docs: add custom fork header to README (multi-tenant by Naeel/ngcloud)

Fixes EnsureNamespaceSA getting 403 Forbidden when provisioning fission-fetcher
SA in dynamically registered namespaces. Adds ClusterRole + ClusterRoleBinding
with create/update/patch for serviceaccounts, roles, rolebindings.

Also adds doc/progress.md and doc/thinking/2026-04-26-rbac-fix.md.

.codecov.yml

@@ -0,0 +1,13 @@
+ignore:
+  - "charts"
+  - "test/"
+  - "tools"
+  - "pkg/generated" # generated code
+  - "pkg/apis/*/*/zz_generated*" # generated code
+coverage:
+  status:
+    project:
+      default:
+        threshold: 2
+    # Disable patch coverage check since we focus on project coverage.
+    patch: off

.dockerignore

@@ -0,0 +1,15 @@
+*.md
+*.sh
+Documentation
+charts
+examples
+environments/*
+!environments/fetcher
+demos
+test
+Makefile
+LICENSE
+glide.*
+.travis.yml
+.gitignore
+.git

.github/ISSUE_TEMPLATE/blog.md

@@ -0,0 +1,10 @@
+---
+name: Blog
+about: Suggest a blog
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,46 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!-- Please answer these questions before submitting your issue. Thanks! -->
+
+<!-- Documentation URL: https://fission.io/docs -->
+<!-- Troubleshooting guide: https://fission.io/docs/trouble-shooting/ -->
+
+**Fission/Kubernetes version**
+
+<!-- If you tested with other services, for example Istio, please also provide the version of service as well. -->
+
+<pre>
+$ fission version
+$ kubectl version
+</pre>
+
+**Kubernetes platform (e.g. Google Kubernetes Engine)**
+
+**Describe the bug**
+<!--A clear and concise description of what the bug is.-->
+
+**To Reproduce**
+
+<!-- Please provide steps for reproducing the error. -->
+
+**Expected result**
+<!--A clear and concise description of what you expected to happen.-->
+
+**Actual result**
+
+**Screenshots/Dump file**
+<!--If applicable, add screenshots/fission dump file to help explain your problem.-->
+
+<pre>
+$ fission support dump
+</pre>
+
+**Additional context**
+<!--Add any other context about the problem here.-->

.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,10 @@
+---
+name: Documentation
+about: Suggest changes/addition to documentation
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe something that is unclear or not documented and needs a documentation update

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+<!--  Thanks for sending a pull request! We request you provide detailed description as much as possible. -->
+
+## Description
+<!--- Describe your changes in detail. -->
+<!-- Typically try to give details of what, why and how of the PR changes. -->
+
+## Which issue(s) this PR fixes:
+<!--
+*Automatically closes linked issue when PR is merged.
+Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
+-->
+Fixes #
+
+## Testing
+<!--- Please describe in detail how you tested your changes. -->
+
+## Checklist:
+<!-- Please tick following checkboxes as per your understanding. -->
+- [ ] I ran tests as well as code linting locally to verify my changes. 
+- [ ] I have done manual verification of my changes, changes working as expected.
+- [ ] I have added new tests to cover my changes.
+- [ ] My changes follow contributing guidelines of Fission.
+- [ ] I have signed all of my commits.

.github/dependabot.yml

@@ -0,0 +1,62 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /cmd/builder
+      - /cmd/fetcher
+      - /cmd/fission-bundle
+      - /cmd/preupgradechecks
+      - /cmd/reporter
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    exclude-paths:
+      - "test/**"
+    groups:
+      docker-images:
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    exclude-paths:
+      - "test/**"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: helm
+    directory: /charts/fission-all
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      helm-charts:
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    exclude-paths:
+      - "test/**"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"

.github/workflows/codeql.yaml

@@ -0,0 +1,50 @@
+name: Code Scanning
+
+on:
+  push:
+    branches:
+      - main
+      - '!dependabot/**'
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 0 * * 0"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  CodeQL-Build:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    runs-on: ubuntu-24.04
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: setup go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        with:
+          languages: go
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8

.github/workflows/dependency-review.yml

@@ -0,0 +1,31 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.github/workflows/lint-dashboards.yaml

@@ -0,0 +1,37 @@
+name: Lint dashboards
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'charts/fission-all/dashboards/**.json'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'charts/fission-all/dashboards/**.json'
+
+permissions:
+  contents: read
+
+jobs:
+  lint-dashboards:
+    runs-on: ubuntu-24.04
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+
+      - name: Run dashboard linter
+        run: ./hack/lint-dashboards.sh

.github/workflows/lint.yaml

@@ -0,0 +1,83 @@
+name: Lint and Unit tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+
+env:
+  GOLANGCI_LINT_VERSION: v2.6.2
+  GOLANGCI_LINT_TIMEOUT: 5m
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-24.04
+    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Verify dependencies
+        run: |
+          go mod verify
+          go mod download
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          skip-cache: true
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          args: --timeout=${{ env.GOLANGCI_LINT_TIMEOUT }}
+
+      - name: Detect git changes
+        if: always()
+        run: |
+          if [[ $(git diff --stat) != '' ]]; then
+            echo -e '❌ \033[0;31m. Fix lint changes.\033[0m'
+            git diff --color
+            exit 1
+          else
+            echo '✔ No issues detected. Have a nice day :-)'
+          fi
+
+      - name: Run unit tests
+        run: ./hack/runtests.sh
+
+      - name: Upload Coverage report to CodeCov
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: unittests
+          file: ./coverage.txt

.github/workflows/push_pr.yaml

@@ -0,0 +1,334 @@
+name: Fission CI
+
+on:
+  push:
+    branches:
+      - main
+      - '!dependabot/**'
+    paths:
+      - "**.go"
+      - "charts/**"
+      - "test/**"
+      - go.mod
+      - go.sum
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "charts/**"
+      - "test/**"
+      - go.mod
+      - go.sum
+
+env:
+  HELM_VERSION: v4.0.1
+  KIND_VERSION: v0.30.0
+  KIND_CLUSTER_NAME: kind
+  SKAFFOLD_VERSION: v2.17.0
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Job to run change detection
+  integration-test:
+    runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.28.15", "v1.32.8", "v1.34.0"]
+        os: [ubuntu-24.04]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout sources
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: setup go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.31.12"]
+        os: [ubuntu-24.04]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout sources
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: setup go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.github/workflows/release.yaml

@@ -0,0 +1,202 @@
+name: Create Draft release
+on:
+  push:
+    tags:
+      - v1.**
+      - v2.**
+
+env:
+  KIND_VERSION: v0.30.0
+  KIND_NODE_IMAGE_TAG: v1.28.15
+  KIND_CLUSTER_NAME: kind
+  COSIGN_VERSION: v3.0.3
+
+jobs:
+  create-draft-release:
+    name: Create Draft Release with Goreleaser
+    outputs:
+      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
+      version: ${{ steps.get_version.outputs.VERSION }}
+    permissions:
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
+      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
+      id-token: write # for cosign to sign the image and binary
+      attestations: write # for goreleaser/goreleaser-action to upload attestations
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Kind Cluster
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
+        with:
+          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
+          version: ${{ env.KIND_VERSION }}
+          config: kind.yaml
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Check cosign install!
+        run: cosign version
+
+      - uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 #v0.20.11
+
+      - name: Generate yaml for manifest, Minikube and Openshift installation
+        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
+        env:
+          VERSION: ${{ steps.get_version.outputs.VERSION }}
+        shell: bash
+
+      - name: Run GoReleaser
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          version: "~> v2"
+          args: release
+        env:
+          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKER_CLI_EXPERIMENTAL: "enabled"
+
+      # Attest binary artifacts
+      # https://goreleaser.com/customization/attestations/
+      - name: Attest binary artifacts
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-checksums: ./dist/checksums.txt
+
+      - name: Image digest
+        id: image
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Image") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
+            split("\n")
+            | map(select(. != ""))
+            | map(
+                split("@")
+                | {
+                    "image": .[0] | split(":")[0],
+                    "checksum": .[1]
+                  }
+              )')
+          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"
+
+  image-sbom-provenance-ghcr:
+    name: Create SBOM & Provenance for container images
+    # Goreleaser does not support generating SBOM for container images.
+    needs: [create-draft-release]
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: write
+      id-token: write
+      packages: write
+      attestations: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Trivy in fs mode to generate SBOM
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        with:
+          scan-type: "fs"
+          format: "spdx-json"
+          output: "sbom.spdx.json"
+      - name: Attest SBOM for image
+        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3.0.0
+        with:
+          sbom-path: sbom.spdx.json
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true
+      - name: Attest provenance for image
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true
+
+  image-provenance-verification-with-cosign:
+    name: Verify Image Provenance
+    needs: [create-draft-release, image-sbom-provenance-ghcr]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    runs-on: ubuntu-24.04
+    permissions: read-all
+    steps:
+      - name: Login
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Verify image
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          echo "Verifying $IMAGE@$DIGEST"
+          cosign verify-attestation \
+             --type https://slsa.dev/provenance/v1 \
+             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+             --certificate-identity-regexp '^https://github.com/fission/fission/.github/workflows/release.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(?:-rc[0-9]+)?$' \
+             $IMAGE@$DIGEST

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '41 18 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-24.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        with:
+          sarif_file: results.sarif

.github/workflows/upgrade_test.yaml

@@ -0,0 +1,133 @@
+name: Fission CI upgrade
+
+on:
+  push:
+    branches:
+      - main
+      - '!dependabot/**'
+    paths:
+      - "**.go"
+      - "charts/**"
+      - "test/**"
+      - go.mod
+      - go.sum
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "charts/**"
+      - "test/**"
+      - go.mod
+      - go.sum
+
+env:
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.30.0
+  KIND_CLUSTER_NAME: kind
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-upgrade-test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  upgrade-test:
+    runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.31.12"]
+        os: [ubuntu-24.04]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout action sources
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Setup go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Setup Helm
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Setup Kind Cluster
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Setup kubectl & fetch node information
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          kubectl get storageclasses.storage.k8s.io
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config set-context --current --namespace=default
+          kubectl config view
+
+      - name: Dump system info
+        run: |
+          source ./test/upgrade_test/fission_objects.sh dump_system_info
+
+      - name: Install and configure previous stable fission
+        run: |
+          source ./test/upgrade_test/fission_objects.sh install_stable_release \
+          && create_fission_objects \
+          && test_fission_objects
+
+      - name: Upgrade fission to latest
+        run: |
+          source ./test/upgrade_test/fission_objects.sh build_docker_images \
+          && kind_image_load \
+          && install_current_release \
+          && install_fission_cli
+
+      - name: Test previously created fission objects with new release
+        timeout-minutes: 10
+        run: |
+          source ./test/upgrade_test/fission_objects.sh test_fission_objects
+
+      - name: Collect Fission Dump
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        if: ${{ always() }}
+        run: |
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Archive fission dump
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive kind logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.gitignore

@@ -1,13 +1,43 @@
-fission-bundle/fission-bundle
+# Binaries
+cmd/fission-bundle/fission-bundle
+cmd/fission-cli/fission
+cmd/fission-cli/fission-cli
+cmd/fetcher/fetcher
+cmd/builder/builder
+cmd/preupgradechecks/pre-upgrade-checks
+cmd/reporter/reporter
+
+# Logs
+test/logs/
+test/e2e/cli/fission-dump/
+
 # Pycharm IDE
 .idea
 environments/php7/vendor/
 
+# terraform files
+.terraform/
+*.tfstate
+*.backup
+
 # Common backup files
 *.swp
 *.bak
 *.tmp
 *~
+*.tgz
 
+.DS_Store
 vendor/
-local/
+local/
+
+build/
+dist/
+manifest/
+.vscode/
+coverage.txt
+
+cosign.key
+
+# Dumps
+.dumps/

.golangci.yaml

@@ -0,0 +1,51 @@
+version: "2"
+linters:
+  enable:
+    - errcheck
+    - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    - promlinter
+    - unconvert
+    - unused
+    - staticcheck
+  settings:
+    errcheck:
+      exclude-functions:
+        - (*go.uber.org/zap.Logger).Sync
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+    rules:
+      - linters:
+        - staticcheck
+        text: "QF1008"
+      - linters:
+          - staticcheck
+        text: "QF1001"
+      - linters:
+          - staticcheck
+        text: "QF1003"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/fission/fission
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yml

@@ -0,0 +1,203 @@
+version: 2
+
+env:
+  - GHCR_REPO=ghcr.io/fission
+
+project_name: fission
+release:
+  github:
+    owner: fission
+    name: fission
+  prerelease: "true"
+  draft: true
+  header: |
+    Release Highlights: https://fission.io/docs/releases/{{ .Tag }}/
+    Install Guide: https://fission.io/docs/installation/
+  extra_files:
+    - glob: ./manifest/charts/*
+    - glob: ./manifest/yamls/*
+
+before:
+  hooks:
+    - go mod tidy
+snapshot:
+  version_template: "{{ .Tag }}"
+builds:
+  - &build-linux
+    id: builder
+    ldflags:
+      - -s -w
+      - -X github.com/fission/fission/pkg/info.GitCommit={{.ShortCommit}}
+      - -X github.com/fission/fission/pkg/info.BuildDate={{.Date}}
+      - -X github.com/fission/fission/pkg/info.Version={{.Tag}}
+    gcflags:
+      - all=-trimpath={{ if index .Env "GITHUB_WORKSPACE"}}{{ .Env.GITHUB_WORKSPACE }}{{ else }}{{ .Env.PWD }}{{ end }}
+    asmflags:
+      - all=-trimpath={{ if index .Env "GITHUB_WORKSPACE"}}{{ .Env.GITHUB_WORKSPACE }}{{ else }}{{ .Env.PWD }}{{ end }}
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    binary: builder
+    dir: ./cmd/builder
+  - <<: *build-linux
+    id: fetcher
+    binary: fetcher
+    dir: ./cmd/fetcher
+  - <<: *build-linux
+    id: fission-bundle
+    binary: fission-bundle
+    dir: ./cmd/fission-bundle
+  - <<: *build-linux
+    id: fission-cli
+    goos:
+      - linux
+      - windows
+      - darwin
+    binary: fission
+    dir: ./cmd/fission-cli
+    ignore:
+      - goos: windows
+        goarch: arm64
+  - <<: *build-linux
+    id: pre-upgrade-checks
+    binary: pre-upgrade-checks
+    dir: ./cmd/preupgradechecks
+  - <<: *build-linux
+    id: reporter
+    binary: reporter
+    dir: ./cmd/reporter
+dockers_v2:
+  - id: builder
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/builder"
+    labels:
+      org.opencontainers.image.description: "The builder assists in building the fission function source code for deployment."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
+    dockerfile: cmd/builder/Dockerfile
+  - id: fetcher
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/fetcher"
+    labels:
+      org.opencontainers.image.description: "Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
+    dockerfile: cmd/fetcher/Dockerfile
+  - id: fission-bundle
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/fission-bundle"
+    labels:
+      org.opencontainers.image.description: "fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
+    dockerfile: cmd/fission-bundle/Dockerfile
+  - id: pre-upgrade-checks
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks"
+    labels:
+      org.opencontainers.image.description: "Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+  - id: reporter
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/reporter"
+    labels:
+      org.opencontainers.image.description: "The reporter gathers information that assists in improving fission."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
+    dockerfile: cmd/reporter/Dockerfile
+changelog:
+  disable: true
+archives:
+  - id: fission
+    ids:
+      - fission-cli
+    name_template: "{{ .ProjectName }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
+    formats:
+      - binary
+checksum:
+  name_template: "checksums.txt"
+docker_digest:
+  name_template: "docker-digests.txt"
+
+# signs the checksum file
+# https://goreleaser.com/customization/sign
+signs:
+  - id: cosign-binary
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    signature: "${artifact}.sig.bundle"
+    cmd: cosign
+    artifacts: all
+    args:
+      - sign-blob
+      - "--bundle=${signature}"
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+# signs our docker image
+# https://goreleaser.com/customization/docker_sign
+docker_signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: all
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+sboms:
+  - artifacts: archive
+    id: archive
+  - artifacts: source
+    id: source
+  - artifacts: binary
+    id: binary
+  - artifacts: package
+    id: package

.mergify.yml

@@ -0,0 +1,17 @@
+pull_request_rules:
+  - name: Automatic merge on approval
+    conditions:
+      - base=main
+      - "#approved-reviews-by>=1"
+      - label=ready-to-merge
+      - label!=hold-off-merging
+      - check-success=CodeQL-Build
+      - check-success=CodeQL
+      - check-success=lint 
+      - check-success=upgrade-test (kindest/node:v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.25.11, ubuntu-latest)
+      - check-success=integration-test (v1.27.3, ubuntu-latest)
+    actions:
+      merge:
+        method: squash

.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace

.travis.yml

@@ -1,34 +0,0 @@
-sudo: required
-
-dist: trusty
-
-language: go
-
-go:
-  - 1.8
-
-cache:
-  directories:
-    - $HOME/google-cloud-sdk/
-    - $HOME/k8scli
-
-install:
-  - go get github.com/Masterminds/glide
-  - hack/travis-kube-setup.sh
-
-env:
-  - KUBECONFIG=${HOME}/.kube/config PATH=$HOME/k8scli:${PATH}
-
-script:
-  - cd ${TRAVIS_BUILD_DIR}
-  - glide install
-  - ./fission-bundle/build.sh
-  - hack/verify-gofmt.sh
-  - hack/runtests.sh
-  - test/build_and_test.sh
-
-notifications:
-  slack:
-    secure: YZ34vsfw1TtftJypg1MyP4+ihONI4gaxeS3FghBQli6+EezjzcxOXyj5VD+x0ucXfDeTaDrFfmVN0SAGObOoZUE+ea9KAoTo50tRLaD9kwOTACiekZalC4uuBguH0D1/A6vlbU8dchsr9mvIhbisG6mTncdPtqGYYHtyBQme6ngmmHbVAQFZcIBHmNuDb/HWhSr8KMEuyB6+mBXLYELHnXnf26cOhdGNaagqCOJTiemX85RGwIuOPxyBhKDFMLyHohDT7FJMH/qijveE6YgOYTQC5nYc2Np1KvC7hQkIu4nuyczyYlrNQl/TWv+SVI8PjIs0PYuCuD3gUqoVEi8d94HbrOPzFEpbwDS9P4qL39DGmco1Q56Vqxe6sRI0vDWPb5gCP1lSgs3PMECVn7Wor/pTvcL+C+U2jLwWJUl0vbyWCL7ngl/3iTssV7qBpUrI7Oclwp8LrQo9fPj0DL4gE9rNanpEWjQ6yPGaysIL1zLHtRghhm52A22NJGp71jkS2KEpLi6ZWFYjMeuXw5eOQFhqFlzyRJOmLYa3B607TLWuyo2L2CxAfMmq0FGfemvrkLZIWtlQKK4y9ImpsURwaGT2XCtThFtHl77wEss913nC+T2dX3O5Bl0UmxFd5S3mVM109I8c4lDosxnAjRfS9MheFlrG0gjSJSBCw57x7f0=
-    on_success: change
-    on_failure: always

CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at codeofconduct@platform9.com. All
+reported by contacting the project team at slack channel. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

CONTRIBUTING.md

@@ -1,46 +1,10 @@
-# Contributing to Fission
 
-### Thank you!
+Thanks for helping make Fission better😍!
 
-Thank you for taking the time and effort to contribute to Fission!
+There are many areas we can use contributions - ranging from code, documentation, feature proposals, issue triage, samples, and content creation. 
 
-First, please read the [code of conduct](CODE_OF_CONDUCT.md).  By
-participating, you're expected to uphold this code.
+First, please read the [code of conduct](CODE_OF_CONDUCT.md). By participating, you're expected to uphold this code.
 
-### Choose something to work on
+Please refer contributing docs for detailed guide.
 
-The easiest way to start is to look at existing
-[issues](https://github.com/fission/fission/issues) and see if there's
-something there that you'd like to work on.
-
-Also, if you're familiar with a language that we don't support today,
-adding an environment for a new language is a good task to take on.
-Take a look at the Python environment as an example.
-
-If you're interested in working on something that doesn't have an
-existing issue, feel free to file a new one.
-
-There's plenty of stuff to do.  If you need help choosing something to
-work on, we'll be happy to suggest something depending on your
-interests.
-
-### Talk to people
-
-At any point, from thinking about contributing to merging your
-changes, please feel free to reach out to us!  We're more than happy
-to talk.
-
-If you choose a big chunk of work that involves design changes to
-Fission, please talk to us while planning the change; that way we can
-all be on the same page before you invest too much work into it.
-
- * Drop by the [slack channel](http://slack.fission.io)
- * Say hi on [twitter](https://twitter.com/fissionio).
- * Email soamvasani@platform9.com
-
-### Contribution Howto
-
- * Fork this github repo
- * Make a branch in your fork
- * Commit your changes to that branch
- * Create a pull request
+[https://fission.io/docs/contributing/](https://fission.io/docs/contributing/)

Compiling.md

@@ -1,55 +0,0 @@
-Compiling Fission
-=================
-
-[You only need to do this if you're making Fission changes; if you're
-just deploying Fission, use fission.yaml which points to prebuilt
-images.]
-
-You'll need the `go` compiler and tools installed, along with the
-[glide dependency management
-tool](https://github.com/Masterminds/glide#install).  You'll also need
-docker for building images.
-
-The server side is compiled as one binary ("fission-bundle") which
-contains controller, poolmgr and router; it invokes the right one
-based on command-line arguments.
-
-To build fission-bundle: clone this repo to
-`$GOPATH/src/github.com/fission/fission`, then from the top level
-directory (if you want to build the image with the docker inside
-minikube, you'll need to set the proper environment variables with
-`eval $(minikube docker-env)`):
-
-```
-  # Get dependencies
-  $ glide install
-
-  # Build fission server and an image
-  $ pushd fission-bundle
-  $ ./build.sh
-```
-
-You now need to build the docker image for fission. You can use
-`push.sh` and push it to a docker hub account. But it's easiest to use
-minikube and its built-in docker daemon:
-
-```
-  $ eval $(minikube docker-env)
-  $ docker build -t minikube/fission-bundle .
-```
-
-Next, install fission on your kubernetes cluster:
-
-```
-  # To install, update fission.yaml to point to the image you just made: "minikube/fission-bundle"
-  $ $EDITOR fission.yaml
-  $ kubectl create -f fission.yaml
-  $ kubectl create -f fission-nodeport.yaml
-```
-
-And if you're changing the CLI too, you can build it with:
-
-```
-  # Build Fission CLI
-  $ cd fission && go install
-```

Documentation/Architecture.md

@@ -1,144 +0,0 @@
-
-A high level view of the internals of Fission.
-
-How it works
-============
-
-Fission is a FaaS -- users create functions (source level), register
-them with fission using a CLI, and associate functions with triggers.
-
-Fission wraps those functions into a service, and runs them on
-Kubernetes on demand.
-
-Here's an overview of the services that make up fission.
-
-Components
-==========
-
-Language-neutral components:
-
- * controller
- * poolmgr
- * router
- * kubewatcher
-
-Language-specific components:
-
- * Environment container
-
-
-Controller
-----------
-
-The controller contains CRUD APIs for functions, http triggers,
-environments, Kubernetes event watches.  This is the component that
-the client talks to.
-
-This is the only stateful component.  It needs to be configured with a
-URL to an etcd cluster and a path to a persistent volume.  The volume
-is used to store the functions' source code.  Etcd is used as the DB.
-
-[Work to extend to other storage backends is planned, see issue #83.]
-
-Pool Manager 
-------------
-
-Poolmgr manages pools of generic containers and function containers.
-
-It has a simple API; both these endpoints are called by the router.
-
-* GetFunctionService takes function metadata and returns the address
-  of a service.
-  
-* TapService lets poolmgr know a service is being used; if it's not
-  called for a few minutes the pod(s) backing the service are killed.
-
-Poolmgr watches the controller API and eagerly creates generic pools
-for environments.  It uses Kubernetes deployments to do that.  The
-environment container runs in a pod with the 'fetcher' container.
-Fetcher is a very simple utility that downloads a URL sent to it and
-saves it at a configured location.
-
-GetFunctionService "specializes" a pod.  The implementation chooses a
-pod from the pool, relabels it to "orphan" the pod from the
-deployment, invokes fetcher to copy the function into the pod, and
-hits the the specialize endpoint on the environment container.  This
-causes the function to be loaded.  The pod is now specific to that
-function.
-
-This function pod is cached; it's cleaned up if it's unused for a few
-minutes.
-
-Router
-------
-
-The router forwards HTTP requests to function pods.  If there's no
-running service for a function, it requests one from poolmgr, while
-holding on to the request; when the function's service is ready it
-forwards the request.
-
-The router is stateless and can be scaled up if needed, according to
-load.
-
-Kubewatcher
------------
-
-Kubewatcher watches the Kubernetes API and invokes functions
-associated with watches, sending the watch event to the function.
-
-The controller keeps track of user's requested watches and associated
-functions.  Kubewatcher watches the API based on these requests; when
-a watch event occurs, it serializes the object and calls the function
-via the router.
-
-While a few simple retries are done, there isn't yet a reliable
-message bus between Kubewatcher and the function.  Work for this is
-tracked in issue #64.
-
-Message Queue Trigger
----------------------
-
-A message queue trigger binds a message queue topic to a function:
-events from that topic cause the function to be invoked with the
-message as the body of the request. The trigger may also contain a
-response topic: if specified, the function's output is sent to this
-response.
-
-Here's a diagram of the components:
-
-![Message queue trigger Diagram](https://user-images.githubusercontent.com/202578/27012344-9457cb24-4f00-11e7-8d6b-926ff01637b3.jpg)
-
-Environment Container
----------------------
-
-Environment containers run user-defined functions.  Environment
-containers are language specific.  They must contain an HTTP server
-and a loader for functions.
-
-Poolmgr deploys the environment container into a pod with fetcher
-(fetcher is a simple utility that can fetch an HTTP url to a file at a
-configured location).  This pod forms a "generic pod", because it can
-be loaded with any function.
-
-When poolmgr needs to create a service for a function, it calls
-fetcher to fetch the function.  Fetcher downloads the function into a
-volume shared between fetcher and this environment container.  Poolmgr
-then requests the container to load the function.
-
-Logger
-------
-
-Logger helps to forward function logs to centralized db service for log
-persistence. Currently only influxdb is supported to store logs.
-Following is a diagram describe how log service works:
-
-![Logger Diagram](https://cloud.githubusercontent.com/assets/202578/23100399/b0e3ea00-f6ba-11e6-8f2f-6588cfef2e84.png)
-
-1. Pool manager choose a pod from pool to execute user function
-2. Pool manager makes a HTTP POST to logger helper, once helper receives 
-the request it creates a symlink to container log for fluentd.
-3. Fluentd reads log from symlink and pipes to influxdb
-4. `fission function logs ...` retrieve event logs from influxdb with 
-optional log filter
-5. Pool manager removes function pod from pool
-6. Pool manager asks logger helper to stop piping logs, logger removes symlink.

Documentation/Roadmap.md

@@ -1,106 +0,0 @@
-# Fission Roadmap
-
-## Function features ([area-func](https://github.com/fission/fission/labels/area-func))
-
-- Secrets, configmaps, env vars
-- Volumes
-- Mem requests and limits
-- Function exec time deadline
-- Expose a regular K8s Service for a function
-
-## Fission API ([area-api](https://github.com/fission/fission/labels/area-api))
-
-- TPR-based controller
-- API authentication
-- Aggregated API server
-
-## Development Workflows ([area-dev](https://github.com/fission/fission/labels/area-dev))
-
-- Function Versioning
-- Versioning for a group of functions
-- Rolling upgrades
-  - for one function
-  - for multiple functions
-  - for functions + other kubernetes deployments
-- Unit testing
-
-## API Gateway / Ingress features ([area-ingress](https://github.com/fission/fission/labels/area-ingress))
-
-- Function authn hooks
-- K8s Ingress flag
-- Bundle an ingress controller?
-
-## Workflows and Function composition ([area-composition](https://github.com/fission/fission/labels/area-composition))
-
-- Simple Composition - Sync
-- Simple Composition - Async
-- Hooks (pre, post, on-error)
-- Workflows
-- Testing in the presence of function composition
-
-## Events ([area-events](https://github.com/fission/fission/labels/area-events))
-
-- NATS
-- Kafka
-- AWS: SNS, SQS
-- Google PubSub
-- RabbitMQ
-- Other event sources
-
-- Bundle an event queue (NATS streaming, most probably)
-
-## Operability ([area-ops](https://github.com/fission/fission/labels/area-ops))
-
-### Fission Install/Upgrade ([area-install](https://github.com/fission/fission/labels/area-install))
-
-- Helm Installer for Fission
-- Helm installation for fission functions
-- CLI installer/upgrader? ("fission upgrade")
-- Upgrade checker/reminder (like minikube does)
-- CLI auto-upgrader
-
-### Function observation ([area-observe](https://github.com/fission/fission/labels/area-observe))
-
-- Function Logging
-- Tracing -- Opentracing
-- Metrics -- Prometheus
-- Function exception tracking
-- Logging function load errors
-- Tracing fission overheads for each function
-
-## Function Security
-
-- Function isolation (is authz hook sufficient or do we need something like mutual TLS?)
-- Function service accounts
-
-## UX, especially for beginners ([area-ux](https://github.com/fission/fission/labels/area-ux))
-
-- Fission CLI should include a tutorial
-- Fission CLI should have a way to drop you into the UI
-- Eliminate FISSION_URL, just use kube client to find fission url.  Also useful to grab credentials.
-
-## Documentation ([area-doc](https://github.com/fission/fission/labels/area-doc))
-
-- Installation guide improvements
-- Troubleshooting guide for common problems
-- FAQ
-- Performance overview
-- Render docs nicely to fission.io
-
-## Web UI (tracked separately in the fission-ui repo)
-
-## Performance and Scalability ([area-perf](https://github.com/fission/fission/labels/area-perf))
-
-- Autoscaling
-- Cold-start optimization -- optimistically choose from pool, save about ~20msec
-- Cold-start optimization -- preload funcs in fetcher
-- Cold-start optimization -- preload libraries in envs (v2) -- mem vs. speed tradeoff
-
-## Function extensibility ([area-ext](https://github.com/fission/fission/labels/area-ext))
-
-- Env v2: easy addition of dependencies etc.
-- Integration with Service Broker
-
-## Multi-area stuff
-
-- Execution strategies: cold-start pool vs create-pod-on-cold-start -- one size doesn't fit all, at least with current tech; abstract over execution strategies according to requirements

Documentation/TERMINOLOGY

@@ -1,15 +0,0 @@
-_Function_: A fission function is something that's mapped to a
-_trigger_ and run on demand.  Though we call it a "function", this is
-a bit imprecise, since it's actually a module with an function as an
-entry point -- it doesn't have to be just one function.
-
-_Trigger_: Triggers are what cause functions to be called.  For
-example, an HTTP trigger causes functions to be called on HTTP
-requests.  Kubernetes Watch triggers cause functions to be called when
-a Kubernetes watch changes.  Future triggers will include message
-queues, timers, storage systems, etc.
-
-_Environments_: Environments are the language-specific parts of
-Fission.  Environment containers wrap the user's function and present
-a common interface to the rest of the fission framework.
-

Documentation/wip/ProgrammingModel.md

@@ -1,24 +0,0 @@
-# Programming Model
-
-This document describes the programming model for fission functions.  
-
-## Time Limits
-
-By default, there is no time limit on fission functions.  
-
-Idle running instances may be killed at any time (usually after the
-default idle timeout of 10 minutes, but this is configurable).
-
-
-## HTTP Triggers
-
-Functions triggered over HTTP receive the HTTP request object in the
-context.  The request's query string, POST body, etc. can be retrieved
-from this object.  The interface is language-specific: see [TODO] for
-documentation on the context object in each environment.
-
-
-## Kubernetes Watch Event Triggers
-
-Kubernetes watches can be used to trigger functions.  These functions
-receive the Kubernetes watch.Event object in JSON-serialized form.

Documentation/wip/env-api.md

@@ -1,120 +0,0 @@
-# Environment V2 Fission-Environment API
-
-Fission Environments are the language-specific component of fission.
-
-They must satisfy the interface in this spec.
-
-## Meta
-
-This is version 2.0-alpha of the Fission-Environment API.
-
-(It's unstable and may change without warning until 2.0-beta.)
-
-## Overview
-
-Fission V2 Environments consist of:
-
- * Metadata
- * A runtime image
- * A builder image (optional)
- * Function Interface Specification
- * User Documentation
- * Examples
-
-### Metadata 
-
-See EnvironmentSpec, Runtime, and Builder in types.go.
-
-## Runtime Image
-
-An environment runtime image is a docker container image. It must run
-a server that has two jobs:
-
-(a) Loading a "function" from a file path on demand
-(b) Invoking that function on request
-
-### Function Loading
-
-The environment must expose a single HTTP endpoint (at the port and
-URL specified in the metadata) that loads a function. The function
-load request is a JSON-serialized `FunctionLoadRequest`.
-
-The function load request contains a filepath to load the function
-from. Fission does not define in any way the contents of the path; it
-is completely environment-dependent. It may be a single file, or a
-directory (in case of deployment packages).
-
-The load request may contain an EntryPoint. If it does, the loader
-must interpret this; usually it's the name of a function in a module
-or package containing multiple functions. If there is no entrypoint,
-the environment must use a default; again, the value of thsi default
-is environment-specific.
-
-The load request may contain a URL. If it does, requests to that URL
-should be routed to the function. It defaults to "/".
-
-### Function Invocation
-
-Functions are invoked on HTTP request to the server. The port for the
-request on the runtime container is defined in the Runtime metadata,
-and the URL for the request is specified in the FunctionLoadRequest.
-
-The interface of the function is environment specific; the environment
-must come with a spec for this interface.
-
-## Builder
-
-The builder is a container image that contains tools to build a
-function from source. The source may be a single file or a directory
-of files.
-
-The builder container is invoked with the specified command, with the
-following params:
-
- 1. File path of the source
- 2. File path where the output should go
- 3. Other env or function-specific params passed by the user
-
-The first two parameters are file paths, and all remaining params are
-environment-specific.
-
-The output of the builder should be something that the runtime can
-load and run -- there should be no intermediate steps that need user
-intervention.
-
-### Errors
-
-## Function Interface Spec
-
-The function interface spec is a document that specifies the interface
-of functions and their semantics.  It must specify:
-
- * How functions are invoked (sync, async)
- * How the request context is provided to the function (URL, headers, request type, request body)
- * Function logging
- * Semantics of function errors and exceptions
-
-
-## Documentation
-
-The docs should contain everything necessary to use the environment:
-
- * How to add it to a fission cluster
- * How to write and build functions for this environment (link to the interface spec)
- * How to modify and rebuild the environment itself
-
-## Examples
-
-Suggested examples to provide:
-
- * A simple "Hello world"
- * A function that demonstrates use of the request context: url params,
-   request headers, request body 
- * A function that does logging
- * A multi-file function package
- * A function with dependencies
- * Functions with shared code
-
-## Compatibility with v1
-
-V1 environment images can be used as v2 environment runtime images. 

Documentation/wip/environments-v2.md

@@ -1,327 +0,0 @@
-# Fission Environments Redesign
-
-As Fission supports more languages and reaches a wider set of use
-cases, it's time to ask how well the current Environments design is
-holding up.
-
-
-## Environments V1: What we learned
-
-Environments V1 is very simple idea: an environments is one Docker
-image with an HTTP server + dynamic loader for that language; it's run
-in a pod with a language-agnostic sidecar (fetcher) that downloads and
-saves the function into a volume shared with the language-specific
-container.
-
-### Pros:
-
-* Abstracted away images.
-
-* Very fast cold start
-
-* No image registry to manage (neither for the user nor for fission
-  implementation)
-
-* Relatively small amount of language specific code. (python env is <
-  100 lines)
-
-### Cons:
-
-* Doesn't work well for compiled languages
-
-* Users have to rebuild the image to add dependencies
-
-* Only one file supported
-
-* Errors in loading are not surfaced properly.  It is especially
-  annoying to wait until runtime to see a syntax error that could have
-  been caught on function upload.
-
-* Starting a Pod without knowing the functions has its limitations: we
-  can't set CPU/memory limits, we can't mount volumes (persistent
-  volumes, secrets, configmaps).  We also can't change the namespace
-  the Pod is in.
-
-* Not great for a large code base
-
-* Some people want to operate at the image level but still get the
-  on-demand execution semantics of FaaS.  This is a cost-optimization
-  use case.
-
-
-### Discussion
-
-Early feedback shows that almost evey user ends up rebuilding images
-to add some dependecies.  Some sort of automated dependecy resolution
-would be very nice to have and improve the development workflow.  In
-other words, just attach a package.json(nodejs) or
-requirements.txt(python) with a function, and fission will do the
-rest.  There's also the possiblity of supporting buildpacks (simple
-zipfiles), a la AWS Lambda.
-
-Though we can support compiled languages by doing the compilation
-inside the cold-start, that's not a great solution because: (a)
-compile errors would be reported at runtime, and (b) because the
-overhead of compilation doesn't really need to be inside the
-cold-start latency.
-
-Non-trivial functions will need multiple files.  That also helps for
-common code across functions.  So we need a way for the user to define
-a function as a collection of code with an entry point.
-
-Finally, Docker images remain the most flexible way to package an app.
-Today, users can always rebuild an environment image to include
-anything they want.  But those images must still run a server that
-implements fission-environment interface (i.e. the specialize
-endpoint).  So perhaps there could be a way for users to say "don't
-use environments, I've already packaged up my function, here it is".
-
-
-## Environment V2 Requirements
-
-Roughly in order of priority:
-
-0. Retain the simplicity of the simple use cases.  First user
-   experience shoud remain trivial -- write a function, map a URL,
-   done.
-
-1. Support compiled languages. Support error reporting on function
-   upload rather than cold start.
-
-2. Support functions as a collection of files rather than just one
-   file.
-
-3. Support automated environment-specific dependecy resolution.
-
-   (#3 may end up having the same solution as #1.  You could think of
-   gathering deps as a "compilation" of package.json,
-   requirements.txt, etc.)
-
-4. Support functions as images.
-
-
-### User stories
-
-#### Environment Creation
-
-V1 Environments were just an image.  V2 Environments will be a yaml
-file with the following properties:
-
-* Run time image (required)
-* Version (required)
-* Builder image (optional)
-* Build invocation command (required if builder image specified)
-* File name extension(s) (optional)
-
-The version will be used to distinguish V2 environments from V1.
-
-```
-$ cat golang.yaml
-type: Environment
-metadata:
-  name: go
-spec:
-  runtimeImage: fission/go-runtime
-  builderImage: fission/go-builder
-  buildCommand:
-  - "/build.sh"
-  fileExtentions:
-  - go
-
-$ fission env create -f golang.yaml
-```
-
-#### Function creation for compiled languages
-
-User writes a function in a compiled language, for example Go.
-
-```
-$ fission function create --code blah.go
-
-<compilation errors>
-
-<user edits file>
-$ $EDITOR blah.go
-<fixes errors>
-
-$ fission function update --code blah.go
-<success>
-
-$ fission route ... # routes work as usual
-```
-
-This same user story applies to interpreted languages too, where the
-"compilation" step can be used to check for syntax errors.
-
-#### Compiled language, without using fission builds
-
-User compiles their function locally, resulting in a set of one or
-more binaries. The user packages these up as a zip file, creating a
-"deployment package".
-
-```
-$ fission function create --deployment-package foo.zip
-
-$ fission route ... # routes work as usual
-```
-
-In this use case, fission is no longer operating at the source
-level. Builds are left to the user and fission only sees the
-deployment package package.
-
-#### Collections of source files
-
-The user can create a source package -- a set of source files in a
-zip.
-
-```
-$ fission function create --source-package foo.zip
-
-```
-
-This workflow works similarly to providing a single source file.
-
-In addition, fission CLI could support automatic creation of source packages, e.g.
-
-```
-$ fission function create --source-files *.js
-```
-
-This is purely client-side "syntactic sugar" -- the CLI creates the
-source package instead of the user having to do it manually.  It
-doesn't change semantics; the source package is still handled as one
-object.
-
-#### Handling Dependencies
-
-The source package of a function can contain dependency specs.
-
-Fission framework proper does not treat this spec in any special way;
-it's just another file in the source package.  These will be
-interpreted by the environment builder.
-
-```
-$ fission function create --source-files *.js --source-files package.json
-```
-
-In this case, the CLI will create a source package containing the JS
-files and package.json.  The NodeJS environment builder will create a
-deployment package out of these files.  The runtime environment will
-load and run the deployment package.
-
-#### V1 Compatibility
-
-V1 Environments will continue to be supported.  Existing commands will
-continue to work.  V1 environments won't support newer features like
-builds, source and deployment packages, etc.
-
-### Implementation
-
-#### Environment Type
-
-The environment type has a set of new properties: version, runtime
-image, builder image, build command, file extension(s).
-
-#### Function Type
-
-The function type has new properties: source package, deployment
-package.  The literal code string continues to be supported, but it
-will have a specified size limit, say 512KB.
-
-#### Source and Binary Packages
-
-A package is just a zip file.  It's contents are opaque to fission:
-the meaning of its contents is defined by the environment.  Fission's
-job is to manage the storage and delivery of the package into build
-and runtime environments.
-
-#### Storage Service
-
-The storage service will have an HTTP API to upload and download
-files. It can store the packages on a persistent volume or as objects
-in cloud storage services such as S3.
-
-Storage service has a garbage collection API endpoint.  When invoked,
-it will remove all packages that are not referenced from any function.
-
-#### Fetcher
-
-Fetcher gets some new responsibilities:
-
-1. It must now also handle zip/unzip of packages
-
-2. It must know how to upload to the storage service (so it's not
-exactly "fetcher" any more, but...)
-
-#### Runtime Environment Interface
-
-The V2 runtime environment interface is very similar to V1
-environments.  Environments must support a dynamic loader and have an
-HTTP server that forwards requests to the loaded module.
-
-The differences:
-
-* V2 runtimes must support loading a deployment package.  Fetcher is
-  responsible for unzipping a deployment package, but interpretation
-  of the contents is up to the environment's code.  For example, it
-  may have to include the directory where the deployment package is
-  unzipped in its module load path.
-
-[TODO any other differences?]
-
-#### Buildmgr
-
-A new service that will manage builds.  Its design is similar to
-poolmgr, except it is triggered on creation or update of a function,
-rather than HTTP requests.
-
-Buildmgr creates a builder deployment+service for each environment.
-Pods in this deployment run the environment's build container, and
-fetcher, with a shared volume between the two containers.
-
-When a function is created or updated with a source package, buildmgr
-notices this and triggers a build.  First, it calls fetcher to
-download the source package into a shared volume with the build
-container.  It then invokes the builder by running the build
-invocation command in the build container.  Next, it calls fetcher to
-package up the output of the builder and store the built package into
-the the storage service.
-
-Finally, it updates the function object in the controller API with a
-reference to the built package.
-
-[We can collapse this workflow into one request into the builder
-service, which would make it easier to scale up the builder
-deployment; if we used multiple requests we'd need some sort of
-affinity rule, but k8s services only support IP based affinity.]
-
-#### Poolmgr
-
-Poolmgr remains relatively unchanged.  Instead of contructing URLs for
-function metadata, it uses the deployment package URL in the function
-object.
-
-#### CLI
-
-Client libraries and CLI have to deal with the new properties in
-functions and environments.
-
-The CLI will now talk to both storage service and controller.  When a
-function is created, the user can specify the function in one of 3
-ways:
-
-1. One source file, same as v1.
-
-2. A source package (or a set of source files, which is turned into a
-   source package by the CLI)
-
-3. A deployment package
-
-If the file is specified as a source file, fission CLI will use the
-code literal if it's under the size limit; otherwise it should use the
-storage service.  This will allow users to use fission deployments
-with no storage service, but with a size limit on functions.
-
-For the case of a source or deployment package, the CLI first does an
-upload to the storage service, then creates a function object with a
-reference to the uploaded package.

