Remove unwanted permissions from Fission components (#2568)

* Remove unwanted permissions from Fission components
* Remove unwanted permission from buildermgr
* Remove rbac permissions from controller
* Remove unwanted namespace permission
* Remove unwanted fission resource permissions
* Add deployment list permission for buildermgr
* add deployment create permission for buildermgr
* Update action version
* Add rolebinding permission for buildermanager
* Reduce permissions for fetcher and builder components
* Aded deployment delete permission to buildermgr
* Add logger to wait crds function
* Revert "Grant CustomResourcedefintion read permission to specific components (#2567)"

This reverts commit 8fe62b755c.

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,57 +4,25 @@ metadata:
   name: {{ .Release.Name }}-fission-fetcher
   namespace: {{ .Values.defaultNamespace }}
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -62,9 +30,34 @@ metadata:
   namespace: {{ .Values.functionNamespace }}
   name: {{ .Release.Name }}-event-fetcher
 rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -11,22 +11,6 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -41,3 +25,17 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}