* Deprecation warning for cross namespace parameters `builderNamespace`, `functionNamespace`
and `disableOwnerReference` flag.
* Do not mention the version
---------
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
* Add DISABLE_OWNER_REFERENCES env variable to executor and buildermgr deployment.
Use this env var to decide adding ownerReferences to K8s resources created by fission CRD.
* Resolve review comments
* Fix lint failure
---------
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
* Run logger as root to allow access to log files from host
* Add to connect part of yaml
* Change fission folder to allow non-root to write
into folder instead
* Configure user ID for logger from helm values.yaml
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
---------
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
Co-authored-by: Mark Retallack <mark.retallack@yunextraffic.com>
* Router failed to create ingress resource in `fission` namespace
```
fission-router has access to create ingress in default namespace.
fission is creating ingress in namespace where fission is installed.
updated the helm chart to give fission-router access to create ingress in release namespace.
```
* Add a todo comment for modifying router's permissions
---------
Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
- Update kubernets version 1.23+
- Update post chart install notes with namespace info
- Update upgrade notes in chart
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
the FISSION_..._NAMESPACE environment variables are used by all services during init
to check if the CRDs are loaded.
Move them to the 'fission-resource-namespace' macro to ensure all services know the relavant namespaces.
Signed-off-by: Anthony King <anthony@datapane.com>
* create roles for custom resource in function and builder namespace
* Create roles for CR for builder in function and builder namespace
* convert warn to info to remove error stack trace
* service account changes for fission-builder
* moved code into executor
* changed default timing to 30 min
* code refactor and add new roles for executor
* create role if serviceAccountCheck is enabled
* Remove cluster role references
* Convert secret/package getter cluster roles to role
* Remove all cluster role binding permissions
* Remove unwanted permission
* Try removing all RBAC-related code
* Remove additional constants
* Add functionality for service account checks
* Restrict permission across services
* Remove package informer factory from the executor
* Revert service account check code for now
* Skip adding roles in place of cluster roles
* Remove additional permission from the router
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
* Replace all cluster roles with autogenerated namespaced roles
* Use cluster role only for preupgrade api extension permissions
* Correct role definition typos
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
We enable security context by default now, so that the fission pod do not have root access to the system.
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
* handle error condition in fission fn log command
* use the single stream for log exclude fetcher logs
* add all pods in the fn logs command
* update the previous stable version
* remove proxy to the controller for influxdb call
* stop running controller if influxdb flag turned true
* port-forward for influx DB
* remove controller dependency from test case
* port forward to influx DB if URL not provided by the user
* archive pruner test
