Bump golang.org/x/net (#3186)

Bumps the go_modules group with 1 update in the /test/tests/websocket directory: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.25.0 to 0.36.0
- [Commits](https://github.com/golang/net/compare/v0.25.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.codecov.yml

@@ -1,11 +1,9 @@
 ignore:
   - "charts"
-  - "demos"
-  - "Documentation"
-  - "examples"
-  - "test"
+  - "test/"
   - "tools"
-  - "pkg/apis/genclient"
+  - "pkg/generated" # generated code
+  - "pkg/apis/*/*/zz_generated*" # generated code
 coverage:
   status:
     project:

.github/ISSUE_TEMPLATE/bug_report.md

@@ -17,7 +17,7 @@ assignees: ''
 <!-- If you tested with other services, for example Istio, please also provide the version of service as well. -->
 
 <pre>
-$ fission --version
+$ fission version
 $ kubectl version
 </pre>
 

.github/dependabot.yml

@@ -0,0 +1,36 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /cmd/builder
+      - /cmd/fetcher
+      - /cmd/fission-bundle
+      - /cmd/preupgradechecks
+      - /cmd/reporter
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      docker-images:
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"

.github/workflows/codeql.yaml

@@ -3,41 +3,48 @@ name: Code Scanning
 on:
   push:
     branches:
-      - master
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
+      - main
+      - '!dependabot/**'
   pull_request:
     branches:
-      - master
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
+      - main
   schedule:
     - cron: "0 0 * * 0"
-  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-codeql-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   CodeQL-Build:
-    runs-on: ubuntu-latest
-
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    runs-on: ubuntu-24.04
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
-      - name: Check out code
-        uses: actions/checkout@v2
-
-      - uses: actions/cache@v2
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: setup go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           languages: go
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2

.github/workflows/dependency-review.yml

@@ -0,0 +1,31 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1

.github/workflows/greetings.yml

@@ -1,23 +0,0 @@
-name: Greetings
-
-on: [pull_request, issues]
-
-jobs:
-  greeting:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-    - uses: actions/first-interaction@v1
-      if: env.month != 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! ✨😊'
-        pr-message: 'Thank you for contributing to this project! ✨😊'
-    - uses: actions/first-interaction@v1
-      if: env.month == 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! Happy Hacktoberfest!!! ✨🎃👕✨'
-        pr-message: 'Thank you for contributing to this project. Happy Hacktoberfest!!! ✨🎃👕'

.github/workflows/lint-dashboards.yaml

@@ -0,0 +1,37 @@
+name: Lint dashboards
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'charts/fission-all/dashboards/**.json'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'charts/fission-all/dashboards/**.json'
+
+permissions:
+  contents: read
+
+jobs:
+  lint-dashboards:
+    runs-on: ubuntu-24.04
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+
+      - name: Run dashboard linter
+        run: ./hack/lint-dashboards.sh

.github/workflows/lint.yaml

@@ -3,76 +3,81 @@ name: Lint and Unit tests
 on:
   push:
     branches:
-      - master
+      - main
     paths:
-      - '**.go'
+      - "**.go"
       - go.mod
       - go.sum
   pull_request:
     branches:
-      - master
+      - main
     paths:
-      - '**.go'
+      - "**.go"
       - go.mod
       - go.sum
-  workflow_dispatch:
+
+env:
+  GOLANGCI_LINT_VERSION: v2.6.0
+  GOLANGCI_LINT_TIMEOUT: 5m
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-lint-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
-
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-24.04
+    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
-      - name: Set up Go
-        uses: actions/setup-go@v2
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
-          go-version: 1.18.1
+          egress-policy: audit
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - uses: actions/cache@v2
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
+          go-version-file: "go.mod"
+          cache: true
 
       - name: Verify dependencies
         run: |
           go mod verify
           go mod download
 
-          LINT_VERSION=1.45.0
-          curl -fsSL https://github.com/golangci/golangci-lint/releases/download/v${LINT_VERSION}/golangci-lint-${LINT_VERSION}-linux-amd64.tar.gz | \
-            tar xz --strip-components 1 --wildcards \*/golangci-lint
-          mkdir -p bin && mv golangci-lint bin/
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          skip-cache: true
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          args: --timeout=${{ env.GOLANGCI_LINT_TIMEOUT }}
 
-      - name: Run checks
+      - name: Detect git changes
+        if: always()
         run: |
-          STATUS=0
-          assert-nothing-changed() {
-            local diff
-            "$@" >/dev/null || return 1
-            if ! diff="$(git diff -U1 --color --exit-code)"; then
-              printf '\e[31mError: running `\e[1m%s\e[22m` results in modifications that you must check into version control:\e[0m\n%s\n\n' "$*" "$diff" >&2
-              git checkout -- .
-              STATUS=1
-            fi
-          }
-
-          assert-nothing-changed go fmt ./...
-          assert-nothing-changed go mod tidy
-
-          bin/golangci-lint run --out-format=github-actions --timeout=5m || STATUS=$?
-
-          exit $STATUS
+          if [[ $(git diff --stat) != '' ]]; then
+            echo -e '❌ \033[0;31m. Fix lint changes.\033[0m'
+            git diff --color
+            exit 1
+          else
+            echo '✔ No issues detected. Have a nice day :-)'
+          fi
 
       - name: Run unit tests
         run: ./hack/runtests.sh
 
       - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
-          token: ${{secrets.CODECOV_TOKEN}}
+          token: ${{ secrets.CODECOV_TOKEN }}
           flags: unittests
           file: ./coverage.txt

.github/workflows/push_pr.yaml

@@ -3,7 +3,8 @@ name: Fission CI
 on:
   push:
     branches:
-      - master
+      - main
+      - '!dependabot/**'
     paths:
       - "**.go"
       - "charts/**"
@@ -12,63 +13,77 @@ on:
       - go.sum
   pull_request:
     branches:
-      - master
+      - main
     paths:
       - "**.go"
       - "charts/**"
       - "test/**"
       - go.mod
       - go.sum
-  workflow_dispatch:
+
+env:
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.30.0
+  KIND_CLUSTER_NAME: kind
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-ci-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   # Job to run change detection
   integration-test:
     runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     strategy:
       fail-fast: false
       matrix:
-        kindversion: ["v1.19.11", "v1.20.7", "v1.21.1"]
-        os: [ubuntu-latest]
+        kindversion: ["v1.28.15", "v1.30.8", "v1.32.0"]
+        os: [ubuntu-24.04]
     steps:
-      - name: setup go
-        uses: actions/setup-go@v2
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
-          go-version: 1.18.1
+          egress-policy: audit
 
       - name: Checkout sources
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: setup go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
 
       - name: Checkout sources
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: fission/examples
           path: examples
 
-      - uses: actions/cache@v2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
       - name: Helm installation
-        uses: Azure/setup-helm@v1
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
-          version: v3.3.4
+          version: ${{ env.HELM_VERSION }}
 
-      - name: Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+      - name: Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
-          image: kindest/node:${{ matrix.kindversion }}
-          version: v0.11.1
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
           config: kind.yaml
 
       - name: Configuring and testing the Installation
         run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl get nodes
           sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
 
       - name: Helm chart lint
         run: |
@@ -76,21 +91,23 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           install-only: true
+          version: "~> v2"
 
       - name: Setup Prometheus Stack
         run: |
           helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
           kubectl create ns monitoring
-          helm install monitoring prometheus-community/prometheus -n monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
 
       - name: Build and Install Fission CLI
         run: |
@@ -100,6 +117,7 @@ jobs:
           sudo chmod +x /usr/local/bin/fission
 
       - name: Build and Install Fission
+        timeout-minutes: 10
         run: |
           kubectl create ns fission
           make create-crds
@@ -108,37 +126,208 @@ jobs:
       - name: Port-forward fission components
         run: |
           kubectl port-forward svc/router 8888:80 -nfission &
-          kubectl port-forward svc/controller 8889:80 -nfission &
 
       - name: Get fission version
+        timeout-minutes: 10
         run: |
           fission version
 
       - name: Integration tests
+        timeout-minutes: 90
         run: ./test/kind_CI.sh
 
       - name: Collect Fission Dump
+        timeout-minutes: 5
         if: ${{ always() }}
         run: |
           command -v fission && fission support dump
 
       - name: Kind export logs
+        timeout-minutes: 10
         if: ${{ always() }}
         run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
 
       - name: Archive fission dump
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
           retention-days: 5
 
-      - name: Archive kind logs
+      - name: Archive prometheus dump
+        timeout-minutes: 10
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
           retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.19.16"]
+        os: [ubuntu-24.04]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout sources
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: setup go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.github/workflows/release.yaml

@@ -0,0 +1,275 @@
+name: Create Draft release
+on:
+  push:
+    tags:
+      - v1.**
+      - v2.**
+
+env:
+  KIND_VERSION: v0.30.0
+  KIND_NODE_IMAGE_TAG: v1.28.15
+  KIND_CLUSTER_NAME: kind
+  COSIGN_VERSION: v3.0.2
+
+jobs:
+  create-draft-release:
+    name: Create Draft Release with Goreleaser
+    outputs:
+      hashes: ${{ steps.binary.outputs.hashes }}
+      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
+      version: ${{ steps.get_version.outputs.VERSION }}
+    permissions:
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
+      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
+      id-token: write # for cosign to sign the image and binary
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
+
+      - name: Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        with:
+          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
+          version: ${{ env.KIND_VERSION }}
+          config: kind.yaml
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Check cosign install!
+        run: cosign version
+
+      - uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 #v0.20.9
+
+      - name: Generate yaml for manifest, Minikube and Openshift installation
+        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
+        env:
+          VERSION: ${{ steps.get_version.outputs.VERSION }}
+        shell: bash
+
+      - name: Run GoReleaser
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          version: "~> v2"
+          args: release
+        env:
+          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKER_CLI_EXPERIMENTAL: "enabled"
+
+      - name: Generate binary hashes
+        id: binary
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+
+          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+      - name: Image digest
+        id: image
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
+            split("\n")
+            | map(select(. != ""))
+            | map(
+                split("@")
+                | {
+                    "image": .[0] | split(":")[0],
+                    "checksum": .[1]
+                  }
+              )')
+          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"
+
+  binary-provenance:
+    name: Create Binary Provenance
+    needs: [create-draft-release]
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # Do not use commit hash
+    with:
+      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
+      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
+      upload-assets: true # upload to a new release
+      draft-release: true # create a draft release
+
+  image-provenance-ghcr:
+    name: Create Image Provenance
+    needs: [create-draft-release]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: read
+      id-token: write
+      packages: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # Do not use commit hash
+    with:
+      image: ${{ fromJson(toJson(matrix)).image }}
+      digest: ${{ fromJson(toJson(matrix)).checksum }}
+      registry-username: ${{ github.actor }}
+    secrets:
+      registry-password: ${{ secrets.GITHUB_TOKEN }}
+
+  image-sbom-ghcr:
+    name: Create SBOM for container images
+    # Goreleaser does not support generating SBOM for container images.
+    needs: [create-draft-release]
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: write
+      id-token: write
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Trivy in fs mode to generate SBOM
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        with:
+          scan-type: "fs"
+          format: "spdx-json"
+          output: "spdx.sbom.json"
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+      - name: Sign image and sbom
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
+          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
+
+  binary-provenance-verification-with-slsa-verifier:
+    name : Verify Binary Provenance
+    needs: [create-draft-release, binary-provenance]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write # To download the assets from draft release.
+    steps:
+      - name: Install the verifier
+        uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1
+
+      - name: Download assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "repo=$GITHUB_REPOSITORY"
+          echo "ref=$VERSION"
+          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
+
+      - name: Verify assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "CHECKSUMS=$CHECKSUMS"
+          echo "PROVENANCE=$PROVENANCE"
+          checksums=$(echo "$CHECKSUMS" | base64 -d)
+          while read -r line; do
+              fn=$(echo $line | cut -d ' ' -f2)
+              echo "Verifying $fn"
+              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
+              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
+                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
+                                            --source-tag "$VERSION" \
+                                            "$fn"
+          done <<<"$checksums"
+
+  image-provenance-verification-with-cosign:
+    name: Verify Image Provenance
+    needs: [create-draft-release, image-provenance-ghcr]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    runs-on: ubuntu-24.04
+    permissions: read-all
+    steps:
+      - name: Login
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Verify image
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          echo "Verifying $IMAGE@$DIGEST"
+          cosign verify-attestation \
+             --type slsaprovenance \
+             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
+             $IMAGE@$DIGEST

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '41 18 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-24.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        with:
+          sarif_file: results.sarif

