Remove unwanted permissions from Fission components (#2568)

* Remove unwanted permissions from Fission components
* Remove unwanted permission from buildermgr
* Remove rbac permissions from controller
* Remove unwanted namespace permission
* Remove unwanted fission resource permissions
* Add deployment list permission for buildermgr
* add deployment create permission for buildermgr
* Update action version
* Add rolebinding permission for buildermanager
* Reduce permissions for fetcher and builder components
* Aded deployment delete permission to buildermgr
* Add logger to wait crds function
* Revert "Grant CustomResourcedefintion read permission to specific components (#2567)"

This reverts commit 8fe62b755c.

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

charts/fission-all/templates/buildermgr/clusterrole.yaml

@@ -8,12 +8,8 @@ rules:
   resources:
   - configmaps
   - pods
-  - secrets
   - services
   - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
   - create
   - delete
@@ -25,39 +21,24 @@ rules:
   - apps
   resources:
   - deployments
-  - deployments/scale
-  - replicasets
   verbs:
+  - list
   - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
   verbs:
   - create
   - get

charts/fission-all/templates/controller/clusterrole.yaml

@@ -6,41 +6,39 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - pods
-  - secrets
   - services
-  - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
-  - create
-  - delete
-  - get
   - list
-  - watch
-  - patch
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
-  - deployments/scale
-  - replicasets
+  - configmaps
+  - secrets
   verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
@@ -60,21 +58,3 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/executor/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -35,17 +34,20 @@ rules:
   - update
   - patch
   - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
   verbs:
   - create
   - get

charts/fission-all/templates/kubewatcher/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,20 +20,6 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - batch
   resources:
@@ -44,28 +29,20 @@ rules:
   - list
   - watch
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,57 +4,25 @@ metadata:
   name: {{ .Release.Name }}-fission-fetcher
   namespace: {{ .Values.defaultNamespace }}
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -62,9 +30,34 @@ metadata:
   namespace: {{ .Values.functionNamespace }}
   name: {{ .Release.Name }}-event-fetcher
 rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -11,22 +11,6 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -41,3 +25,17 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}

charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/mqt-keda/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml

@@ -13,6 +13,8 @@ rules:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:

charts/fission-all/templates/router/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,20 +20,6 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -48,28 +33,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - httptriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/timer/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,29 +20,11 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
   - timetriggers
   verbs:
@@ -54,18 +35,6 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -84,3 +53,11 @@ rules:
   - clusterroles
   verbs:
   - bind
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch