* Add DISABLE_OWNER_REFERENCES env variable to executor and buildermgr deployment.
Use this env var to decide adding ownerReferences to K8s resources created by fission CRD.
* Resolve review comments
* Fix lint failure
---------
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
the FISSION_..._NAMESPACE environment variables are used by all services during init
to check if the CRDs are loaded.
Move them to the 'fission-resource-namespace' macro to ensure all services know the relavant namespaces.
Signed-off-by: Anthony King <anthony@datapane.com>
* create roles for custom resource in function and builder namespace
* Create roles for CR for builder in function and builder namespace
* convert warn to info to remove error stack trace
* service account changes for fission-builder
* moved code into executor
* changed default timing to 30 min
* code refactor and add new roles for executor
* create role if serviceAccountCheck is enabled
* Replace all cluster roles with autogenerated namespaced roles
* Use cluster role only for preupgrade api extension permissions
* Correct role definition typos
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
Currently, we create Fission resources in the default namespace, function-related resources are created in the fission-function namespace, whereas builder resources are created in the fission-builder namespace. This causes confusion for a lot of users.
In this fix, we allow the user to set the function and builder namespace empty so that function and builder resources are created in the same namespace as the function resource always.
If the user desires older behaviour they can functionNamespace and builderNamespace the same previous before the upgrade.
* use default namespace for fission function and builder
* support for existing fission namespaces
* Replace builder and function namespace with template
* Fix namespace creation template
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
* Convert ClusterRoles to Roles for all components for multiple namespaces
* Added templates for rules and role generator to dynamically generate roles for each component
* Fix role-generator component templating
* Enable namespaces variable for preupgradechecks
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
* Separate service accounts for each component
* Permission changes per component
* Fixed fluentbit permissions
* added hooks to pre-upgrade service account and role
* Adjusted hook weights for pre-upgrade hook
* Replaced * with explicit permissions
Added properties to configure object reaper interval, global and specific to exec type.
OBJECT_REAPER_INTERVAL - global
NEWDEPLOY_OBJECT_REAPER_INTERVAL - for new deploy type
CONTAINER_OBJECT_REAPER_INTERVAL - for container type
POOLMGR_OBJECT_REAPER_INTERVAL - for poolmgr
The users can now set the pod spec for builder and fn pods via helm chart.
Currently we have set some default securitycontext for the pods. Before there were no permissions set and the user would by default enter root when kubectl exec into pod. Now the permissions have been set and the user will not be able to access root directory in poolmgr and newdeploy pods.
Following component has been updated with securityContext -
1. buildermgr
2. controller
3. executor
4. kubewatcher
5. router
6. timer
7. storagesvc
* Removed the security context from fetcher as per the offline discussion
* fix helm templating on resources of router deployment
* add resources attribute to other fission deployments
Co-authored-by: crmendes <carlos.mendes@kelvininc.com>
* Change RBAC resource names work for multiple Fission release
* Fetch secret configmap and package cluster role based on the release name
* Remove default namespace hardcoding from helm chart
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Currently default pod termination logs go to /dev/termination-log.
With CI we need to change customize path somewhere to /var/log for
exporting logs with the kind export logs command.
Setting FallbackToLogsOnError as termination policy for skaffold.
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
In Fission CI as well in a couple of scenarios, noticed Fission pods
getting preempted when Function pods are getting created. As both
Fission components and function pods have the same priority class
fission component pods might get preempted. It to be recommended to
set higher priority class for components such as Fission router, executor,
controller so that Fission functioning doesn't get disrupted.
Most of the Fission components work fine with restart except the executor. So
user should set priorityClass for Fission executor.
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
* Sync a few files from fission-all to fission-core chart
* Change values in fission-all chart
We keep the following components by default disabled now, which were enabled by default earlier.
1. nats - Fission Nats integration
2. influxdb - Influxdb and logger component
3. prometheus - Prometheus disabled by default
4. canaryDeployment - Disabled by default
This change reduces the need for a fission-core chart and we can configure
values of fission-all so that it can provide the behaviour of fission-all
as well as fission-core.
* Remove fission-core chart
* Add README in the fission-all chart
* Rename clusterrolebinding fission-crd to fission-cr-admin
* Add icon and sources in helm chart
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