.github/workflows/upgrade_test.yaml

@@ -3,100 +3,131 @@ name: Fission CI upgrade
 on:
   push:
     branches:
-      - master
+      - main
+      - '!dependabot/**'
     paths:
-      - '**.go'
-      - 'charts/**'
-      - 'test/**'
+      - "**.go"
+      - "charts/**"
+      - "test/**"
       - go.mod
       - go.sum
   pull_request:
     branches:
-      - master
+      - main
     paths:
-      - '**.go'
-      - 'charts/**'
-      - 'test/**'
+      - "**.go"
+      - "charts/**"
+      - "test/**"
       - go.mod
       - go.sum
-  workflow_dispatch:
+
+env:
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.26.0
+  KIND_CLUSTER_NAME: kind
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-upgrade-test-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   upgrade-test:
     runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     strategy:
       fail-fast: false
       matrix:
-        kindimage : [ 'kindest/node:v1.19.11' ]
-        os: [ ubuntu-latest ]
+        kindversion: ["v1.28.15"]
+        os: [ubuntu-24.04]
     steps:
-    - name: Setup go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.18.1
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
 
-    - name: Checkout action sources
-      uses: actions/checkout@v2.3.4
+      - name: Checkout action sources
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-    - uses: actions/cache@v2
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
+      - name: Setup go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
 
-    - name: Setup Helm
-      uses: Azure/setup-helm@v1
-      with:
-        version: v3.3.4
+      - name: Setup Helm
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: ${{ env.HELM_VERSION }}
 
-    - name: Setup Kind Clutser
-      uses: engineerd/setup-kind@v0.5.0
-      with:
-        image:  ${{ matrix.kindimage }}
-        version: v0.11.1
+      - name: Setup Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
 
-    - name: Install GoReleaser
-      uses: goreleaser/goreleaser-action@v2
-      with:
-        install-only: true
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          install-only: true
+          version: "~> v2"
 
-    - name: Setup kubectl & fetch node information
-      run: |
-        kubectl cluster-info --context kind-kind
-        kubectl get nodes
-        kubectl get storageclasses.storage.k8s.io
+      - name: Setup kubectl & fetch node information
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          kubectl get storageclasses.storage.k8s.io
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config set-context --current --namespace=default
+          kubectl config view
 
-    - name: Dump system info
-      run: |
-        source ./test/upgrade_test/fission_objects.sh dump_system_info
+      - name: Dump system info
+        run: |
+          source ./test/upgrade_test/fission_objects.sh dump_system_info
 
-    - name: Install and configure previous stable fission
-      run: |
-        source ./test/upgrade_test/fission_objects.sh install_stable_release \
-        && create_fission_objects \
-        && test_fission_objects
+      - name: Install and configure previous stable fission
+        run: |
+          source ./test/upgrade_test/fission_objects.sh install_stable_release \
+          && create_fission_objects \
+          && test_fission_objects
 
-    - name: Upgrade fission to latest
-      run: |
-        source ./test/upgrade_test/fission_objects.sh build_docker_images \
-        && kind_image_load \
-        && install_current_release \
-        && install_fission_cli
+      - name: Upgrade fission to latest
+        run: |
+          source ./test/upgrade_test/fission_objects.sh build_docker_images \
+          && kind_image_load \
+          && install_current_release \
+          && install_fission_cli
 
-    - name: Test previously created fission objects with new release
-      run: |
-        source ./test/upgrade_test/fission_objects.sh test_fission_objects
+      - name: Test previously created fission objects with new release
+        timeout-minutes: 10
+        run: |
+          source ./test/upgrade_test/fission_objects.sh test_fission_objects
 
-    - name: Collect Fission Dump
-      if: ${{ always() }}
-      run: |
-        command -v fission && fission support dump
+      - name: Collect Fission Dump
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
 
-    - name: Archive fission dump
-      if: ${{ failure() }}
-      uses: actions/upload-artifact@v2
-      with:
-        name: fission-dump
-        path: fission-dump/*.zip
-        retention-days: 5
+      - name: Kind export logs
+        if: ${{ always() }}
+        run: |
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Archive fission dump
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive kind logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.gitignore

@@ -9,6 +9,7 @@ cmd/reporter/reporter
 
 # Logs
 test/logs/
+test/e2e/cli/fission-dump/
 
 # Pycharm IDE
 .idea
@@ -33,3 +34,10 @@ local/
 build/
 dist/
 manifest/
+.vscode/
+coverage.txt
+
+cosign.key
+
+# Dumps
+.dumps/

.golangci.yaml

@@ -1,38 +1,51 @@
+version: "2"
 linters:
   enable:
-    # Default linter
-    - deadcode
     - errcheck
-    - gosimple
     - govet
     - ineffassign
-    - staticcheck
-    - structcheck
-    - typecheck
-    - unused
-    - varcheck
-    # Additional linters
-    - gofmt
-    - goimports
     - misspell
     - nakedret
+    - promlinter
     - unconvert
-    # Enable in future
-    # - bodyclose
-    # - dogsled
-    # - dupl
-    # - gosec
-    # - ifshort
-    # - nilerr
-    # - prealloc
-    # - revive
-    # - unparam
-    # - wrapcheck
-    # - gocritic
-linters-settings:
-  errcheck:
-    ignore: go.uber.org/zap:Sync
-  goimports:
-    # put imports beginning with prefix after 3rd-party packages;
-    # it's a comma-separated list of prefixes
-    local-prefixes: github.com/fission/fission
+    - unused
+    - staticcheck
+  settings:
+    errcheck:
+      exclude-functions:
+        - (*go.uber.org/zap.Logger).Sync
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+    rules:
+      - linters:
+        - staticcheck
+        text: "QF1008"
+      - linters:
+          - staticcheck
+        text: "QF1001"
+      - linters:
+          - staticcheck
+        text: "QF1003"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/fission/fission
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yml

@@ -1,14 +1,18 @@
+version: 2
+
+env:
+  - GHCR_REPO=ghcr.io/fission
+
 project_name: fission
 release:
   github:
     owner: fission
     name: fission
-  prerelease: true
+  prerelease: "true"
   draft: true
   header: |
     Release Highlights: https://fission.io/docs/releases/{{ .Tag }}/
     Install Guide: https://fission.io/docs/installation/
-    Full Changelog: https://github.com/fission/fission/blob/master/CHANGELOG.md
   extra_files:
     - glob: ./manifest/charts/*
     - glob: ./manifest/yamls/*
@@ -17,7 +21,7 @@ before:
   hooks:
     - go mod tidy
 snapshot:
-  name_template: "{{ .Tag }}"
+  version_template: "{{ .Tag }}"
 builds:
   - &build-linux
     id: builder
@@ -27,9 +31,9 @@ builds:
       - -X github.com/fission/fission/pkg/info.BuildDate={{.Date}}
       - -X github.com/fission/fission/pkg/info.Version={{.Tag}}
     gcflags:
-      - all=-trimpath={{.Env.PWD}}
+      - all=-trimpath={{ if index .Env "GITHUB_WORKSPACE"}}{{ .Env.GITHUB_WORKSPACE }}{{ else }}{{ .Env.PWD }}{{ end }}
     asmflags:
-      - all=-trimpath={{.Env.PWD}}
+      - all=-trimpath={{ if index .Env "GITHUB_WORKSPACE"}}{{ .Env.GITHUB_WORKSPACE }}{{ else }}{{ .Env.PWD }}{{ end }}
     env:
       - CGO_ENABLED=0
     goos:
@@ -37,9 +41,6 @@ builds:
     goarch:
       - amd64
       - arm64
-      - arm
-    goarm:
-      - 7
     binary: builder
     dir: ./cmd/builder
   - <<: *build-linux
@@ -61,12 +62,6 @@ builds:
     ignore:
       - goos: windows
         goarch: arm64
-      - goos: darwin
-        goarch: arm
-        goarm: 7
-      - goos: windows
-        goarch: arm
-        goarm: 7
   - <<: *build-linux
     id: pre-upgrade-checks
     binary: pre-upgrade-checks
@@ -83,42 +78,87 @@ dockers:
     ids:
       - builder
     image_templates:
-      - "fission/builder:latest-amd64"
-      - "fission/builder:{{ .Tag }}-amd64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/amd64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - fetcher
     image_templates:
-      - "fission/fetcher:latest-amd64"
-      - "fission/fetcher:{{ .Tag }}-amd64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - fission-bundle
     image_templates:
-      - "fission/fission-bundle:latest-amd64"
-      - "fission/fission-bundle:{{ .Tag }}-amd64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - pre-upgrade-checks
     image_templates:
-      - "fission/pre-upgrade-checks:latest-amd64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - reporter
     image_templates:
-      - "fission/reporter:latest-amd64"
-      - "fission/reporter:{{ .Tag }}-amd64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - &docker-arm64
     use: buildx
     goos: linux
@@ -126,145 +166,175 @@ dockers:
     ids:
       - builder
     image_templates:
-      - "fission/builder:latest-arm64"
-      - "fission/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-arm64
     ids:
       - fetcher
     image_templates:
-      - "fission/fetcher:latest-arm64"
-      - "fission/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
-  - <<: *docker-arm64
-    ids:
-      - fission-bundle
-    image_templates:
-      - "fission/fission-bundle:latest-arm64"
-      - "fission/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
-  - <<: *docker-arm64
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "fission/pre-upgrade-checks:latest-arm64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
-  - <<: *docker-arm64
-    ids:
-      - reporter
-    image_templates:
-      - "fission/reporter:latest-arm64"
-      - "fission/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
-  - &docker-armv7
-    use: buildx
-    goos: linux
-    goarch: arm
-    goarm: 7
-    ids:
-      - builder
-    image_templates:
-      - "fission/builder:latest-armv7"
-      - "fission/builder:{{ .Tag }}-armv7"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
+    dockerfile: cmd/fetcher/Dockerfile
     build_flag_templates:
-      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - fetcher
-    image_templates:
-      - "fission/fetcher:latest-armv7"
-      - "fission/fetcher:{{ .Tag }}-armv7"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
-  - <<: *docker-armv7
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
+  - <<: *docker-arm64
     ids:
       - fission-bundle
     image_templates:
-      - "fission/fission-bundle:latest-armv7"
-      - "fission/fission-bundle:{{ .Tag }}-armv7"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
-  - <<: *docker-armv7
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
+  - <<: *docker-arm64
     ids:
       - pre-upgrade-checks
     image_templates:
-      - "fission/pre-upgrade-checks:latest-armv7"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
-  - <<: *docker-armv7
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
+  - <<: *docker-arm64
     ids:
       - reporter
     image_templates:
-      - "fission/reporter:latest-armv7"
-      - "fission/reporter:{{ .Tag }}-armv7"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
 docker_manifests:
-  - name_template: fission/builder:{{ .Tag }}
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
     image_templates:
-      - fission/builder:{{ .Tag }}-amd64
-      - fission/builder:{{ .Tag }}-arm64
-      - fission/builder:{{ .Tag }}-armv7
-  - name_template: fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
     image_templates:
-      - fission/fetcher:{{ .Tag }}-amd64
-      - fission/fetcher:{{ .Tag }}-arm64
-      - fission/fetcher:{{ .Tag }}-armv7
-  - name_template: fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
     image_templates:
-      - fission/fission-bundle:{{ .Tag }}-amd64
-      - fission/fission-bundle:{{ .Tag }}-arm64
-      - fission/fission-bundle:{{ .Tag }}-armv7
-  - name_template: fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
     image_templates:
-      - fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-      - fission/pre-upgrade-checks:{{ .Tag }}-armv7
-  - name_template: fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
     image_templates:
-      - fission/reporter:{{ .Tag }}-amd64
-      - fission/reporter:{{ .Tag }}-arm64
-      - fission/reporter:{{ .Tag }}-armv7
-  - name_template: fission/builder:latest
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
     image_templates:
-      - fission/builder:latest-amd64
-      - fission/builder:latest-arm64
-      - fission/builder:latest-armv7
-  - name_template: fission/fetcher:latest
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
     image_templates:
-      - fission/fetcher:latest-amd64
-      - fission/fetcher:latest-arm64
-      - fission/fetcher:latest-armv7
-  - name_template: fission/fission-bundle:latest
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
     image_templates:
-      - fission/fission-bundle:latest-amd64
-      - fission/fission-bundle:latest-arm64
-      - fission/fission-bundle:latest-armv7
-  - name_template: fission/pre-upgrade-checks:latest
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
     image_templates:
-      - fission/pre-upgrade-checks:latest-amd64
-      - fission/pre-upgrade-checks:latest-arm64
-      - fission/pre-upgrade-checks:latest-armv7
-  - name_template: fission/reporter:latest
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
     image_templates:
-      - fission/reporter:latest-amd64
-      - fission/reporter:latest-arm64
-      - fission/reporter:latest-armv7
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
-  skip: true
+  disable: true
 archives:
   - id: fission
-    builds:
+    ids:
       - fission-cli
     name_template: "{{ .ProjectName }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
-    format: binary
+    formats:
+      - binary
 checksum:
   name_template: "checksums.txt"
   algorithm: sha256
+
+# signs the checksum file
+# https://goreleaser.com/customization/sign
+signs:
+  - id: cosign-binary
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    artifacts: binary
+    args:
+      - sign-blob
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+# signs our docker image
+# https://goreleaser.com/customization/docker_sign
+docker_signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: all
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+sboms:
+  - artifacts: archive
+    id: archive
+  - artifacts: source
+    id: source
+  - artifacts: binary
+    id: binary
+  - artifacts: package
+    id: package

.mergify.yml

@@ -1,17 +1,17 @@
 pull_request_rules:
   - name: Automatic merge on approval
     conditions:
-      - base=master
+      - base=main
       - "#approved-reviews-by>=1"
       - label=ready-to-merge
       - label!=hold-off-merging
       - check-success=CodeQL-Build
       - check-success=CodeQL
       - check-success=lint 
-      - check-success=upgrade-test (kindest/node:v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.20.7, ubuntu-latest)
-      - check-success=integration-test (v1.21.1, ubuntu-latest)
+      - check-success=upgrade-test (kindest/node:v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.25.11, ubuntu-latest)
+      - check-success=integration-test (v1.27.3, ubuntu-latest)
     actions:
       merge:
         method: squash

.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [v1.17.0-rc1](https://github.com/fission/fission/tree/v1.17.0-rc1) (2022-07-06)
+
+[Full Changelog](https://github.com/fission/fission/compare/v1.16.0...v1.17.0-rc1)
+
+**Merged pull requests:**
+
+- Update controller-tools to v0.9.2 [\#2467](https://github.com/fission/fission/pull/2467) ([sanketsudake](https://github.com/sanketsudake))
+- OpenTelemetry package update to v1.7.0 [\#2466](https://github.com/fission/fission/pull/2466) ([shubham-bansal96](https://github.com/shubham-bansal96))
+- Added support to set builder and fn pod specs via helm chart [\#2461](https://github.com/fission/fission/pull/2461) ([blackfly19](https://github.com/blackfly19))
+- Pods immediately terminate for idletimeout in new deployment and container executer type [\#2459](https://github.com/fission/fission/pull/2459) ([shubham-bansal96](https://github.com/shubham-bansal96))
+- Added variable to enable or disable archivePruner [\#2458](https://github.com/fission/fission/pull/2458) ([blackfly19](https://github.com/blackfly19))
+- Avoid fission installation failure due to analytics connection error [\#2457](https://github.com/fission/fission/pull/2457) ([shubham-bansal96](https://github.com/shubham-bansal96))
+- Fix for archivepruner to delete files only from subdir [\#2456](https://github.com/fission/fission/pull/2456) ([blackfly19](https://github.com/blackfly19))
+- Upgraded controller-gen to remove status from fission CRDs [\#2454](https://github.com/fission/fission/pull/2454) ([sanketsudake](https://github.com/sanketsudake))
+- builder: Allow command with arguments via custom build options [\#2453](https://github.com/fission/fission/pull/2453) ([shubham-bansal96](https://github.com/shubham-bansal96))
+- CLI to operate archives managed by Storage Service [\#2450](https://github.com/fission/fission/pull/2450) ([blackfly19](https://github.com/blackfly19))
+- \[issue-2401\] Added pod security context for Fission Components [\#2449](https://github.com/fission/fission/pull/2449) ([baba230896](https://github.com/baba230896))
+- Update github.com/opencontainers/runc dependency to 1.1.2 [\#2448](https://github.com/fission/fission/pull/2448) ([blackfly19](https://github.com/blackfly19))
+- Fixed help for ColdStarts metric in executor according to new labels [\#2446](https://github.com/fission/fission/pull/2446) ([blackfly19](https://github.com/blackfly19))
+- Ensure poolmanager fn address validation even if pod has active connections [\#2441](https://github.com/fission/fission/pull/2441) ([blackfly19](https://github.com/blackfly19))
+- Fix pre-check failure during new fission installation [\#2437](https://github.com/fission/fission/pull/2437) ([shubham4443](https://github.com/shubham4443))
+
+## [v1.16.0](https://github.com/fission/fission/tree/v1.16.0) (2022-05-24)
+
+[Full Changelog](https://github.com/fission/fission/compare/v1.16.0-rc2...v1.16.0)
+
+**Merged pull requests:**
+
+- Updated keda image versions [\#2433](https://github.com/fission/fission/pull/2433) ([blackfly19](https://github.com/blackfly19))
+
 ## [v1.16.0-rc2](https://github.com/fission/fission/tree/v1.16.0-rc2) (2022-05-11)
 
 [Full Changelog](https://github.com/fission/fission/compare/v1.16.0-rc1...v1.16.0-rc2)

Makefile

@@ -23,6 +23,7 @@ COMMITSHA ?= $(shell git rev-parse HEAD)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 GOAMD64 ?= $(shell go env GOAMD64)
+GOPATH ?= $(shell go env GOPATH)
 
 FISSION-CLI-SUFFIX :=
 ifeq ($(GOOS), windows)
@@ -42,9 +43,7 @@ debug-vars: print-GOOS print-GOARCH print-GOAMD64 print-VERSION print-TIMESTAMP
 check: test-run build-fission-cli clean
 
 code-checks:
-	hack/verify-gofmt.sh
-	hack/verify-govet.sh
-	hack/verify-staticcheck.sh
+	golangci-lint run
 
 # run basic check scripts
 test-run: code-checks
@@ -53,7 +52,7 @@ test-run: code-checks
 
 ### Binaries
 build-fission-cli:
-	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target --id fission-cli
+	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target --id fission-cli
 
 install-fission-cli:
 	# TODO: Fix this hack, replace v1 with GOAMD64
@@ -62,13 +61,21 @@ install-fission-cli:
 ### Codegen
 codegen:
 	@./hack/update-codegen.sh
+	go tool controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
 
 ### CRDs
 generate-crds:
-	controller-gen crd:trivialVersions=false,preserveUnknownFields=false  \
+	go tool controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1
 
+### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
+generate-webhooks:
+	go tool controller-gen webhook \
+	 paths=./pkg/webhook \
+	 output:dir=charts/fission-all/templates/webhook-server
+
+
 create-crds:
 	@kubectl create -k crds/v1
 
@@ -91,20 +98,20 @@ generate-cli-docs:
 
 generate-crd-ref-docs:
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	go tool crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
 
-all-generators: codegen generate-crds generate-swagger-doc
+all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs
 
 skaffold-prebuild:
-	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target
-	@cp -v cmd/builder/Dockerfile.fission-builder dist/builder_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fetcher/Dockerfile.fission-fetcher dist/fetcher_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fission-bundle/Dockerfile.fission-bundle dist/fission-bundle_linux_amd64_v1/Dockerfile
-	@cp -v cmd/reporter/Dockerfile.reporter dist/reporter_linux_amd64_v1/Dockerfile
-	@cp -v cmd/preupgradechecks/Dockerfile.fission-preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target
+	@cp -v cmd/builder/Dockerfile dist/builder_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fetcher/Dockerfile dist/fetcher_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
+	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
+	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
 
 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)

README.md

@@ -5,7 +5,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/fission/fission/blob/master/LICENSE">
+  <a href="https://github.com/fission/fission/blob/main/LICENSE">
     <img alt="Fission Licence" src="https://img.shields.io/github/license/fission/fission">
   </a>
   <a href="https://github.com/fission/fission/releases">
@@ -20,7 +20,7 @@
   <a href="https://github.com/fission/fission/graphs/contributors">
     <img alt="Fission contributors" src="https://img.shields.io/github/contributors/fission/fission">
   </a>
-  <a href="https://github.com/fission/fission/commits/master">
+  <a href="https://github.com/fission/fission/commits/main">
     <img alt="Commit Activity" src="https://img.shields.io/github/commit-activity/m/fission/fission">
   </a>
   <br>
@@ -36,12 +36,19 @@
   <a href="https://github.com/fission/fission">
     <img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/fission/fission?style=social">
   </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/fission/fission">
+    <image alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/fission/fission/badge">
+  </a>
+  <a href="https://www.bestpractices.dev/projects/4986">
+    <img src="https://www.bestpractices.dev/projects/4986/badge">
+  </a>
 </p>
 
 --------------
 
-Fission is a fast serverless framework for Kubernetes with a focus on
-developer productivity and high performance.
+Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. With Fission, developers can easily create and deploy serverless functions that can be triggered by a variety of events, such as HTTP requests, messages from a message queue, or scheduled tasks.
+
+Fission provides a simple, easy-to-use interface for developers to create serverless functions in their language of choice, without having to worry about the underlying infrastructure. The framework also offers automatic scaling, so functions can scale up or down based on demand, without any additional configuration.
 
 Fission operates on _just the code_: Docker and Kubernetes are
 abstracted away under normal operation, though you can use both to
@@ -60,6 +67,7 @@ Table of Contents
   - [Getting Started](#getting-started)
   - [Learn More](#learn-more)
   - [Contributing](#contributing)
+  - [Who is using Fission?](#who-is-using-fission)
   - [Sponsors](#sponsors)
 - [License](#license)
 