INSTALL.md

@@ -1,221 +0,0 @@
-
-- [Running Fission on your Cluster](#running-fission-on-your-cluster)
-  * [Setup Kubernetes](#setup-kubernetes)
-    + [Install and start Kubernetes on OSX:](#install-and-start-kubernetes-on-osx)
-    + [Or, install and start Kubernetes on Linux:](#or-install-and-start-kubernetes-on-linux)
-  * [Verify access to the cluster](#verify-access-to-the-cluster)
-  * [Get and Run Fission: Minikube or Local cluster](#get-and-run-fission-minikube-or-local-cluster)
-  * [Get and Run Fission: GKE or other Cloud](#get-and-run-fission-gke-or-other-cloud)
-  * [Get and Run Fission: OpenShift](#get-and-run-fission-openshift)
-    + [Using Minishift or Local Cluster](#using-minishift-or-local-cluster)
-    + [Using other clouds](#using-other-clouds)
-  * [Install the client CLI](#install-the-client-cli)
-  * [Run an example](#run-an-example)
-  * [Enable Persistent Function Logs (Optional)](#enable-persistent-function-logs-optional)
-  * [Use the web based Fission-ui (Optional)](#use-the-web-based-fission-ui-optional)
-
-## Running Fission on your Cluster
-
-### Setup Kubernetes
-
-You can install Kubernetes on your laptop with [minikube](https://github.com/kubernetes/minikube):
-
-#### Install and start Kubernetes on OSX:
-```bash
-  $ curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl && chmod +x kubectl && sudo mv kubectl /usr/local/bin
-  $ curl -Lo minikube https://storage.googleapis.com/minikube/releases/v0.16.0/minikube-darwin-amd64 && chmod +x minikube && sudo mv minikube /usr/local/bin/
-  $ minikube start
-```
-
-#### Or, install and start Kubernetes on Linux:
-```bash
-  $ curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && chmod +x kubectl && sudo mv kubectl /usr/local/bin
-  $ curl -Lo minikube https://storage.googleapis.com/minikube/releases/v0.16.0/minikube-linux-amd64 && chmod +x minikube && sudo mv minikube /usr/local/bin/
-  $ minikube start
-```
-
-Or, you can use [Google Container Engine's](https://cloud.google.com/container-engine/) free trial to get a 3 node cluster.
-
-### Verify access to the cluster
-
-```
-  $ kubectl version
-```
-
-### Get and Run Fission: Minikube or Local cluster
-
-If you're using minikube or no cloud provider, use these commands to
-set up services with NodePort.  This exposes fission on ports 31313
-and 31314.
-
-```
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-rbac.yaml
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-nodeport.yaml
-```
-
-Set the FISSION_URL and FISSION_ROUTER environment variables.
-FISSION_URL is used by the fission CLI to find the server.
-FISSION_URL should be prefixed with a `http://`.  (FISSION_ROUTER is
-only needed for the examples below to work.)
-
-If you're using minikube, use these commands:
-
-```
-  $ export FISSION_URL=http://$(minikube ip):31313
-  $ export FISSION_ROUTER=$(minikube ip):31314
-```
-
-
-### Get and Run Fission: GKE or other Cloud
-
-If you're using GKE or any other cloud provider that supports the
-LoadBalancer service type, use these commands:
-
-```
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-rbac.yaml
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-cloud.yaml
-```
-
-Save the external IP addresses of controller and router services in
-FISSION_URL and FISSION_ROUTER, respectively.  Wait for services to
-get IP addresses (check this with ```kubectl --namespace fission get
-svc```).  Then:
-
-```
-  $ export FISSION_URL=http://$(kubectl --namespace fission get svc controller -o=jsonpath='{..ip}')
-  $ export FISSION_ROUTER=$(kubectl --namespace fission get svc router -o=jsonpath='{..ip}')
-```
-
-### Get and Run Fission: OpenShift
-
-If you're using OpenShift, it's possible to run Fission on it! The
-deployment template needs to be deployed as a user with cluster-admin
-permissions (like `system:admin`), as it needs to create a
-`ClusterRole` for deploying function containers from the `fission`
-namespace/project.
-
-Identically as with Kubernetes, you need to set the FISSION_URL and FISSION_ROUTER environment variables. If you're using minishift, use these commands:
-
-```
-  $ export FISSION_URL=http://$(minishift ip):31313¬
-  $ export FISSION_ROUTER=$(minishift ip):31314¬
-```
-#### Using Minishift or Local Cluster
-
-If you're using minishift or no cloud provider, use these commands to set up services with NodePort. This exposes fission on ports 31313 and 31314.
-
-```
-  $ oc login -u system:admin
-  $ oc create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-openshift.yaml
-  $ oc create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-nodeport.yaml
-```
-
-#### Using other clouds
-
-If you're using any cloud provider that supports the LoadBalancer service type, use these commands:
-
-```
-$ oc login -u system:admin
-$ oc create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-openshift.yaml
-$ oc create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-cloud.yaml
-```
-After these steps, you should be able to run fission client as with kubernetes.
-
-### Install the client CLI
-
-#### Mac OS
-
-Get the CLI binary for Mac:
-
-```
-  $ curl -Lo fission https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-osx && chmod +x fission && sudo mv fission /usr/local/bin/
-```
-
-#### Linux
-
-```
-  $ curl -Lo fission https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-linux && chmod +x fission && sudo mv fission /usr/local/bin/
-```
-
-#### Windows
-
-For Windows, you can use the linux binary on WSL. Or you can download
-this windows executable: [fission.exe](https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-windows.exe)
-
-### Run an example
-
-Finally, you're ready to use Fission!
-
-```
-  $ fission env create --name nodejs --image fission/node-env
-
-  $ curl https://raw.githubusercontent.com/fission/fission/master/examples/nodejs/hello.js > hello.js
-
-  $ fission function create --name hello --env nodejs --code hello.js
-  
-  $ fission route create --method GET --url /hello --function hello
-  
-  $ curl http://$FISSION_ROUTER/hello
-  Hello, world!
-```
-
-
-### Enable Persistent Function Logs (Optional)
-
-Fission uses InfluxDB to store logs and fluentd to forward them from
-function pods into InfluxDB.  
-
-```
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-logger.yaml
-```
-
-That's it for the basic setup.  You can now use following command to view function logs:
-
-```
-  $ fission function logs --name hello
-```
-
-You can also list the all the pods that have hosted the function
-(including ones that aren't alive any more) and view logs for a
-particular pod:
-
-```
-  $ fission function pods --name hello
-
-  $ fission function logs --name hello --pod <pod name>
-```
-
-### Use the web based Fission-ui (Optional)
-
-[Fission-ui](https://github.com/fission/fission-ui) is the ui for fission maintained by the community.
-It allows users to observe and manage fission. It also provides a simple online development environment for serverless functions.
-
-To setup Fission-ui with fission in k8s is simple:
-
-```bash
-  # Run this after fission is deployed
-  $ kubectl create -f https://raw.githubusercontent.com/fission/fission-ui/master/docker/fission-ui.yaml
-```
-
-Then open `http://node-ip:31319` to use Fission-ui.
-
-For more infomation, please check out [Fission-ui Readme](https://github.com/fission/fission-ui/blob/master/README.md).
-
-### Install NATS for message-queue based triggers (Optional)
-
-Fission supports message queue triggers that allow you to invoke
-functions based on events in a queue.  For now, NATS-Streaming is the
-only supported message queue.
-
-You can install NATS Streaming on your Kubernetes cluster with:
-
-```
-  $ kubectl create -f https://github.com/fission/fission/releases/download/nightly20170705/fission-nats.yaml
-```
-
-You can subscribe to a NATS Streaming queue with a command like this:
-(See `fission mqtrigger --help` for details)
-
-```
-  $ fission mqtrigger create --name myQueueTrigger --function processEvent --topic "myQueue.request" 
-```

Makefile

@@ -0,0 +1,125 @@
+# Copyright 2017 The Fission Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+.DEFAULT_GOAL := check
+
+SKAFFOLD_PROFILE ?= kind
+
+VERSION ?= v0.0.0
+TIMESTAMP ?= $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
+COMMITSHA ?= $(shell git rev-parse HEAD)
+
+GOOS ?= $(shell go env GOOS)
+GOARCH ?= $(shell go env GOARCH)
+GOAMD64 ?= $(shell go env GOAMD64)
+GOPATH ?= $(shell go env GOPATH)
+
+FISSION-CLI-SUFFIX :=
+ifeq ($(GOOS), windows)
+	FISSION-CLI-SUFFIX := .exe
+endif
+
+# Show this help.
+help:
+	@awk '/^#/{c=substr($$0,3);next}c&&/^[[:alpha:]][[:alnum:]_-]+:/{print substr($$1,1,index($$1,":")),c}1{c=0}' $(MAKEFILE_LIST) | column -s: -t
+
+print-%:
+	@echo '$*=$($*)'
+
+debug-vars: print-GOOS print-GOARCH print-GOAMD64 print-VERSION print-TIMESTAMP print-COMMITSHA print-FISSION-CLI-SUFFIX print-SKAFFOLD_PROFILE
+
+### Static checks
+check: test-run build-fission-cli clean
+
+code-checks:
+	golangci-lint run
+
+# run basic check scripts
+test-run: code-checks
+	hack/runtests.sh
+	@rm -f coverage.txt
+
+### Binaries
+build-fission-cli:
+	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target --id fission-cli
+
+install-fission-cli:
+	# TODO: Fix this hack, replace v1 with GOAMD64
+	mv dist/fission-cli_$(GOOS)_$(GOARCH)_v1/fission$(FISSION-CLI-SUFFIX) /usr/local/bin/fission
+
+### Codegen
+codegen:
+	@./hack/update-codegen.sh
+	go tool controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
+
+### CRDs
+generate-crds:
+	go tool controller-gen crd \
+	paths=./pkg/apis/core/v1  \
+	output:crd:artifacts:config=crds/v1
+
+### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
+generate-webhooks:
+	go tool controller-gen webhook \
+	 paths=./pkg/webhook \
+	 output:dir=charts/fission-all/templates/webhook-server
+
+
+create-crds:
+	@kubectl create -k crds/v1
+
+update-crds:
+	@kubectl replace -k crds/v1
+
+delete-crds:
+	@kubectl delete -k crds/v1
+
+### Cleanup
+clean:
+	@rm -f dist/
+
+### Misc
+generate-swagger-doc:
+	@./hack/update-swagger-docs.sh
+
+generate-cli-docs:
+	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"
+
+generate-crd-ref-docs:
+	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
+	go tool crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	cp tools/crd-ref-docs/header.md crd_docs.md
+	cat out.md >> crd_docs.md && rm out.md
+	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
+
+all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs
+
+skaffold-prebuild:
+	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target
+	@cp -v cmd/builder/Dockerfile dist/builder_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fetcher/Dockerfile dist/fetcher_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
+	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
+	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@find dist/ -name 'Dockerfile' -exec sed -i.bak 's|$$TARGETPLATFORM/||g' {} +; find dist/ -name 'Dockerfile.bak' -delete
+
+skaffold-deploy: skaffold-prebuild
+	skaffold run -p $(SKAFFOLD_PROFILE)
+
+### Release
+release:
+	@./hack/generate-helm-manifest.sh $(VERSION)
+	@./hack/release.sh $(VERSION)
+	@./hack/release-tag.sh $(VERSION)
+	@./hack/changelog.sh

NEXT_CHAT_LAYER2.md

@@ -0,0 +1,79 @@
+# NEXT CHAT: LAYER2 START HERE
+
+Если ты новый агент в новом чате, сначала прочитай этот файл целиком.
+
+## Где работать
+
+Репозиторий: `fission-src`
+
+Ветка:
+
+`rewrite/layer2-namespace-manager-api-step1`
+
+## Что уже готово
+
+Layer1 завершён.
+
+Это значит:
+
+1. Внутренний `NamespaceManager` layer уже реализован.
+2. Buildermgr, router и executor/multitenant уже переведены на общий watcher/helper layer.
+3. Summary/debug contract стабилизирован.
+4. Logging path усилен.
+5. Layer1 закрыт commit-ом:
+
+`63ce6ea`  
+`layer1: close namespace manager step1`
+
+## Что уже было проверено
+
+Целевой прогон для layer1 уже был зелёным:
+
+`go test ./pkg/utils/... ./pkg/buildermgr/... ./pkg/router/... ./pkg/executor/multitenant`
+
+## Что нужно делать теперь
+
+Нужен layer2.
+
+Layer2 = не переписывать watcher-ы заново, а дать внешний read-only status/debug/API surface поверх уже готового `NamespaceManager` слоя.
+
+Цель:
+
+1. Найти лучший существующий read-only endpoint/status/debug surface.
+2. Начать аккуратно выносить наружу `NamespaceManagerSummary`.
+3. Не менять runtime semantics watcher-ов.
+4. Не плодить второй источник правды о namespace state.
+
+## Как работать
+
+1. Работай маленькими шагами.
+2. Перед кодом сначала найди правильную точку интеграции.
+3. Все новые заметки пиши только в новые файлы в `doc/thinking/`.
+4. Не трогай старые doc-файлы.
+5. Не запускай background-команды.
+6. Все команды запускай только через SSH на VM и всегда с timeout.
+
+## Важные файлы
+
+- `pkg/utils/namespace_manager.go`
+- `pkg/utils/namespace_manager_model.go`
+- `pkg/utils/namespace_manager_test.go`
+- `pkg/buildermgr/ns_watcher.go`
+- `pkg/router/ns_watcher.go`
+- `pkg/executor/multitenant/ns_watcher.go`
+
+## Первый шаг в новом чате
+
+Сначала не писать код.
+
+Сначала:
+
+1. проверить текущую ветку и чистоту дерева;
+2. найти существующий service-level status/debug/API contour;
+3. выбрать один безопасный read-only entrypoint для первого шага layer2.
+
+## Текст первого сообщения нового чата
+
+Можно просто вставить это:
+
+"Прочитай файл NEXT_CHAT_LAYER2.md и продолжай работу строго по нему. Нужен layer2: safe read-only API/status/debug surface поверх NamespaceManager без изменения runtime semantics watcher-ов. Сначала найди правильную точку интеграции, потом делай маленькие шаги с документированием в новых файлах doc/thinking/."

README.md

@@ -1,13 +1,69 @@
-Fission: Serverless Functions for Kubernetes
-============================================
-[![Build Status](https://travis-ci.org/fission/fission.svg?branch=master)](https://travis-ci.org/fission/fission)
-[![Go Report Card](https://goreportcard.com/badge/github.com/fission/fission)](https://goreportcard.com/report/github.com/fission/fission)
-[![Fission Slack](http://slack.fission.io/badge.svg)](http://slack.fission.io)
+> [!IMPORTANT]
+> ## Это форк Fission с поддержкой мультитенантности (multi-tenant)
+>
+> **Автор доработок:** Naeel / ngcloud  
+> **Базовая версия:** Fission v1.22.0 (официальный)  
+> **Репозиторий:** https://gitea.services.ngcloud.ru/Nail/fission-src
+>
+> ### Что добавлено по сравнению с официальным Fission:
+> - **Динамический multi-tenant:** namespace с меткой `fission.io/managed=true` подхватываются без рестарта Fission
+> - **Автоматический SA provisioning:** при появлении нового namespace автоматически создаются ServiceAccount, Role, RoleBinding для fetcher/builder
+> - **Namespace Manager:** новый компонент в `pkg/utils/` для отслеживания namespace в реальном времени
+> - **Обратная совместимость:** полная, поведение идентично официальному если меток нет
 
-[fission.io](http://fission.io)  [@fissionio](http://twitter.com/fissionio)
+---
 
-Fission is a fast serverless framework for Kubernetes with a focus on
-developer productivity and high performance.
+<p align="center">
+  <img src="https://fission.io/images/logo-gh.svg" width="300" />
+  <br>
+  <h1 align="center">Fission: Serverless Functions for Kubernetes</h1>
+</p>
+
+<p align="center">
+  <a href="https://github.com/fission/fission/blob/main/LICENSE">
+    <img alt="Fission Licence" src="https://img.shields.io/github/license/fission/fission">
+  </a>
+  <a href="https://github.com/fission/fission/releases">
+    <img alt="Fission Releases" src="https://img.shields.io/github/release-pre/fission/fission.svg">
+  </a>
+  <a href="https://pkg.go.dev/github.com/fission/fission">
+    <img alt="go.dev reference" src="https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white">
+  </a>
+  <a href="https://goreportcard.com/report/github.com/fission/fission">
+    <img src="https://goreportcard.com/badge/github.com/fission/fission" alt="Go Report Card" />
+  </a>
+  <a href="https://github.com/fission/fission/graphs/contributors">
+    <img alt="Fission contributors" src="https://img.shields.io/github/contributors/fission/fission">
+  </a>
+  <a href="https://github.com/fission/fission/commits/main">
+    <img alt="Commit Activity" src="https://img.shields.io/github/commit-activity/m/fission/fission">
+  </a>
+  <br>
+  <a href="https://fission.io/">
+    <img alt="Fission website" src="https://img.shields.io/badge/website-fission.io-blue">
+  </a>
+  <a href="https://fission.io/slack">
+    <img alt="Fission slack" src="https://badgen.net/badge/slack/Fission?icon=slack">
+  </a>
+  <a href="https://twitter.com/fissionio">
+    <img alt="Fission twitter" src="https://img.shields.io/twitter/follow/fissionio?style=social">
+  </a>
+  <a href="https://github.com/fission/fission">
+    <img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/fission/fission?style=social">
+  </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/fission/fission">
+    <image alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/fission/fission/badge">
+  </a>
+  <a href="https://www.bestpractices.dev/projects/4986">
+    <img src="https://www.bestpractices.dev/projects/4986/badge">
+  </a>
+</p>
+
+--------------
+
+Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. With Fission, developers can easily create and deploy serverless functions that can be triggered by a variety of events, such as HTTP requests, messages from a message queue, or scheduled tasks.
+
+Fission provides a simple, easy-to-use interface for developers to create serverless functions in their language of choice, without having to worry about the underlying infrastructure. The framework also offers automatic scaling, so functions can scale up or down based on demand, without any additional configuration.
 
 Fission operates on _just the code_: Docker and Kubernetes are
 abstracted away under normal operation, though you can use both to
@@ -18,7 +74,19 @@ language-specific parts are isolated in something called
 _environments_ (more below).  Fission currently supports NodeJS, Python, Ruby, Go, 
 PHP, Bash, and any Linux executable, with more languages coming soon.
 
-### Performance: 100msec cold start
+Table of Contents
+=================
+- [Table of Contents](#table-of-contents)
+  - [Performance: 100msec cold start](#performance-100msec-cold-start)
+  - [Kubernetes is the right place for Serverless](#kubernetes-is-the-right-place-for-serverless)
+  - [Getting Started](#getting-started)
+  - [Learn More](#learn-more)
+  - [Contributing](#contributing)
+  - [Who is using Fission?](#who-is-using-fission)
+  - [Sponsors](#sponsors)
+- [License](#license)
+
+## Performance: 100msec cold start
 
 Fission maintains a pool of "warm" containers that each contain a
 small dynamic loader.  When a function is first called,
@@ -26,7 +94,7 @@ i.e. "cold-started", a running container is chosen and the function is
 loaded.  This pool is what makes Fission fast: cold-start latencies
 are typically about 100msec.
 
-### Kubernetes is the right place for Serverless
+## Kubernetes is the right place for Serverless
 
 We're built on Kubernetes because we think any non-trivial app will
 use a combination of serverless functions and more conventional
@@ -37,65 +105,59 @@ Building on Kubernetes also means that anything you do for operations
 on your Kubernetes cluster &mdash; such as monitoring or log
 aggregation &mdash; also helps with ops on your Fission deployment.
 
-
-Fission Concepts
-----------------
-
-A _function_ is a piece of code that follows the fission function
-interface.
-
-An _environment_ contains the language- and runtime-specific parts of
-running a function.  Fission comes with NodeJS and Python
-environments; you can also extend environments or create entirely new
-ones if you want.  (An environment is essentially just a container
-with a webserver and dynamic loader.)
-
-A _trigger_ is something that maps an event to a function; Fission
-supports HTTP routes as triggers today, with upcoming support for
-other types of event triggers, such as timers and Kubernetes events.
-
-Usage
------
+## Getting Started
 
 ```bash
-
   # Add the stock NodeJS env to your Fission deployment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env
 
-  # A javascript one-liner that prints "hello world"
-  $ curl https://raw.githubusercontent.com/fission/fission/master/examples/nodejs/hello.js > hello.js
-
-  # Upload your function code to fission
-  $ fission function create --name hello --env nodejs --code hello.js
-
-  # Map GET /hello to your new function
-  $ fission route create --method GET --url /hello --function hello
+  # Create a function with a javascript one-liner that prints "hello world"
+  $ fission function create --name hello --env nodejs --code https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js
 
   # Run the function.  This takes about 100msec the first time.
-  $ curl http://$FISSION_ROUTER/hello
+  $ fission function test --name hello
   Hello, world!
 ```
 
-See the [examples](examples) directory for more.
+## Learn More
 
-Running Fission on your Cluster
-===============================
+- Understand [Fission Concepts](https://fission.io/docs/concepts/).
+- See the [installation guide](https://fission.io/docs/installation/) for installing and running Fission.
+- You can learn more about Fission and get started from [Fission Docs](https://fission.io/docs).
+- To see Fission in action, check out the [Fission Examples Repo](https://github.com/fission/examples).
+- See the [troubleshooting guide](https://fission.io/docs/trouble-shooting/) for debugging your functions and Fission installation.
 
-See the [installation guide](INSTALL.md).
+## Contributing
 
-Compiling Fission
-=================
+Check out the [contributing guide](CONTRIBUTING.md).
 
-See the [compilation guide](Compiling.md).
+## Who is using Fission?
+- [Fareye](https://www.getfareye.com)
+- Apple
+- [iQuanti](https://www.iquanti.com)
+- A large telecom CSP
+- [Gadget](https://gadget.dev)
+- [CinnamonAI](https://cinnamon.is/en)
+- [Armo](https://www.armosec.io/)
+- [The Social Audience](https://thesocialaudience.com/)
+- [KubeML](https://github.com/DiegoStock12/kubeml)
+- Unilever
+- [BD](https://www.bd.com/en-in)
+- [Biofourmis](https://biofourmis.com/)
+- [Babylon](https://www.babylonhealth.com/en-gb)
 
-Status
-======
+## Sponsors
 
-Fission is in early alpha.  It's not suitable for production use just
-yet.  
+The following companies, organizations, and individuals support Fission's ongoing maintenance and development. If you are using/contributing to Fission, we would be happy to list you here, please raise a Pull request.
 
-Reach us on [slack](http://slack.fission.io) or
-[twitter](https://twitter.com/fissionio).
+<p>
+  <a href="https://infracloud.io/"><img src="https://fission.io/sponsors/infracloud.png" alt="InfraCloud" height="70"></a>
+  <a href="https://srcmesh.com/"><img src="https://fission.io/sponsors/srcmesh.png" alt="Srcmesh" height="70"></a>
+  <a href="https://www.digitalocean.com/?utm_medium=opensource&utm_source=fissionio">
+    <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/PoweredByDO/DO_Powered_by_Badge_blue.svg" width="201px">
+  </a>
+</p>
 
-Fission is a project by [Platform9 Systems](https://platform9.com/fission/)
-and [many contributors](https://github.com/fission/fission/graphs/contributors).
+# License
+
+Fission is licensed under the Apache License 2.0 - see the [LICENSE](./LICENSE) file for details

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Please refer using [latest stable release](https://github.com/fission/fission/releases/latest) of Fission. 
+
+| Version | Supported          |
+| ------- | ------------------ |
+| >=1.20.x   | :white_check_mark: |
+| < 1.20.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Please send the details to both of us:
+
+- Sanket Sudake sanket[at]infracloud.io
+- Vishal Biyani vishal[at]infracloud.io

_build/linux_amd64/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+COPY fission-bundle /
+ENTRYPOINT ["/fission-bundle"]

builder/builder.go

@@ -1,166 +0,0 @@
-/*
-Copyright 2016 The Fission Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package builder
-
-import (
-	"bufio"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/dchest/uniuri"
-)
-
-const (
-	// supported environment variables
-	envSrcPkg    = "SRC_PKG"
-	envDeployPkg = "DEPLOY_PKG"
-)
-
-type (
-	PackageBuildRequest struct {
-		SrcPkgFilename string `json:"srcPkgFilename"`
-		// Command for builder to run with.
-		// A build command consists of commands, parameters and environment variables.
-		// For now, two environment variables are supported:
-		// 1. SRC_PKG: path to source package directory
-		// 2. DEPLOY_PKG: path to deployment package directory
-		BuildCommand string `json:"command"`
-	}
-
-	PackageBuildResponse struct {
-		ArtifactFilename string `json:"artifactFilename"`
-		BuildLogs        string `json:"buildLogs"`
-	}
-
-	Builder struct {
-		sharedVolumePath string
-	}
-)
-
-func MakeBuilder(sharedVolumePath string) *Builder {
-	return &Builder{
-		sharedVolumePath: sharedVolumePath,
-	}
-}
-
-func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != "POST" {
-		http.Error(w, "", 405)
-		return
-	}
-
-	startTime := time.Now()
-	defer func() {
-		elapsed := time.Now().Sub(startTime)
-		log.Printf("elapsed time in build request = %v", elapsed)
-	}()
-
-	// parse request
-	body, err := ioutil.ReadAll(r.Body)
-	if err != nil {
-		log.Printf("Error reading request body")
-		http.Error(w, err.Error(), 500)
-		return
-	}
-	var req PackageBuildRequest
-	err = json.Unmarshal(body, &req)
-	if err != nil {
-		log.Printf("Error parsing json body: %v", err)
-		http.Error(w, err.Error(), 400)
-		return
-	}
-	log.Printf("Builder received request: %v", req)
-
-	log.Println("Starting build...")
-	srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
-	deployPkgFilename := fmt.Sprintf("%v-%v", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))
-	deployPkgPath := filepath.Join(builder.sharedVolumePath, deployPkgFilename)
-	buildLogs, err := builder.build(req.BuildCommand, srcPkgPath, deployPkgPath)
-	if err != nil {
-		e := errors.New(fmt.Sprintf("Error building source package: %v", err))
-		http.Error(w, e.Error(), 500)
-		return
-	}
-
-	resp := PackageBuildResponse{
-		ArtifactFilename: deployPkgFilename,
-		BuildLogs:        buildLogs,
-	}
-
-	rBody, err := json.Marshal(resp)
-	if err != nil {
-		e := errors.New(fmt.Sprintf("Error encoding response body: %v", err))
-		http.Error(w, e.Error(), 500)
-		return
-	}
-
-	w.Header().Add("Content-Type", "application/json")
-	w.Write(rBody)
-	w.WriteHeader(http.StatusOK)
-}
-
-func (builder *Builder) build(command string, srcPkgPath string, deployPkgPath string) (string, error) {
-	cmd := exec.Command(command)
-	cmd.Dir = srcPkgPath
-	// set env variables for build command
-	cmd.Env = append(os.Environ(),
-		fmt.Sprintf("%v=%v", envSrcPkg, srcPkgPath),
-		fmt.Sprintf("%v=%v", envDeployPkg, deployPkgPath),
-	)
-
-	cmdReader, err := cmd.StdoutPipe()
-	if err != nil {
-		return "", errors.New(fmt.Sprintf("Error creating stdout pipe for cmd: %v", err.Error()))
-	}
-
-	scanner := bufio.NewScanner(cmdReader)
-
-	err = cmd.Start()
-	if err != nil {
-		return "", errors.New(fmt.Sprintf("Error starting cmd: %v", err.Error()))
-	}
-
-	var buildLogs string
-
-	fmt.Println("\n=== Build Logs ===")
-	for scanner.Scan() {
-		output := scanner.Text()
-		fmt.Println(output)
-		buildLogs += fmt.Sprintf("%v\n", output)
-	}
-	fmt.Println("==================\n")
-
-	if err := scanner.Err(); err != nil {
-		return "", errors.New(fmt.Sprintf("Error reading cmd output: %v", err.Error()))
-	}
-
-	err = cmd.Wait()
-	if err != nil {
-		return "", errors.New(fmt.Sprintf("Error waiting for cmd: %v", err.Error()))
-	}
-
-	return buildLogs, nil
-}

builder/client/client.go

@@ -1,56 +0,0 @@
-/*
-Copyright 2016 The Fission Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package client
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"strings"
-
-	"github.com/fission/fission"
-	builder "github.com/fission/fission/builder"
-)
-
-type (
-	Client struct {
-		url string
-	}
-)
-
-func MakeClient(serverUrl string) *Client {
-	return &Client{
-		url: strings.TrimSuffix(serverUrl, "/"),
-	}
-}
-
-func (c *Client) Build(req *builder.PackageBuildRequest) error {
-	body, err := json.Marshal(req)
-	if err != nil {
-		return err
-	}
-	resp, err := http.Post(c.url, "application/json", bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		return fission.MakeErrorFromHTTP(resp)
-	}
-	return nil
-}

builder/cmd/Dockerfile

@@ -1,5 +0,0 @@
-FROM alpine:3.4
-
-ADD builder /
-
-EXPOSE 8000

builder/cmd/build.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-GOOS=linux GOARCH=386 go build -o builder .

charts/README.md

@@ -1,82 +0,0 @@
-# Fission
-
-[Fission](http://fission.io/) is a framework for serverless functions on Kubernetes.
-
-
-## Prerequisites
-
-- Kubernetes 1.6+ with Beta APIs enabled
-
-
-## Helm charts
-
-The following table lists two helm charts for Fission.
-
-| Parameter      | Description                                                                            |
-| ---------------| ---------------------------------------------------------------------------------------|
-| `fission-core` | FaaS essentials, and triggers for HTTP, Timers and Kubernetes Watches                  |
-| `fission-all`  | Log aggregation with fluentd and InfluxDB; NATS for message queue triggers; Fission-UI |
-
-## Installing the chart
-
-To install the chart with the release name `my-release`,
-
-```bash
-$ helm install --name my-release fission-all
-```
-
-## Uninstalling the chart
-
-To uninstall/delete chart,
-
-```bash
-$ helm delete my-release
-```
-
-## Configuration
-
-The following table lists the configurable parameters of the Fission chart and their default values.
-
-| Parameter           | Description                                | Default                  |
-| ------------------- | ------------------------------------------ | ------------------------ |
-| `serviceType`       | Type of service to use                     | `LoadBalancer`.          |
-| `image`             | Fission image                              | `fission/fission-bundle` |
-| `imageTag`          | Fission image tag                          | `alpha20170124`          |
-| `fetcherImage`      | Fission fetcher image                      | `fission/fetcher`        |
-| `fetcherImageTag`   | Fission fetcher image tag                  | `latest`                 |
-| `controllerPort`    | Fission Controller Service Port            | `31313`                  |
-| `routerPort`        | Fission Router Service Port                | `31314`                  |
-| `functionNamespace` | Namespace for Fission functions            | `fission-function`       |
-| `openshift`         | RBAC for openshift                         | `false`                  |
-
-
-* Extra configuration for `fission-all`
-
-| Parameter              | Description                 | Default                    |
-| ---------------------- | --------------------------- | -------------------------- |
-| `logger.influxdbAdmin` | Log database admin username | `admin`.                   |
-| `logger.fluentdImage`  | Logger fluentd image        | `fission/fluentd`          |
-| `fissionUiImage`       | Fission ui image            | `fission/fission-ui:0.1.0` |
-| `nats.authToken`       | Nats streaming auth token   | `defaultFissionAuthToken`  |
-| `nats.clusterID`       | Nats streaming clusterID    | `fissionMQTrigger`         |
-
-
-
-Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
-
-```bash
-$ helm install --name my-release --set image=custom/fission-bundle,imageTag=v1 fission-all
-```
-
-If you're using minikube, set serviceType to NodePort:
-
-```bash
-$ helm install --name my-release --set serviceType=NodePort fission-all
-```
-
-You can also set parameters with a yaml file (see values.yaml for
-what it should look like):
-
-```bash
-$ helm install --name my-release -f values.yaml fission-all
-```

charts/fission-all/Chart.yaml

@@ -1,16 +1,28 @@
-apiVersion: v1
+apiVersion: v2
 name: fission-all
-version: v0.2.0-20170822
+version: 1.22.0
+appVersion: v1.22.0
 description: Fission is a fast serverless framework for Kubernetes.
+kubeVersion: ">=1.28.0-0"
+home: https://fission.io/
+icon: https://fission.io/images/fission-logo-white.svg
+sources:
+  - https://github.com/fission/fission
+  - https://github.com/fission/keda-connectors
 keywords:
-- fission
-- serverless
-home: http://fission.io/
+  - fission
+  - serverless
+  - platform
+  - faas
+  - functions
+  - Integration & Delivery
 maintainers:
+  - name: Vishal Biyani
+    email: vishal@infracloud.io
   - name: Sanket Sudake
-    email: sanketsudake@gmail.com
-  - name: Soam Vasani
-    email: soamvasani@platform9.com
-  - name: Ta Ching Chen
-    email: contact@tachingchen.com
-engine: gotpl
+    email: sanket@infracloud.io
+type: application
+annotations:
+  artifacthub.io/signKey: |
+    fingerprint: 2EAE29FDF8A387050C82CD5ABBDD4FD6A1FFCBF6
+    url: https://raw.githubusercontent.com/fission/fission-charts/main/public_key/pgp_keys.asc

charts/fission-all/README.md

@@ -0,0 +1,157 @@
+# fission-all
+
+[Fission](https://fission.io/) is a framework for serverless functions on Kubernetes.
+
+## Prerequisites
+
+- Kubernetes 1.28+
+- Helm 3+
+
+## Get Repo Info
+
+```console
+helm repo add fission-charts https://fission.github.io/fission-charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Install Chart
+
+Replace `{{version}}` with [the latest Fission version](https://github.com/fission/fission/releases/latest).
+![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/fission/fission)
+
+```console
+# Helm
+$ export FISSION_NAMESPACE="fission"
+$ kubectl create namespace $FISSION_NAMESPACE
+$ kubectl create -k "github.com/fission/fission/crds/v1?ref={{version}}"
+$ helm install [RELEASE_NAME] fission-charts/fission-all --namespace fission
+```
+
+_See [configuration](#configuration) below._
+
+_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
+
+## Dependencies
+
+By default, this chart installs additional, dependent charts:
+
+- [prometheus-community/prometheus](https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus)
+
+To disable dependencies during installation, see [multiple releases](#multiple-releases) below.
+
+_See [helm dependency](https://helm.sh/docs/helm/helm_dependency/) for command documentation._
+
+## Uninstall Chart
+
+```console
+# Helm
+$ helm uninstall [RELEASE_NAME]
+```
+
+This removes all the Kubernetes components associated with the chart and deletes the release.
+
+_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
+
+CRDs are not removed by this chart and should be manually cleaned up:
+
+`{{version}}` references the version you used during the installation of chart.
+
+```console
+kubectl delete -k "github.com/fission/fission/crds/v1?ref={{version}}"
+```
+
+OR
+
+You can list all Fission CRDs and clean them up with `kubectl delete crd` command.
+
+```console
+kubectl get crds| grep ".fission.io"
+```
+
+## Upgrading Chart
+
+CRDs created by this chart are not updated by default and should be manually updated.
+
+`{{version}}` references the version you are upgrading to ![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/fission/fission)
+
+```console
+kubectl replace -k "github.com/fission/fission/crds/v1?ref={{version}}"
+```
+
+```console
+# Helm
+$ helm upgrade [RELEASE_NAME] fission-charts/fission-all
+```
+
+_See [configuration](#configuration) below._
+
+_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
+
+### Upgrading an existing Release to a new major version
+
+A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions.
+
+### Upgrade from 1.18.x to 1.20.x
+
+We have removed controller service from fission-all chart.
+
+### Upgrade from 1.17.x to 1.18.x
+
+With 1.18.x, we have major change in the way we are deploying Fission.
+We have added parameters `defaultNamespace`, `additionalFissionNamespaces`, `functionNamespace` and `builderNamespace` to manage the namespaces.
+We watch and manage specific namespaces for Fission resources configured via `defaultNamespace` and `additionalFissionNamespaces` parameters.
+You dont need to worry about `builderNamespace` and `functionNamespace` parameters, unless you want to consider legacy Fission resources.
+
+Please refer to [core changes](https://fission.io/docs/releases/v1.18.0/#fission-core-changes) for more details.
+
+### Upgrade from 1.16.x to 1.17.x
+
+By default, Fission runs with the default security context. This means that it will be run as root. We have added settings in Helm chart for securityContext across all services in Fission. You can enable recommended securityContext settings during Fission installation.
+
+Please refer to [security context settings](https://fission.io/docs/releases/v1.17.0/#security-context-setting-for-fission-installation) for more details.
+
+### Upgrade from 1.15.x to 1.16.x
+
+If you have been using `prometheus.enabled=true` in your fission-all chart, you will need to deploy the prometheus using prometheus community supported chart.
+We have removed prometheus dependency from fission-all chart.
+We would recommend [prometheus-community/prometheus](https://artifacthub.io/packages/helm/prometheus-community/prometheus) or [prometheus-community/kube-prometheus-stack](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack) chart.
+
+### Upgrade from 1.14.x to 1.15.x
+
+With 1.15.x release, following changes are made:
+
+- `fission-core` chart is removed
+- `fission-all` chart is made similar `fission-core` chart
+- In the `fission-all` chart, the following components are disabled which were enabled by default earlier. If you want to enable them, please use `--set` flag.
+
+  - nats - Set `nats.enabled=true` to enable Fission Nats integration
+  - influxdb - Set `influxdb.enabled=true` to enable Fission InfluxDB and logger component
+  - prometheus - Set `prometheus.enabled=true` to install Prometheus with Fission
+  - canaryDeployment - Set `canaryDeployment.enabled=true` to enable Canary Deployment
+
+## Migrating from fission-core chart
+
+With the release of Fission v1.15.x, the fission-core chart was removed.
+Fission-all is now exactly similar to fission-core and can be used to migrate from fission-core.
+
+If you are upgrading from the fission-core chart, you can use the following command to migrate with required changes.
+
+```console
+ helm upgrade [RELEASE_NAME] fission-charts/fission-all --namespace fission
+ ```
+
+## Configuration
+
+See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments:
+
+```console
+helm show values fission-charts/fission-all
+```
+
+You may also `helm show values` on this chart's [dependencies](#dependencies) for additional options.
+
+### Multiple releases
+
+The same chart can be used to run multiple Fission instances in the same cluster if required.

charts/fission-all/config/fluentbit.conf

@@ -0,0 +1,56 @@
+# Some stuff in this file is copied out of https://github.com/fluent/fluent-bit-kubernetes-logging/blob/master/output/kafka/fluent-bit-configmap.yaml
+[SERVICE]
+    Flush 5
+    Log_Level info
+    Parsers_File parsers.conf
+
+[INPUT]
+    Name tail
+    Tag log.*
+    Path ${LOG_PATH}
+    Mem_Buf_Limit 5MB
+    Parser docker
+    DB /var/log/fission/flb_kube.db
+    Skip_Long_Lines   On
+    Refresh_Interval  10
+
+[FILTER]
+    Name kubernetes
+    Match *
+    Kube_Tag_Prefix  log.var.log.fission.
+    Kube_URL https://kubernetes.default.svc.cluster.local:443
+
+#
+# Flatten kubernetes labels so we can tag and query functionuid with influxdb
+#
+[FILTER]
+    Name nest
+    Match log.*
+    Operation lift
+    Nested_under kubernetes
+    Prefix_with kubernetes_
+
+[FILTER]
+    Name nest
+    Match log.*
+    Operation lift
+    Nested_under kubernetes_labels
+    Prefix_with kubernetes_labels_
+
+[OUTPUT]
+    Name influxdb
+    Match log.*
+    Host ${INFLUXDB_ADDRESS}
+    Port ${INFLUXDB_PORT}
+    Database ${INFLUXDB_DBNAME}
+    HTTP_User ${INFLUXDB_USERNAME}
+    HTTP_Passwd ${INFLUXDB_PASSWD}
+    Tag_Keys kubernetes_labels_functionUid
+    Sequence_Tag  _seq
+
+
+# Useful for testing config changes
+#[OUTPUT]
+#    Name file
+#    Match log.*
+#    Path /flbout.txt

charts/fission-all/config/parsers.conf

@@ -0,0 +1,12 @@
+[PARSER]
+    Name        docker
+    Format      json
+    Time_Key    time
+    Time_Format %Y-%m-%dT%H:%M:%S.%L
+    Time_Keep   On
+
+    # next bit is useful when the logs from the function itself are in json
+    # Command      |  Decoder | Field | Optional Action
+    # =============|==================|=================
+    #Decode_Field_As   escaped    log
+

charts/fission-all/dashboards/.lint

@@ -0,0 +1,11 @@
+exclusions:
+  template-job-rule:
+    reason: "Most panels dont need to be filtered by job"
+  template-instance-rule:
+    reason: "Most panels dont need to be filtered by instance"
+  target-job-rule:
+    reason: "Most panels dont need to be filtered by job"
+  target-instance-rule:
+    reason: "Most panels dont need to be filtered by instance"
+  panel-units-rule:
+    reason: "Some panels are using the 'number' unit which throws a linting error."

charts/fission-all/dashboards/fission-user-dashboard.json

@@ -0,0 +1,648 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "links": [],
+  "liveNow": false,
+  "panels": [
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows function calls, namespaces and their response codes.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 0
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_calls_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "interval": "",
+          "legendFormat": "Namespace:{{function_namespace}} Func:{{function_name}} {{method}} Response: {{code}} ",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function calls",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows any functions that return 400 or 500 errors.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 0
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_errors_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "legendFormat": "Namespace:{{function_namespace}} Function:{{function_name}} Response:{{code}} ",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function Errors",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Tracks cold starts of all functions.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 8
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_cold_starts_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "legendFormat": "{{function_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function cold starts",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 16
+      },
+      "id": 12,
+      "panels": [],
+      "title": "Http Requests",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows the number of requests currently in flight per function path",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 17
+      },
+      "id": 8,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "http_requests_in_flight{path=~\"$Path\"}",
+          "legendFormat": "{{path}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Http Requests in Flight (function)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows the average latency for each path.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 17
+      },
+      "id": 10,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "http_requests_duration_seconds_sum{path!=\"/healthz\",path!~\"/v2/.*\",path!~\"/router.*\",path=~\"$Path\"}/http_requests_duration_seconds_count{path=~\"$Path\"}",
+          "legendFormat": "{{path}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Request latency",
+      "type": "timeseries"
+    }
+  ],
+  "schemaVersion": 36,
+  "style": "dark",
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "selected": false,
+          "text": "Prometheus",
+          "value": "Prometheus"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Data Source",
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(fission_function_calls_total, function_name)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": false,
+        "name": "Function_Name",
+        "options": [],
+        "query": {
+          "query": "label_values(fission_function_calls_total, function_name)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": true,
+          "text": [
+            "All"
+          ],
+          "value": [
+            "$__all"
+          ]
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(http_requests_total, path)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "Path",
+        "options": [],
+        "query": {
+          "query": "label_values(http_requests_total, path)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(kube_namespace_labels, namespace)",
+        "description": "",
+        "hide": 0,
+        "includeAll": true,
+        "multi": false,
+        "name": "Function_Namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(kube_namespace_labels, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "current": {
+          "selected": false,
+          "text": "fission",
+          "value": "fission"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(fission_function_calls_total, namespace)",
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "Fission_Namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(fission_function_calls_total, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-5m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Fission User Dashboard",
+  "uid": "he2w3Xq7z",
+  "version": 3,
+  "weekStart": ""
+}

charts/fission-all/templates/NOTES.txt

@@ -1,40 +1,42 @@
+{{ template "deprecationWarnings" . }}
+
 1. Install the client CLI.
 
 Mac:
-  $ curl -Lo fission https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-osx && chmod +x fission && sudo mv fission /usr/local/bin/
+  $ curl -Lo fission https://github.com/fission/fission/releases/download/{{ .Chart.Version }}/fission-{{ .Chart.Version }}-darwin-amd64 && chmod +x fission && sudo mv fission /usr/local/bin/
 
 Linux:
-  $ curl -Lo fission https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-linux && chmod +x fission && sudo mv fission /usr/local/bin/
+  $ curl -Lo fission https://github.com/fission/fission/releases/download/{{ .Chart.Version }}/fission-{{ .Chart.Version }}-linux-amd64 && chmod +x fission && sudo mv fission /usr/local/bin/
 
 Windows:
-  For Windows, you can use the linux binary on WSL. Or you can download this windows executable: https://github.com/fission/fission/releases/download/nightly20170705/fission-cli-windows.exe
+  For Windows, you can use the linux binary on WSL. Or you can download this windows executable: https://github.com/fission/fission/releases/download/{{ .Chart.Version }}/fission-{{ .Chart.Version }}-windows-amd64.exe
 
-2. Set the FISSION_URL and FISSION_ROUTER environment variables.
-FISSION_URL is used by the fission CLI to find the server.
-FISSION_URL should be prefixed with a http://. (FISSION_ROUTER is only needed for the examples below to work.)
-
-{{- if contains "NodePort" .Values.serviceType }}
-  $ export FISSION_URL=http://$(minikube ip):{{ .Values.controllerPort }}
-  $ export FISSION_ROUTER=$(minikube ip):{{ .Values.routerPort }}
-
-{{- else if contains "LoadBalancer" .Values.serviceType }}
-  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-        You can watch the status of by running 'kubectl --namespace fission get -w svc' and 'kubectl --namespace fission get svc -w router'
-
-  $ export FISSION_URL=http://$(kubectl --namespace fission get svc controller -o=jsonpath='{..ip}')
-  $ export FISSION_ROUTER=$(kubectl --namespace fission get svc router -o=jsonpath='{..ip}')
+2. You're ready to use Fission!
 
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  You can create fission resources in the namespaces "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  You can create fission resources in the namespace "{{ .Values.defaultNamespace }}"
 {{- end }}
 
-3. Finally, you're ready to use Fission!
+  # Create an environment
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env --namespace {{ .Values.defaultNamespace }}
 
-  $ fission env create --name nodejs --image fission/node-env
+  # Get a hello world
+  $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
 
-  $ curl https://raw.githubusercontent.com/fission/fission/master/examples/nodejs/hello.js > hello.js
+  # Register this function with Fission
+  $ fission function create --name hello --env nodejs --code hello.js --namespace {{ .Values.defaultNamespace }}
 
-  $ fission function create --name hello --env nodejs --code hello.js
+{{- if .Values.authentication.enabled }}
 
-  $ fission route create --method GET --url /hello --function hello
+  # Create token
+  $ FISSION_USERNAME=$(kubectl get secrets/router --template={{`{{.data.username}}`}} -n fission | base64 -d)
+  $ FISSION_PASSWORD=$(kubectl get secrets/router --template={{`{{.data.password}}`}} -n fission | base64 -d)
+  $ export FISSION_AUTH_TOKEN=$(fission token create --username $FISSION_USERNAME --password $FISSION_PASSWORD)
+{{- end }}
 
-  $ curl http://$FISSION_ROUTER/hello
+  # Run this function
+  $ fission function test --name hello --namespace {{ .Values.defaultNamespace }}
   Hello, world!
+

charts/fission-all/templates/_certs.tpl

@@ -0,0 +1,43 @@
+
+
+{{- define "fision.selfSignedCABundleCertPEM" -}}
+  {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+  {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+  {{- $caKeypair.Cert -}}
+{{- end -}}
+
+{{- define "webhook.caBundleCertPEM" -}}
+  {{- if .Values.webhook.caBundlePEM -}}
+    {{- trim .Values.webhook.caBundlePEM -}}
+  {{- else -}}
+    {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+    {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+    {{- $caKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.certPEM" -}}
+  {{- if .Values.webhook.crtPEM -}}
+    {{- trim .Values.webhook.crtPEM -}}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace }}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) }}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.keyPEM" -}}
+  {{- if .Values.webhook.keyPEM -}}
+    {{ trim .Values.webhook.keyPEM }}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) -}}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Key -}}
+  {{- end -}}
+{{- end -}}

charts/fission-all/templates/_deprecation-warnings.tpl

@@ -0,0 +1,21 @@
+{{- define "deprecationWarnings" -}}
+{{- $deprecations := list -}}
+
+{{- if .Values.builderNamespace -}}
+{{- $deprecations = append $deprecations "The 'builderNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.functionNamespace -}}
+{{- $deprecations = append $deprecations "The 'functionNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.disableOwnerReference -}}
+{{- $deprecations = append $deprecations "The 'disableOwnerReference' flag is temporary addition and will be removed in future release." -}}
+{{- end -}}
+
+{{- if $deprecations -}}
+{{- range $deprecations }}
+{{- printf "WARNING: %s" . | nindent 0 }}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/_fission-component-roles.tpl

@@ -0,0 +1,163 @@
+{{- define "buildermgr-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "executor-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kubewatcher-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kafka-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "keda-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "preupgrade-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+{{- end }}
+{{- define "router-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "storagesvc-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "timer-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "canaryconfig-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - httptriggers
+  verbs:
+  - list
+  - watch
+  - get
+  - update
+{{- end }}

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -0,0 +1,384 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}

charts/fission-all/templates/_fission-kuberntes-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_fission-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "fission-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-rules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-rules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-rules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-rules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-rules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-rules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-rules" . }}
+{{- end }}
+{{- if eq "storagesvc" .component }}
+{{- include "storagesvc-rules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-rules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-rules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_function-access-role.tpl

@@ -0,0 +1,123 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
+{{- end -}}

charts/fission-all/templates/_helpers.tpl

@@ -14,3 +14,120 @@ We truncate at 24 chars because some Kubernetes name fields are limited to this
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 24 | trimSuffix "-" -}}
 {{- end -}}
+
+
+{{/*
+This is a template with config parameters for optional features in fission. This gets mounted on to the controller pod
+as a config map.
+To add new features with config parameters, create a yaml block below with the feature name and define a corresponding struct in
+controller/config.go
+*/}}
+{{- define "config" -}}
+canary:
+  enabled: {{ .Values.canaryDeployment.enabled }}
+  prometheusSvc: {{ .Values.prometheus.serviceEndpoint | default "" | quote }}
+  {{- printf "\n" -}}
+auth:
+  enabled: {{ .Values.authentication.enabled | default false }}
+  {{- if .Values.authentication.enabled }}
+  authUriPath: {{ .Values.authentication.authUriPath | default "/auth/login" | quote}}
+  jwtExpiryTime: {{ .Values.authentication.jwtExpiryTime | default 120 }}
+  jwtIssuer: {{ .Values.authentication.jwtIssuer | default "fission" | quote }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+Helper template to construct image names with repository and tag
+*/}}
+{{- define "imageWithTag" -}}
+{{- $repository := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $tag := index . 2 -}}
+{{- if $repository -}}
+{{- printf "%s/%s%s" $repository $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- else -}}
+{{- printf "%s%s" $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-bundleImage" -}}
+{{- $args := list .Values.repository .Values.image .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "reporterImage" -}}
+{{- $args := list .Values.repository .Values.postInstallReportImage .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "fetcherImage" -}}
+{{- $args := list (.Values.fetcher.repository | default .Values.repository) .Values.fetcher.image .Values.fetcher.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "preUpgradeChecksImage" -}}
+{{- $args := list (.Values.preUpgradeChecks.repository | default .Values.repository) .Values.preUpgradeChecks.image .Values.preUpgradeChecks.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "opentelemtry.envs" }}
+- name: OTEL_EXPORTER_OTLP_ENDPOINT
+  value: "{{ .Values.openTelemetry.otlpCollectorEndpoint }}"
+- name: OTEL_EXPORTER_OTLP_INSECURE
+  value: "{{ .Values.openTelemetry.otlpInsecure }}"
+{{- if .Values.openTelemetry.otlpHeaders }}
+- name: OTEL_EXPORTER_OTLP_HEADERS
+  value: "{{ .Values.openTelemetry.otlpHeaders }}"
+{{- end }}
+- name: OTEL_TRACES_SAMPLER
+  value: "{{ .Values.openTelemetry.tracesSampler }}"
+- name: OTEL_TRACES_SAMPLER_ARG
+  value: "{{ .Values.openTelemetry.tracesSamplingRate }}"
+- name: OTEL_PROPAGATORS
+  value: "{{ .Values.openTelemetry.propagators }}"
+{{- end }}
+
+{{- define "fission-resource-namespace.envs" }}
+- name: FISSION_BUILDER_NAMESPACE
+  value: "{{ .Values.builderNamespace }}"
+- name: FISSION_FUNCTION_NAMESPACE
+  value: "{{ .Values.functionNamespace }}"
+- name: FISSION_DEFAULT_NAMESPACE
+  value: "{{ .Values.defaultNamespace }}"
+- name: FISSION_RESOURCE_NAMESPACES
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  value: {{ .Values.defaultNamespace }}  
+{{- end }}
+{{- end }}
+
+{{- define "kube_client.envs" }}
+- name: KUBE_CLIENT_QPS
+  value: "{{ .Values.kubernetesClientQPS }}"
+- name: KUBE_CLIENT_BURST
+  value: "{{ .Values.kubernetesClientBurst }}"
+{{- end}}
+
+{{/*
+Define the svc's name
+*/}}
+{{- define "fission-webhook.svc" -}}
+{{- printf "webhook-service" -}}
+{{- end -}}
+
+{{- define "fission-function-ns" -}}
+{{- if .Values.functionNamespace -}}
+{{- printf "%s" .Values.functionNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-builder-ns" -}}
+{{- if .Values.builderNamespace -}}
+{{- printf "%s" .Values.builderNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/analytics/nonhelm-install-job.yaml

@@ -0,0 +1,40 @@
+{{- if .Values.analyticsNonHelmInstall }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-{{ randNumeric 3 }}
+  labels:
+    # The "release" convention makes it easy to tie a release to all of the
+    # Kubernetes resources that were created as part of that release.
+    release: {{ .Release.Name }}
+    # This makes it easy to audit chart usage.
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    app: {{ template "name" . }}
+spec:
+  #ttlSecondsAfterFinished: 120
+  template:
+    metadata:
+      name: {{ template "fullname" . }}
+      labels:
+        release: {{ .Release.Name }}
+        app: {{ template "name" . }}
+      annotations:
+        {{- if .Values.enableIstio }}
+        "sidecar.istio.io/inject": "false"
+        {{- end }}
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: post-install-job
+          image: {{ include "reporterImage" . | quote }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          command: [ "/reporter" ]
+          args: ["event", "-c", "fission-use", "-a", "yaml-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
+          env:
+            - name: GA_TRACKING_ID
+              value: "{{ .Values.gaTrackingID }}"
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

charts/fission-all/templates/analytics/post-install-job.yaml

@@ -0,0 +1,50 @@
+{{- if .Values.analytics }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-install
+  labels:
+    # The "release" convention makes it easy to tie a release to all of the
+    # Kubernetes resources that were created as part of that release.
+    release: {{ .Release.Name }}
+    # This makes it easy to audit chart usage.
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    app: {{ template "name" . }}
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    metadata:
+      name: {{ template "fullname" . }}
+      labels:
+        release: {{ .Release.Name }}
+        app: {{ template "name" . }}
+      annotations:
+        {{- if .Values.enableIstio }}
+        "sidecar.istio.io/inject": "false"
+        {{- end }}
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: post-install-job
+          image: {{ include "reporterImage" . | quote }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          command: [ "/reporter" ]
+          args: ["event", "-c", "fission-use", "-a", "helm-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
+          env:
+            - name: GA_TRACKING_ID
+              value: "{{ .Values.gaTrackingID }}"
+        {{- if .Values.terminationMessagePath }}
+          terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

charts/fission-all/templates/analytics/post-upgrade-job.yaml

@@ -0,0 +1,50 @@
+{{- if .Values.analytics }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-upgrade
+  labels:
+    # The "release" convention makes it easy to tie a release to all of the
+    # Kubernetes resources that were created as part of that release.
+    release: {{ .Release.Name }}
+    # This makes it easy to audit chart usage.
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    app: {{ template "name" . }}
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    metadata:
+      name: {{ template "fullname" . }}
+      labels:
+        release: {{ .Release.Name }}
+        app: {{ template "name" . }}
+      annotations:
+        {{- if .Values.enableIstio }}
+        "sidecar.istio.io/inject": "false"
+        {{- end }}
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: post-upgrade-job
+          image: {{ include "reporterImage" . | quote }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          command: [ "/reporter" ]
+          args: ["event", "-c", "fission-use", "-a", "helm-post-upgrade", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
+          env:
+            - name: GA_TRACKING_ID
+              value: "{{ .Values.gaTrackingID }}"
+          {{- if .Values.terminationMessagePath }}
+          terminationMessagePath: {{ .Values.terminationMessagePath }}
+          {{- end }}
+          {{- if .Values.terminationMessagePolicy }}
+          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+          {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

charts/fission-all/templates/buildermgr/configmap.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.builderPodSpec.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: builder-podspec-patch
+data: 
+  builder-podspec-patch.yaml: |
+    {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
+{{- end -}}

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -0,0 +1,93 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buildermgr
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: buildermgr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: buildermgr
+  template:
+    metadata:
+      labels:
+        svc: buildermgr
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.buildermgr.securityContext.enabled }}
+      securityContext: {{- omit .Values.buildermgr.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: buildermgr
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
+        env:
+        - name: FETCHER_IMAGE
+          value: {{ include "fetcherImage" . | quote }}
+        - name: FETCHER_IMAGE_PULL_POLICY
+          value: "{{ .Values.pullPolicy }}"
+        - name: BUILDER_IMAGE_PULL_POLICY
+          value: "{{ .Values.pullPolicy }}"
+        - name: ENABLE_ISTIO
+          value: "{{ .Values.enableIstio }}"
+        - name: FETCHER_MINCPU
+          value: {{ .Values.fetcher.resource.cpu.requests | quote }}
+        - name: FETCHER_MINMEM
+          value: {{ .Values.fetcher.resource.mem.requests | quote }}
+        - name: FETCHER_MAXCPU
+          value: {{ .Values.fetcher.resource.cpu.limits | quote }}
+        - name: FETCHER_MAXMEM
+          value: {{ .Values.fetcher.resource.mem.limits | quote }}
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        - name: HELM_RELEASE_NAME
+          value: {{ .Release.Name | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
+        ports:
+          - containerPort: 8080
+            name: metrics
+        resources:
+          {{- toYaml .Values.buildermgr.resources | nindent 10 }}
+        {{- if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+      serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}

charts/fission-all/templates/buildermgr/podmonitor.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.podMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: buildermgr-monitor
+  {{- if .Values.podMonitor.namespace }}
+  namespace: {{ .Values.podMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.podMonitor.additionalPodMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: buildermgr
+  podMetricsEndpoints:
+  - port: "metrics"
+    path: "/metrics"
+{{- end -}}

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-buildermgr
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/canary-config/deployment.yaml

@@ -0,0 +1,82 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: canaryconfig
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: canaryconfig
+    application: fission-canaryconfig
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: canaryconfig
+      application: fission-canaryconfig
+  template:
+    metadata:
+      labels:
+        svc: canaryconfig
+        application: fission-canaryconfig
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.canaryDeployment.securityContext.enabled }}
+      securityContext: {{- omit .Values.canaryDeployment.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: canaryconfig
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--canaryConfig"]
+        env:
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        resources:
+          {{- toYaml .Values.canaryDeployment.resources | nindent 10 }}
+        {{- if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/config/config.yaml
+          subPath: config.yaml
+        ports:
+          - containerPort: 8080
+            name: metrics
+        {{- if .Values.pprof.enabled }}
+          - containerPort: 6060
+            name: pprof
+        {{- end }}
+  
+      serviceAccountName: fission-canaryconfig
+      volumes:
+      - name: config-volume
+        configMap:
+          name: feature-config
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-fission-cr.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-kubernetes.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/canary-config/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-canaryconfig
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/fission-all/templates/canary-config/servicemonitor.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: canaryconfig-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: canaryconfig
+  endpoints:
+  - targetPort: 8080
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/dashboards/dashboards.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.grafana.dashboards.enable }}
+{{- $files := .Files }}
+{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
+{{- $filename := trimSuffix (ext $path) (base $path) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-%s" $.Chart.Name $filename | trunc 63 | trimSuffix "-" }}
+  namespace: {{ $.Values.grafana.namespace }}
+  labels:
+    grafana_dashboard: "1"
+    created_by: "{{ $.Chart.Name }}"
+data:
+  {{ base $path }}: '{{ $files.Get $path }}'
+---
+{{- end }}
+{{- end }}

charts/fission-all/templates/deployment.yaml

@@ -1,486 +0,0 @@
-{{ if .Values.openshift }}
-
-# For openshift
-
----
-apiVersion: v1
-kind: ProjectRequest
-metadata:
-  name: fission
-  labels:
-    name: fission
-
----
-apiVersion: v1
-kind: ProjectRequest
-metadata:
-  name: {{ .Values.functionNamespace }}
-  labels:
-    name: fission-function
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fission-admin
-  namespace: {{ .Release.Namespace }}
-
----
-apiVersion: v1
-kind: ClusterRole
-metadata:
-  name: fission:fission-admin
-rules:
-- apiGroups:
-  - extensions
-  attributeRestrictions: null
-  resources:
-  - deployments
-  verbs:
-  - create
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ""
-  attributeRestrictions: null
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - update
-
----
-apiVersion: v1
-groupNames: null
-kind: RoleBinding
-metadata:
-  name: fission:fission-admin
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  name: fission:fission-admin
-subjects:
-- kind: ServiceAccount
-  name: fission-admin
-  namespace: {{ .Release.Namespace }}
-userNames:
-- system:serviceaccount:fission:fission-admin
-
-{{ else }}
-
-# For all environments except openshift
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ .Values.functionNamespace }}
-  labels:
-    name: fission-function
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fission-svc
-  namespace: {{ .Release.Namespace }}
-
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-admin
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: fission-svc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: admin
-  apiGroup: rbac.authorization.k8s.io
-
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-function-admin
-  namespace: {{ .Values.functionNamespace }}
-subjects:
-  - kind: ServiceAccount
-    name: fission-svc
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: admin
-  apiGroup: rbac.authorization.k8s.io
-
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-tpr
-subjects:
-- kind: ServiceAccount
-  name: fission-svc
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
-
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
-metadata:
-  name: fission-fetcher-tpr
-subjects:
-- kind: ServiceAccount
-  name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
-
-{{ end }}
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: controller
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: controller
-    spec:
-      containers:
-      - name: controller
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--controllerPort", "8888"]
-      serviceAccount: fission-svc
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: router
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: router
-    spec:
-      containers:
-      - name: router
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--routerPort", "8888", "--poolmgrUrl", "http://poolmgr.{{ .Release.Namespace }}"]
-      serviceAccount: fission-svc
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: poolmgr
-  labels:
-    svc: poolmgr
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: 8888
-  selector:
-    svc: poolmgr
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: poolmgr
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: poolmgr
-    spec:
-      containers:
-      - name: poolmgr
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}", "--fission-namespace", "{{ .Release.Namespace }}"]
-        env:
-        - name: FETCHER_IMAGE
-          value: "{{ .Values.fetcherImage }}:{{ .Values.fetcherImageTag }}"
-        - name: FETCHER_IMAGE_PULL_POLICY
-          value: "{{ .Values.pullPolicy }}"
-      serviceAccount: fission-svc
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: kubewatcher
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: kubewatcher
-    spec:
-      containers:
-      - name: kubewatcher
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--kubewatcher"]
-      serviceAccount: fission-svc
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: influxdb
-  labels:
-    svc: influxdb
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8086
-    targetPort: 8086
-  selector:
-    svc: influxdb
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: influxdb
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: influxdb
-    spec:
-      containers:
-      - name: influxdb
-        image: tutum/influxdb
-        env:
-          - name: PRE_CREATE_DB
-            value: fissionFunctionLog
-          - name: ADMIN_USER
-            valueFrom:
-              secretKeyRef:
-                name: influxdb
-                key: username
-          - name: INFLUXDB_INIT_PWD
-            valueFrom:
-              secretKeyRef:
-                name: influxdb
-                key: password
-
----
-apiVersion: extensions/v1beta1
-kind: DaemonSet
-metadata:
-  name: logger
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  template:
-    metadata:
-      labels:
-        svc: logger
-    spec:
-      containers:
-        - name: logger
-          image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-          imagePullPolicy: {{ .Values.pullPolicy }}
-          command: ["/fission-bundle"]
-          args: ["--logger"]
-          volumeMounts:
-            - name: container-log
-              mountPath: /var/log/containers
-              readOnly: true
-            - name: docker-log
-              mountPath: /var/lib/docker/containers
-              readOnly: true
-            - name: fission-log
-              mountPath: /var/log/fission
-              readOnly: false
-          ports:
-            - containerPort: 1234
-              hostPort: 1234
-              protocol: TCP
-        - name: fluentd
-          image: {{ .Values.logger.fluentdImage }}
-          imagePullPolicy: {{ .Values.pullPolicy }}
-          env:
-            - name: INFLUXDB_ADDRESS
-              value: influxdb
-            - name: INFLUXDB_PORT
-              value: "8086"
-            - name: INFLUXDB_DBNAME
-              value: "fissionFunctionLog"
-            - name: INFLUXDB_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: influxdb
-                  key: username
-            - name: INFLUXDB_PASSWD
-              valueFrom:
-                secretKeyRef:
-                  name: influxdb
-                  key: password
-          volumeMounts:
-            - name: container-log
-              mountPath: /var/log/containers
-              readOnly: true
-            - name: docker-log
-              mountPath: /var/lib/docker/containers
-              readOnly: true
-            - name: fission-log
-              mountPath: /var/log/fission
-              readOnly: false
-      serviceAccount: fission-svc
-      volumes:
-        - name: container-log
-          hostPath:
-              path: /var/log/containers
-        - name: docker-log
-          hostPath:
-              path: /var/lib/docker/containers
-        - name: fission-log
-          hostPath:
-              path: /var/log/fission
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: timer
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: timer
-    spec:
-      containers:
-      - name: timer
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--timer"]
-      serviceAccount: fission-svc
-
-#
-# This is commented out until fission-ui allows configuring the
-# namespace. Right now it just crashes if Release.Namespace !=
-# "fission".
-#
-#---
-#apiVersion: extensions/v1beta1
-#kind: Deployment
-#metadata:
-#  name: fission-ui
-#  labels:
-#    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-#spec:
-#  replicas: 1
-#  template:
-#    metadata:
-#      labels:
-#        svc: fission-ui
-#    spec:
-#      containers:
-#      - name: nginx
-#        image: {{ .Values.fissionUiImage }}
-#      - name: kubectl-proxy
-#        image: lachlanevenson/k8s-kubectl
-#        args: ["proxy", "--port", "8001", "--address", "127.0.0.1"]
-#      serviceAccount: fission-svc
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  labels:
-    svc: nats-streaming
-  name: nats-streaming
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: nats-streaming
-    spec:
-      containers:
-      - name: nats-streaming
-        image: nats-streaming
-        args: ["--cluster_id", "{{ .Values.nats.clusterID }}", "--auth", "{{ .Values.nats.authToken }}"]
-        ports:
-        - containerPort: 4222
-          hostPort: 4222
-          protocol: TCP
-
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: mqtrigger
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        svc: mqtrigger
-    spec:
-      containers:
-      - name: mqtrigger
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--mqt"]
-        env:
-        - name: MESSAGE_QUEUE_TYPE
-          value: nats-streaming
-        - name: MESSAGE_QUEUE_URL
-          value: nats://{{ .Values.nats.authToken }}@nats-streaming:4222
-      serviceAccount: fission-svc

charts/fission-all/templates/executor/configmap.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.runtimePodSpec.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: runtime-podspec-patch
+data: 
+  runtime-podspec-patch.yaml: |
+    {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
+{{- end -}}

charts/fission-all/templates/executor/deployment.yaml

@@ -0,0 +1,142 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: executor
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: executor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: executor
+  template:
+    metadata:
+      labels:
+        svc: executor
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.executor.securityContext.enabled }}
+      securityContext: {{- omit .Values.executor.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: executor
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--executorPort", "8888"]
+        env:
+        - name: FETCHER_IMAGE
+          value: {{ include "fetcherImage" . | quote }}
+        - name: FETCHER_IMAGE_PULL_POLICY
+          value: "{{ .Values.pullPolicy }}"
+        - name: RUNTIME_IMAGE_PULL_POLICY
+          value: "{{ .Values.pullPolicy }}"
+        - name: ADOPT_EXISTING_RESOURCES
+          value: {{ .Values.executor.adoptExistingResources | default false | quote }}
+        - name: POD_READY_TIMEOUT
+          value: {{ .Values.executor.podReadyTimeout | default false | quote }}
+        - name: ENABLE_ISTIO
+          value: "{{ .Values.enableIstio }}"
+        - name: FETCHER_MINCPU
+          value: {{ .Values.fetcher.resource.cpu.requests | quote }}
+        - name: FETCHER_MINMEM
+          value: {{ .Values.fetcher.resource.mem.requests | quote }}
+        - name: FETCHER_MAXCPU
+          value: {{ .Values.fetcher.resource.cpu.limits | quote }}
+        - name: FETCHER_MAXMEM
+          value: {{ .Values.fetcher.resource.mem.limits | quote }}
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        - name: OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.objectReaperInterval | quote }}
+        {{- if .Values.executor.poolmgr.objectReaperInterval }}
+        - name: POOLMGR_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.poolmgr.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.newdeploy.objectReaperInterval }}
+        - name: NEWDEPLOY_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.newdeploy.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.container.objectReaperInterval }}
+        - name: CONTAINER_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.container.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
+        {{- end}}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
+        - name: HELM_RELEASE_NAME
+          value: {{ .Release.Name | quote }}
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        resources:
+          {{- toYaml .Values.executor.resources | nindent 10 }}
+        readinessProbe:
+          httpGet:
+            path: "/healthz"
+            port: 8888
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          failureThreshold: 30
+        livenessProbe:
+          httpGet:
+            path: "/healthz"
+            port: 8888
+          initialDelaySeconds: 35
+          periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
+        ports:
+        - containerPort: 8080
+          name: metrics
+        - containerPort: 8888
+          name: http
+        {{- if .Values.pprof.enabled }}
+        - containerPort: 6060
+          name: pprof
+        {{- end }}
+        {{- if .Values.executor.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.executor.terminationMessagePath }}
+        {{- else if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.executor.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.executor.terminationMessagePolicy }}
+        {{- else if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+      serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
+{{- if .Values.executor.priorityClassName }}
+      priorityClassName: {{ .Values.executor.priorityClassName }}
+{{- else if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-executor
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/executor/servicemonitor.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: executor-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: executor
+  endpoints:
+  - targetPort: 8080
+{{- end -}}

charts/fission-all/templates/executor/svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: executor
+  labels:
+    svc: executor
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8888
+  selector:
+    svc: executor

charts/fission-all/templates/fluentbit/fluentbit.yaml

@@ -0,0 +1,193 @@
+{{- if .Values.influxdb.enabled }}
+# Fluentbit deployment for Fission
+#
+# Requires:
+# - service account: fission-svc
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-fission-fluentbit
+data:
+{{- if .Files.Get "config/fluentbit.conf" }}
+  fluentbit.conf: |
+{{ .Files.Get "config/fluentbit.conf" | indent 3 }}
+{{ else }}
+{{ fail "invalid chart" }}
+{{- end }}
+{{- if .Files.Get "config/parsers.conf" }}
+  parsers.conf: |
+{{ .Files.Get "config/parsers.conf" | indent 3 }}
+{{ else }}
+{{ fail "invalid chart" }}
+{{- end }}
+{{- if .Values.logger.podSecurityPolicy.enabled }}
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+spec:
+  privileged: true
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  volumes:
+  - '*'
+  {{- if .Values.logger.podSecurityPolicy.additionalCapabilities }}
+  allowedCapabilities:
+  {{- range .Values.logger.podSecurityPolicy.additionalCapabilities }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: psp:{{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ .Release.Name }}-fission-logger-privileged
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: psp:{{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+roleRef:
+  kind:     Role
+  name:     psp:{{ .Release.Name }}-fission-logger-privileged
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind:      ServiceAccount
+  name:      default
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: logger
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+spec:
+  selector:
+    matchLabels:
+      svc: logger
+  template:
+    metadata:
+      labels:
+        svc: logger
+    spec:
+      initContainers:
+        - name: init
+          image: {{ .Values.busyboxImage | quote }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          command: ['mkdir', '-p', '/var/log/fission']
+          volumeMounts:
+            - name: container-log
+              mountPath: /var/log/
+              readOnly: false
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
+      containers:
+        - name: logger
+          image: {{ include "fission-bundleImage" . | quote }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            {{- include "fission-resource-namespace.envs" . | indent 12 }}
+          command: ["/fission-bundle"]
+          args: ["--logger"]
+          volumeMounts:
+            - name: container-log
+              mountPath: /var/log/
+              readOnly: false
+            - name: docker-log
+              mountPath: /var/lib/docker/containers
+              readOnly: true
+          securityContext:
+            {{- toYaml .Values.logger.securityContext | nindent 12 }}
+        - name: fluentbit
+{{- if .Values.repository }}
+          image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
+{{ else }}
+          image: "{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
+{{- end }}
+          imagePullPolicy: {{ .Values.pullPolicy }}
+          # CMD ["/fluent-bit/bin/fluent-bit", "-c", "/fluent-bit/etc/fluent-bit.conf"]
+          command: ["/fluent-bit/bin/fluent-bit", "-c", "/fluent-bit/etc/fluentbit.conf"]
+          env:
+            - name: INFLUXDB_ADDRESS
+              value: influxdb
+            - name: INFLUXDB_PORT
+              value: "8086"
+            - name: INFLUXDB_DBNAME
+              value: "fissionFunctionLog"
+            - name: INFLUXDB_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: influxdb
+                  key: username
+            - name: INFLUXDB_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: influxdb
+                  key: password
+            - name: LOG_PATH
+              value: /var/log/fission/*.log
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
+          volumeMounts:
+            - name: container-log
+              mountPath: /var/log/
+              readOnly: false
+            - name: docker-log
+              mountPath: /var/lib/docker/containers
+              readOnly: true
+            - name: fluentbit-config
+              mountPath: /fluent-bit/etc/
+              readOnly: true
+      serviceAccountName: fission-fluentbit
+      volumes:
+        - name: container-log
+          hostPath:
+            path: /var/log/
+        - name: docker-log
+          hostPath:
+            path: /var/lib/docker/containers
+        # Fluentbit config location: /fluent-bit/etc/*.conf
+        - name: fluentbit-config
+          configMap:
+            name: {{ .Release.Name }}-fission-fluentbit
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  updateStrategy:
+    type: RollingUpdate
+{{- end }}

charts/fission-all/templates/fluentbit/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/fluentbit/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fluentbit
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/influxdb/deployment.yaml

@@ -0,0 +1,59 @@
+{{- if .Values.influxdb.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: influxdb
+  labels:
+    svc: influxdb
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8086
+    targetPort: 8086
+  selector:
+    svc: influxdb
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: influxdb
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: influxdb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: influxdb
+  template:
+    metadata:
+      labels:
+        svc: influxdb
+    spec:
+      containers:
+      - name: influxdb
+        image: {{ .Values.influxdb.image | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        env:
+        - name: INFLUXDB_DB
+          value: fissionFunctionLog
+        - name: INFLUXDB_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              name: influxdb
+              key: username
+        - name: INFLUXDB_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: influxdb
+              key: password
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}
+{{- end }}

charts/fission-all/templates/influxdb/secret.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.influxdb.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -7,4 +8,5 @@ metadata:
 type: Opaque
 data:
   username: {{ .Values.logger.influxdbAdmin | b64enc | quote }}
-  password: {{ randAlphaNum 20 | b64enc | quote }}
+  password: {{ randAlphaNum 20 | b64enc | quote }}
+{{- end }}

charts/fission-all/templates/kubewatcher/deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubewatcher
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: kubewatcher
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: kubewatcher
+  template:
+    metadata:
+      labels:
+        svc: kubewatcher
+    spec:
+      {{- if .Values.kubewatcher.securityContext.enabled }}
+      securityContext: {{- omit .Values.kubewatcher.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: kubewatcher
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--kubewatcher", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
+        env:
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        resources:
+          {{- toYaml .Values.kubewatcher.resources | nindent 10 }}
+        {{- if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+      serviceAccountName: fission-kubewatcher
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kubewatcher
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/misc-functions/cm.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: feature-config
+  namespace: {{ .Release.Namespace }}
+data:
+  "config.yaml": {{ include "config" . | b64enc }}

charts/fission-all/templates/misc-functions/namespace.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.createNamespace }}
+{{- if and (ne .Values.functionNamespace "default") (ne .Values.functionNamespace "") }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ template "fission-function-ns" . }}
+  labels:
+    name: fission-function
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    {{- if .Values.enableIstio }}
+    istio-injection: enabled
+    {{- end }}
+{{- end}}
+
+---
+
+{{- if and (ne .Values.builderNamespace "default") (ne .Values.builderNamespace "") }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ template "fission-builder-ns" . }}
+  labels:
+    name: fission-builder
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    {{- if .Values.enableIstio }}
+    istio-injection: enabled
+    {{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/role.yaml

@@ -0,0 +1,12 @@
+{{/* 
+Passing namespace as an argument to the "fissionFunction.roles" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -0,0 +1,12 @@
+{{/* 
+Passing namespace as an argument to the "fissionFunction.rolebindings" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/serviceaccount.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fetcher
+  namespace: {{ template "fission-function-ns" . }}
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-builder
+  namespace: {{ template "fission-builder-ns" . }}

charts/fission-all/templates/mqt-fission-kafka/deployment.yaml

@@ -0,0 +1,108 @@
+{{- if .Values.kafka.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mqtrigger-kafka
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: mqtrigger
+    messagequeue: kafka
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: mqtrigger
+      messagequeue: kafka
+  template:
+    metadata:
+      labels:
+        svc: mqtrigger
+        messagequeue: kafka
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      containers:
+      - name: mqtrigger
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
+        ports:
+          - containerPort: 8080
+            name: metrics
+        env:
+        - name: MESSAGE_QUEUE_TYPE
+          value: kafka
+        - name: MESSAGE_QUEUE_URL
+          value: "{{.Values.kafka.brokers}}"
+        - name: MESSAGE_QUEUE_KAFKA_VERSION
+          value: "{{.Values.kafka.version}}"
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        # TLS authentication is TLS with authentication (2 way)
+        # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
+        {{- if .Values.kafka.authentication.tls.enabled }}
+        - name: TLS_ENABLED
+          value: "true"
+        - name: MESSAGE_QUEUE_SECRETS
+          value: /etc/fission/secrets
+        - name: INSECURE_SKIP_VERIFY
+          value: "{{ .Values.kafka.authentication.tls.insecureSkipVerify }}"
+        volumeMounts:
+        - name: kafka-secrets
+          mountPath: /etc/fission/secrets
+        {{- end }}
+        {{- if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+      serviceAccountName: fission-kafka
+      {{- if .Values.kafka.authentication.tls.enabled }}
+      volumes:
+      - name: kafka-secrets
+        secret:
+          secretName: mqtrigger-kafka-secrets
+      {{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+
+
+---
+{{- if .Values.kafka.authentication.tls.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mqtrigger-kafka-secrets
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+data:
+  {{- if .Files.Get  (printf "%s" .Values.kafka.authentication.tls.caCert) }}
+  caCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.caCert) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. CA Certificate not found." }}
+  {{- end }}
+  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) }}
+  userCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. User Certificate not found." }}
+  {{- end }}
+  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) }}
+  userKey: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. User Key not found." }}
+  {{- end }}
+{{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/podmonitor.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.podMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: mqt-fission-kafka-monitor
+  {{- if .Values.podMonitor.namespace }}
+  namespace: {{ .Values.podMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.podMonitor.additionalPodMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: mqtrigger
+  podMetricsEndpoints:
+  - port: "metrics"
+    path: "/metrics"
+{{- end -}}

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}