Remove unwanted permissions from Fission components (#2568)

* Remove unwanted permissions from Fission components
* Remove unwanted permission from buildermgr
* Remove rbac permissions from controller
* Remove unwanted namespace permission
* Remove unwanted fission resource permissions
* Add deployment list permission for buildermgr
* add deployment create permission for buildermgr
* Update action version
* Add rolebinding permission for buildermanager
* Reduce permissions for fetcher and builder components
* Aded deployment delete permission to buildermgr
* Add logger to wait crds function
* Revert "Grant CustomResourcedefintion read permission to specific components (#2567)"

This reverts commit 8fe62b755c.

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

.github/workflows/push_pr.yaml

@@ -82,7 +82,7 @@ jobs:
           skaffold version
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
         with:
           install-only: true
 
@@ -130,7 +130,7 @@ jobs:
 
       - name: Archive fission dump
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
@@ -138,7 +138,7 @@ jobs:
 
       - name: Archive kind logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*

.github/workflows/upgrade_test.yaml

@@ -55,7 +55,7 @@ jobs:
           version: ${{ env.KIND_VERSION }}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
         with:
           install-only: true
 
@@ -101,7 +101,7 @@ jobs:
 
       - name: Archive fission dump
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: fission-dump
           path: fission-dump/*.zip
@@ -109,7 +109,7 @@ jobs:
 
       - name: Archive kind logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*

charts/fission-all/templates/buildermgr/clusterrole.yaml

@@ -8,12 +8,8 @@ rules:
   resources:
   - configmaps
   - pods
-  - secrets
   - services
   - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
   - create
   - delete
@@ -25,39 +21,24 @@ rules:
   - apps
   resources:
   - deployments
-  - deployments/scale
-  - replicasets
   verbs:
+  - list
   - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
   verbs:
   - create
   - get

charts/fission-all/templates/controller/clusterrole.yaml

@@ -6,41 +6,39 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - pods
-  - secrets
   - services
-  - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
-  - create
-  - delete
-  - get
   - list
-  - watch
-  - patch
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
-  - deployments/scale
-  - replicasets
+  - configmaps
+  - secrets
   verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
@@ -60,21 +58,3 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/executor/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -35,17 +34,20 @@ rules:
   - update
   - patch
   - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
   verbs:
   - create
   - get

charts/fission-all/templates/kubewatcher/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,20 +20,6 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - batch
   resources:
@@ -44,28 +29,20 @@ rules:
   - list
   - watch
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,57 +4,25 @@ metadata:
   name: {{ .Release.Name }}-fission-fetcher
   namespace: {{ .Values.defaultNamespace }}
 rules:
-  - apiGroups:
+- apiGroups:
   - ""
   resources:
   - configmaps
   - secrets
-      - pods
   verbs:
   - get
-      - list
-      - watch
-  - apiGroups:
+- apiGroups:
   - ""
   resources:
-      - events
+  - pods
   verbs:
-      - "*"
-  - apiGroups:
+  - list
+- apiGroups:
   - fission.io
   resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
   - packages
-      - timetriggers
   verbs:
-      - "*"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+  - "get"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -62,9 +30,34 @@ metadata:
   namespace: {{ .Values.functionNamespace }}
   name: {{ .Release.Name }}-event-fetcher
 rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -11,22 +11,6 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -41,3 +25,17 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}

charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/mqt-keda/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml

@@ -13,6 +13,8 @@ rules:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:

charts/fission-all/templates/router/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,20 +20,6 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -48,28 +33,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - httptriggers
+  - packages
   verbs:
   - create
   - get

charts/fission-all/templates/timer/clusterrole.yaml

@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,29 +20,11 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
   - timetriggers
   verbs:
@@ -54,18 +35,6 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -84,3 +53,11 @@ rules:
   - clusterroles
   verbs:
   - bind
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch

cmd/fission-bundle/mqtrigger/mqtrigger.go

@@ -41,7 +41,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

pkg/buildermgr/buildermgr.go

@@ -42,7 +42,7 @@ func Start(ctx context.Context, logger *zap.Logger, storageSvcUrl string, envBui
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

pkg/buildermgr/envwatcher.go

@@ -505,7 +505,7 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
 		},
 		Spec: apiv1.PodSpec{
 			Containers:         []apiv1.Container{*container},
-			ServiceAccountName: "fission-builder",
+			ServiceAccountName: fv1.FissionBuilderSA,
 		},
 	}
 

pkg/controller/controller.go

@@ -37,7 +37,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, unitTestFlag bool)
 		cLogger.Fatal("failed to find fission CRDs", zap.Error(err))
 	}
 
-	err = crd.WaitForCRDs(ctx, fc)
+	err = crd.WaitForCRDs(ctx, logger, fc)
 	if err != nil {
 		cLogger.Fatal("error waiting for CRDs", zap.Error(err))
 	}

pkg/crd/client.go

@@ -22,6 +22,7 @@ import (
 	"os"
 	"time"
 
+	"go.uber.org/zap"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/dynamic"
@@ -88,7 +89,8 @@ func MakeFissionClient() (versioned.Interface, kubernetes.Interface, apiextensio
 }
 
 // WaitForCRDs does a timeout to check if CRDs have been installed
-func WaitForCRDs(ctx context.Context, fissionClient versioned.Interface) error {
+func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error {
+	logger.Info("Waiting for CRDs to be installed")
 	start := time.Now()
 	for {
 		fi := fissionClient.CoreV1().Functions(metav1.NamespaceDefault)

pkg/executor/executor.go

@@ -259,7 +259,7 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st
 		return errors.Wrap(err, "failed to get kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

pkg/executor/executor_test.go

@@ -149,7 +149,7 @@ func TestExecutor(t *testing.T) {
 		log.Panicf("failed to ensure crds: %v", err)
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		log.Panicf("failed to wait crds: %v", err)
 	}

pkg/executor/executortype/newdeploy/newdeploy.go

@@ -273,7 +273,7 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
 		},
 		Spec: apiv1.PodSpec{
 			Containers:                    []apiv1.Container{*container},
-			ServiceAccountName:            "fission-fetcher",
+			ServiceAccountName:            fv1.FissionFetcherSA,
 			TerminationGracePeriodSeconds: &gracePeriodSeconds,
 		},
 	}

pkg/executor/executortype/poolmgr/gp_deployment.go

@@ -142,7 +142,7 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme
 		},
 		Spec: apiv1.PodSpec{
 			Containers:         []apiv1.Container{*container},
-			ServiceAccountName: "fission-fetcher",
+			ServiceAccountName: fv1.FissionFetcherSA,
 			// TerminationGracePeriodSeconds should be equal to the
 			// sleep time of preStop to make sure that SIGTERM is sent
 			// to pod after 6 mins.

pkg/kubewatcher/main.go

@@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

pkg/mqtrigger/scalermanager.go

@@ -154,7 +154,7 @@ func StartScalerManager(ctx context.Context, logger *zap.Logger, routerURL strin
 	if err != nil {
 		return err
 	}
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

pkg/router/router.go

@@ -95,7 +95,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, executorURL string
 		logger.Fatal("error connecting to kubernetes API", zap.Error(err))
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		logger.Fatal("error waiting for CRDs", zap.Error(err))
 	}

pkg/timer/main.go

@@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}

test/kind_CI.sh

@@ -53,7 +53,7 @@ echo "Successfully pull env and builder images"
 export FAILURES=0
 main() {
     set +e
-    export TIMEOUT=1200  # 20 minutes per test
+    export TIMEOUT=900  # 15 minutes per test
     # run tests without newdeploy in parallel.
     export JOBS=6
     source $ROOT/test/run_test.sh \