@@ -86,7 +94,7 @@ aggregation &mdash; also helps with ops on your Fission deployment.
 
 ```bash
   # Add the stock NodeJS env to your Fission deployment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env
 
   # Create a function with a javascript one-liner that prints "hello world"
   $ fission function create --name hello --env nodejs --code https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js
@@ -108,6 +116,21 @@ aggregation &mdash; also helps with ops on your Fission deployment.
 
 Check out the [contributing guide](CONTRIBUTING.md).
 
+## Who is using Fission?
+- [Fareye](https://www.getfareye.com)
+- Apple
+- [iQuanti](https://www.iquanti.com)
+- A large telecom CSP
+- [Gadget](https://gadget.dev)
+- [CinnamonAI](https://cinnamon.is/en)
+- [Armo](https://www.armosec.io/)
+- [The Social Audience](https://thesocialaudience.com/)
+- [KubeML](https://github.com/DiegoStock12/kubeml)
+- Unilever
+- [BD](https://www.bd.com/en-in)
+- [Biofourmis](https://biofourmis.com/)
+- [Babylon](https://www.babylonhealth.com/en-gb)
+
 ## Sponsors
 
 The following companies, organizations, and individuals support Fission's ongoing maintenance and development. If you are using/contributing to Fission, we would be happy to list you here, please raise a Pull request.

SECURITY.md

@@ -6,12 +6,12 @@ Please refer using [latest stable release](https://github.com/fission/fission/re
 
 | Version | Supported          |
 | ------- | ------------------ |
-| >=1.14.x   | :white_check_mark: |
-| < 1.14.0   | :x:                |
+| >=1.20.x   | :white_check_mark: |
+| < 1.20.0   | :x:                |
 
 ## Reporting a Vulnerability
 
 Please send the details to both of us:
 
-- Sanket Sudake sanket@infracloud.io
-- Vishal Biyani vishal@infracloud.io
+- Sanket Sudake sanket[at]infracloud.io
+- Vishal Biyani vishal[at]infracloud.io

charts/fission-all/Chart.yaml

@@ -1,8 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.16.0
-appVersion: v1.16.0
+version: v1.22.0
+appVersion: v1.22.0
 description: Fission is a fast serverless framework for Kubernetes.
+kubeVersion: ">=1.27.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -21,4 +22,8 @@ maintainers:
   - name: Sanket Sudake
     email: sanket@infracloud.io
 engine: gotpl
-type: application
+type: application
+annotations:
+  artifacthub.io/signKey: |
+    fingerprint: 2EAE29FDF8A387050C82CD5ABBDD4FD6A1FFCBF6
+    url: https://raw.githubusercontent.com/fission/fission-charts/main/public_key/pgp_keys.asc

charts/fission-all/README.md

@@ -4,7 +4,7 @@
 
 ## Prerequisites
 
-- Kubernetes 1.19+
+- Kubernetes 1.23+
 - Helm 3+
 
 ## Get Repo Info
@@ -93,6 +93,25 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen
 
 A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions.
 
+### Upgrade from 1.18.x to 1.20.x
+
+We have removed controller service from fission-all chart.
+
+### Upgrade from 1.17.x to 1.18.x
+
+With 1.18.x, we have major change in the way we are deploying Fission.
+We have added parameters `defaultNamespace`, `additionalFissionNamespaces`, `functionNamespace` and `builderNamespace` to manage the namespaces.
+We watch and manage specific namespaces for Fission resources configured via `defaultNamespace` and `additionalFissionNamespaces` parameters.
+You dont need to worry about `builderNamespace` and `functionNamespace` parameters, unless you want to consider legacy Fission resources.
+
+Please refer to [core changes](https://fission.io/docs/releases/v1.18.0/#fission-core-changes) for more details.
+
+### Upgrade from 1.16.x to 1.17.x
+
+By default, Fission runs with the default security context. This means that it will be run as root. We have added settings in Helm chart for securityContext across all services in Fission. You can enable recommended securityContext settings during Fission installation.
+
+Please refer to [security context settings](https://fission.io/docs/releases/v1.17.0/#security-context-setting-for-fission-installation) for more details.
+
 ### Upgrade from 1.15.x to 1.16.x
 
 If you have been using `prometheus.enabled=true` in your fission-all chart, you will need to deploy the prometheus using prometheus community supported chart.

charts/fission-all/dashboards/.lint

@@ -0,0 +1,11 @@
+exclusions:
+  template-job-rule:
+    reason: "Most panels dont need to be filtered by job"
+  template-instance-rule:
+    reason: "Most panels dont need to be filtered by instance"
+  target-job-rule:
+    reason: "Most panels dont need to be filtered by job"
+  target-instance-rule:
+    reason: "Most panels dont need to be filtered by instance"
+  panel-units-rule:
+    reason: "Some panels are using the 'number' unit which throws a linting error."

charts/fission-all/dashboards/fission-user-dashboard.json

@@ -0,0 +1,648 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "links": [],
+  "liveNow": false,
+  "panels": [
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows function calls, namespaces and their response codes.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 0
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_calls_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "interval": "",
+          "legendFormat": "Namespace:{{function_namespace}} Func:{{function_name}} {{method}} Response: {{code}} ",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function calls",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows any functions that return 400 or 500 errors.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 0
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_errors_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "legendFormat": "Namespace:{{function_namespace}} Function:{{function_name}} Response:{{code}} ",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function Errors",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Tracks cold starts of all functions.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 8
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "increase(fission_function_cold_starts_total{function_name=~\"$Function_Name\",function_namespace=~\"$Function_Namespace\"}[1m])",
+          "legendFormat": "{{function_name}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Function cold starts",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 16
+      },
+      "id": 12,
+      "panels": [],
+      "title": "Http Requests",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows the number of requests currently in flight per function path",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 17
+      },
+      "id": 8,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "http_requests_in_flight{path=~\"$Path\"}",
+          "legendFormat": "{{path}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Http Requests in Flight (function)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Shows the average latency for each path.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 17
+      },
+      "id": 10,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "http_requests_duration_seconds_sum{path!=\"/healthz\",path!~\"/v2/.*\",path!~\"/router.*\",path=~\"$Path\"}/http_requests_duration_seconds_count{path=~\"$Path\"}",
+          "legendFormat": "{{path}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Request latency",
+      "type": "timeseries"
+    }
+  ],
+  "schemaVersion": 36,
+  "style": "dark",
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "selected": false,
+          "text": "Prometheus",
+          "value": "Prometheus"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Data Source",
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(fission_function_calls_total, function_name)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": false,
+        "name": "Function_Name",
+        "options": [],
+        "query": {
+          "query": "label_values(fission_function_calls_total, function_name)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": true,
+          "text": [
+            "All"
+          ],
+          "value": [
+            "$__all"
+          ]
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(http_requests_total, path)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "Path",
+        "options": [],
+        "query": {
+          "query": "label_values(http_requests_total, path)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(kube_namespace_labels, namespace)",
+        "description": "",
+        "hide": 0,
+        "includeAll": true,
+        "multi": false,
+        "name": "Function_Namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(kube_namespace_labels, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      },
+      {
+        "current": {
+          "selected": false,
+          "text": "fission",
+          "value": "fission"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(fission_function_calls_total, namespace)",
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "name": "Fission_Namespace",
+        "options": [],
+        "query": {
+          "query": "label_values(fission_function_calls_total, namespace)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-5m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Fission User Dashboard",
+  "uid": "he2w3Xq7z",
+  "version": 3,
+  "weekStart": ""
+}

charts/fission-all/templates/NOTES.txt

@@ -1,3 +1,5 @@
+{{ template "deprecationWarnings" . }}
+
 1. Install the client CLI.
 
 Mac:
@@ -11,14 +13,20 @@ Windows:
 
 2. You're ready to use Fission!
 
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  You can create fission resources in the namespaces "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  You can create fission resources in the namespace "{{ .Values.defaultNamespace }}"
+{{- end }}
+
   # Create an environment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env --namespace {{ .Values.defaultNamespace }}
 
   # Get a hello world
   $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
 
   # Register this function with Fission
-  $ fission function create --name hello --env nodejs --code hello.js
+  $ fission function create --name hello --env nodejs --code hello.js --namespace {{ .Values.defaultNamespace }}
 
 {{- if .Values.authentication.enabled }}
 
@@ -29,6 +37,6 @@ Windows:
 {{- end }}
 
   # Run this function
-  $ fission function test --name hello
+  $ fission function test --name hello --namespace {{ .Values.defaultNamespace }}
   Hello, world!
 

charts/fission-all/templates/_certs.tpl

@@ -0,0 +1,43 @@
+
+
+{{- define "fision.selfSignedCABundleCertPEM" -}}
+  {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+  {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+  {{- $caKeypair.Cert -}}
+{{- end -}}
+
+{{- define "webhook.caBundleCertPEM" -}}
+  {{- if .Values.webhook.caBundlePEM -}}
+    {{- trim .Values.webhook.caBundlePEM -}}
+  {{- else -}}
+    {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+    {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+    {{- $caKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.certPEM" -}}
+  {{- if .Values.webhook.crtPEM -}}
+    {{- trim .Values.webhook.crtPEM -}}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace }}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) }}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.keyPEM" -}}
+  {{- if .Values.webhook.keyPEM -}}
+    {{ trim .Values.webhook.keyPEM }}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) -}}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Key -}}
