29 +20,11 @@ rules: - list - watch - patch -- apiGroups: - - apps - resources: - - deployments - - deployments/scale - - replicasets - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - fission.io resources: - - canaryconfigs - environments - functions - - httptriggers - - kuberneteswatchtriggers - - messagequeuetriggers - packages - timetriggers verbs: @@ -54,18 +35,6 @@ rules: - update - patch - delete -- apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - apiGroups: - rbac.authorization.k8s.io resources: @@ -84,3 +53,11 @@ rules: - clusterroles verbs: - bind +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch \ No newline at end of file diff --git a/cmd/fission-bundle/mqtrigger/mqtrigger.go b/cmd/fission-bundle/mqtrigger/mqtrigger.go index 0ea06c66..7448eac0 100644 --- a/cmd/fission-bundle/mqtrigger/mqtrigger.go +++ b/cmd/fission-bundle/mqtrigger/mqtrigger.go @@ -41,7 +41,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error { return errors.Wrap(err, "failed to get fission or kubernetes client") } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/pkg/buildermgr/buildermgr.go b/pkg/buildermgr/buildermgr.go index b94cbbd6..ecccafda 100644 --- a/pkg/buildermgr/buildermgr.go +++ b/pkg/buildermgr/buildermgr.go @@ -42,7 +42,7 @@ func Start(ctx context.Context, logger *zap.Logger, storageSvcUrl string, envBui return errors.Wrap(err, "failed to get fission or kubernetes client") } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/pkg/buildermgr/envwatcher.go b/pkg/buildermgr/envwatcher.go index 7925316a..b4046b0b 100644 --- a/pkg/buildermgr/envwatcher.go +++ b/pkg/buildermgr/envwatcher.go @@ -505,7 +505,7 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env }, Spec: apiv1.PodSpec{ Containers: []apiv1.Container{*container}, - ServiceAccountName: "fission-builder", + ServiceAccountName: fv1.FissionBuilderSA, }, } diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go index 9dd3ac0c..d34ddb1d 100644 --- a/pkg/controller/controller.go +++ b/pkg/controller/controller.go @@ -37,7 +37,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, unitTestFlag bool) cLogger.Fatal("failed to find fission CRDs", zap.Error(err)) } - err = crd.WaitForCRDs(ctx, fc) + err = crd.WaitForCRDs(ctx, logger, fc) if err != nil { cLogger.Fatal("error waiting for CRDs", zap.Error(err)) } diff --git a/pkg/crd/client.go b/pkg/crd/client.go index 76a2890c..e77e33b3 100644 --- a/pkg/crd/client.go +++ b/pkg/crd/client.go @@ -22,6 +22,7 @@ import ( "os" "time" + "go.uber.org/zap" apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/client-go/dynamic" @@ -88,7 +89,8 @@ func MakeFissionClient() (versioned.Interface, kubernetes.Interface, apiextensio } // WaitForCRDs does a timeout to check if CRDs have been installed -func WaitForCRDs(ctx context.Context, fissionClient versioned.Interface) error { +func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error { + logger.Info("Waiting for CRDs to be installed") start := time.Now() for { fi := fissionClient.CoreV1().Functions(metav1.NamespaceDefault) diff --git a/pkg/executor/executor.go b/pkg/executor/executor.go index 59f02300..f3ec9741 100644 --- a/pkg/executor/executor.go +++ b/pkg/executor/executor.go @@ -259,7 +259,7 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st return errors.Wrap(err, "failed to get kubernetes client") } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/pkg/executor/executor_test.go b/pkg/executor/executor_test.go index 7a3a43ac..69479338 100644 --- a/pkg/executor/executor_test.go +++ b/pkg/executor/executor_test.go @@ -149,7 +149,7 @@ func TestExecutor(t *testing.T) { log.Panicf("failed to ensure crds: %v", err) } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { log.Panicf("failed to wait crds: %v", err) } diff --git a/pkg/executor/executortype/newdeploy/newdeploy.go b/pkg/executor/executortype/newdeploy/newdeploy.go index 069de80c..c4f0f9e6 100644 --- a/pkg/executor/executortype/newdeploy/newdeploy.go +++ b/pkg/executor/executortype/newdeploy/newdeploy.go @@ -273,7 +273,7 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function }, Spec: apiv1.PodSpec{ Containers: []apiv1.Container{*container}, - ServiceAccountName: "fission-fetcher", + ServiceAccountName: fv1.FissionFetcherSA, TerminationGracePeriodSeconds: &gracePeriodSeconds, }, } diff --git a/pkg/executor/executortype/poolmgr/gp_deployment.go b/pkg/executor/executortype/poolmgr/gp_deployment.go index a1f68cea..2ec24b4c 100644 --- a/pkg/executor/executortype/poolmgr/gp_deployment.go +++ b/pkg/executor/executortype/poolmgr/gp_deployment.go @@ -142,7 +142,7 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme }, Spec: apiv1.PodSpec{ Containers: []apiv1.Container{*container}, - ServiceAccountName: "fission-fetcher", + ServiceAccountName: fv1.FissionFetcherSA, // TerminationGracePeriodSeconds should be equal to the // sleep time of preStop to make sure that SIGTERM is sent // to pod after 6 mins. diff --git a/pkg/kubewatcher/main.go b/pkg/kubewatcher/main.go index f0249fad..6dc3afa4 100644 --- a/pkg/kubewatcher/main.go +++ b/pkg/kubewatcher/main.go @@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error { return errors.Wrap(err, "failed to get fission or kubernetes client") } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/pkg/mqtrigger/scalermanager.go b/pkg/mqtrigger/scalermanager.go index 80068c6b..e40e7dbd 100644 --- a/pkg/mqtrigger/scalermanager.go +++ b/pkg/mqtrigger/scalermanager.go @@ -154,7 +154,7 @@ func StartScalerManager(ctx context.Context, logger *zap.Logger, routerURL strin if err != nil { return err } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/pkg/router/router.go b/pkg/router/router.go index 2f9bd6be..55608977 100644 --- a/pkg/router/router.go +++ b/pkg/router/router.go @@ -95,7 +95,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, executorURL string logger.Fatal("error connecting to kubernetes API", zap.Error(err)) } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { logger.Fatal("error waiting for CRDs", zap.Error(err)) } diff --git a/pkg/timer/main.go b/pkg/timer/main.go index ecae3784..75a6132f 100644 --- a/pkg/timer/main.go +++ b/pkg/timer/main.go @@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error { return errors.Wrap(err, "failed to get fission or kubernetes client") } - err = crd.WaitForCRDs(ctx, fissionClient) + err = crd.WaitForCRDs(ctx, logger, fissionClient) if err != nil { return errors.Wrap(err, "error waiting for CRDs") } diff --git a/test/kind_CI.sh b/test/kind_CI.sh index 92199bf0..798159dd 100755 --- a/test/kind_CI.sh +++ b/test/kind_CI.sh @@ -53,7 +53,7 @@ echo "Successfully pull env and builder images" export FAILURES=0 main() { set +e - export TIMEOUT=1200 # 20 minutes per test + export TIMEOUT=900 # 15 minutes per test # run tests without newdeploy in parallel. export JOBS=6 source $ROOT/test/run_test.sh \