+  {{- end -}}
+{{- end -}}

charts/fission-all/templates/_deprecation-warnings.tpl

@@ -0,0 +1,21 @@
+{{- define "deprecationWarnings" -}}
+{{- $deprecations := list -}}
+
+{{- if .Values.builderNamespace -}}
+{{- $deprecations = append $deprecations "The 'builderNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.functionNamespace -}}
+{{- $deprecations = append $deprecations "The 'functionNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.disableOwnerReference -}}
+{{- $deprecations = append $deprecations "The 'disableOwnerReference' flag is temporary addition and will be removed in future release." -}}
+{{- end -}}
+
+{{- if $deprecations -}}
+{{- range $deprecations }}
+{{- printf "WARNING: %s" . | nindent 0 }}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/_fission-component-roles.tpl

@@ -0,0 +1,163 @@
+{{- define "buildermgr-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "executor-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kubewatcher-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kafka-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "keda-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "preupgrade-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+{{- end }}
+{{- define "router-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "storagesvc-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "timer-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "canaryconfig-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - httptriggers
+  verbs:
+  - list
+  - watch
+  - get
+  - update
+{{- end }}

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -0,0 +1,384 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}

charts/fission-all/templates/_fission-kuberntes-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_fission-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "fission-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-rules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-rules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-rules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-rules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-rules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-rules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-rules" . }}
+{{- end }}
+{{- if eq "storagesvc" .component }}
+{{- include "storagesvc-rules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-rules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-rules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_function-access-role.tpl

@@ -0,0 +1,123 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
+{{- end -}}

charts/fission-all/templates/_helpers.tpl

@@ -37,22 +37,37 @@ auth:
 {{- end -}}
 
 {{/*
-This template generates the image name for the deployment depending on the value of "repository" field in values.yaml file.
+Helper template to construct image names with repository and tag
 */}}
-{{- define "fission-bundleImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.image }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
+{{- define "imageWithTag" -}}
+{{- $repository := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $tag := index . 2 -}}
+{{- if $repository -}}
+{{- printf "%s/%s%s" $repository $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
 {{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.image }}
-  {{- else -}}
-    {{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- printf "%s%s" $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-bundleImage" -}}
+{{- $args := list .Values.repository .Values.image .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "reporterImage" -}}
+{{- $args := list .Values.repository .Values.postInstallReportImage .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "fetcherImage" -}}
+{{- $args := list (.Values.fetcher.repository | default .Values.repository) .Values.fetcher.image .Values.fetcher.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "preUpgradeChecksImage" -}}
+{{- $args := list (.Values.preUpgradeChecks.repository | default .Values.repository) .Values.preUpgradeChecks.image .Values.preUpgradeChecks.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}
 
 {{- define "opentelemtry.envs" }}
@@ -72,11 +87,47 @@ This template generates the image name for the deployment depending on the value
   value: "{{ .Values.openTelemetry.propagators }}"
 {{- end }}
 
-{{- define "opentracing.envs" }}
-- name: OPENTRACING_ENABLED
-  value: {{ .Values.openTracing.enabled | default false | quote }}
-- name: TRACE_JAEGER_COLLECTOR_ENDPOINT
-  value: "{{ .Values.openTracing.collectorEndpoint }}"
-- name: TRACING_SAMPLING_RATE
-  value: {{ .Values.openTracing.samplingRate | default "0.5" | quote }}
-{{- end }}
+{{- define "fission-resource-namespace.envs" }}
+- name: FISSION_BUILDER_NAMESPACE
+  value: "{{ .Values.builderNamespace }}"
+- name: FISSION_FUNCTION_NAMESPACE
+  value: "{{ .Values.functionNamespace }}"
+- name: FISSION_DEFAULT_NAMESPACE
+  value: "{{ .Values.defaultNamespace }}"
+- name: FISSION_RESOURCE_NAMESPACES
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  value: {{ .Values.defaultNamespace }}  
+{{- end }}
+{{- end }}
+
+{{- define "kube_client.envs" }}
+- name: KUBE_CLIENT_QPS
+  value: "{{ .Values.kubernetesClientQPS }}"
+- name: KUBE_CLIENT_BURST
+  value: "{{ .Values.kubernetesClientBurst }}"
+{{- end}}
+
+{{/*
+Define the svc's name
+*/}}
+{{- define "fission-webhook.svc" -}}
+{{- printf "webhook-service" -}}
+{{- end -}}
+
+{{- define "fission-function-ns" -}}
+{{- if .Values.functionNamespace -}}
+{{- printf "%s" .Values.functionNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-builder-ns" -}}
+{{- if .Values.builderNamespace -}}
+{{- printf "%s" .Values.builderNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/analytics/nonhelm-install-job.yaml

@@ -26,16 +26,15 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "yaml-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
           env:
             - name: GA_TRACKING_ID
               value: "{{ .Values.gaTrackingID }}"
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-install-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-install
   labels:
     # The "release" convention makes it easy to tie a release to all of the
     # Kubernetes resources that were created as part of that release.
@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,5 +43,8 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-upgrade-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-upgrade
   labels:
     # The "release" convention makes it easy to tie a release to all of the
     # Kubernetes resources that were created as part of that release.
@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-upgrade-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-upgrade", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,5 +43,8 @@ spec:
           {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
           {{- end }}
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/buildermgr/configmap.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.builderPodSpec.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: builder-podspec-patch
+data: 
+  builder-podspec-patch.yaml: |
+    {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
+{{- end -}}

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -19,19 +19,18 @@ spec:
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
+      {{- if .Values.buildermgr.securityContext.enabled }}
+      securityContext: {{- omit .Values.buildermgr.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: buildermgr
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
         env:
         - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
         - name: FETCHER_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
         - name: BUILDER_IMAGE_PULL_POLICY
@@ -48,12 +47,22 @@ spec:
           value: {{ .Values.fetcher.resource.mem.limits | quote }}
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
           - containerPort: 8080
             name: metrics
@@ -65,12 +74,18 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/buildermgr/podmonitor.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.podMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: buildermgr-monitor
+  {{- if .Values.podMonitor.namespace }}
+  namespace: {{ .Values.podMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.podMonitor.additionalPodMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: buildermgr
+  podMetricsEndpoints:
+  - port: "metrics"
+    path: "/metrics"
+{{- end -}}

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-buildermgr
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/canary-config/deployment.yaml

@@ -1,67 +1,57 @@
+{{- if .Values.canaryDeployment.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller
+  name: canaryconfig
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    svc: controller
-    application: fission-api
+    svc: canaryconfig
+    application: fission-canaryconfig
 spec:
   replicas: 1
   selector:
     matchLabels:
-      svc: controller
-      application: fission-api
+      svc: canaryconfig
+      application: fission-canaryconfig
   template:
     metadata:
       labels:
-        svc: controller
-        application: fission-api
+        svc: canaryconfig
+        application: fission-canaryconfig
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
+      {{- if .Values.canaryDeployment.securityContext.enabled }}
+      securityContext: {{- omit .Values.canaryDeployment.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
-      - name: controller
+      - name: canaryconfig
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--controllerPort", "8888"]
+        args: ["--canaryConfig"]
         env:
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        {{- include "opentracing.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
-          {{- toYaml .Values.controller.resources | nindent 10 }}
+          {{- toYaml .Values.canaryDeployment.resources | nindent 10 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-        readinessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          failureThreshold: 30
-        livenessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 35
-          periodSeconds: 5
         volumeMounts:
         - name: config-volume
           mountPath: /etc/config/config.yaml
@@ -69,14 +59,12 @@ spec:
         ports:
           - containerPort: 8080
             name: metrics
-          - containerPort: 8888
-            name: http
         {{- if .Values.pprof.enabled }}
           - containerPort: 6060
             name: pprof
         {{- end }}
   
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-canaryconfig
       volumes:
       - name: config-volume
         configMap:
@@ -90,4 +78,5 @@ spec:
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
-{{- end }}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-fission-cr.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-kubernetes.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/canary-config/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-canaryconfig
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/fission-all/templates/canary-config/servicemonitor.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: canaryconfig-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: canaryconfig
+  endpoints:
+  - targetPort: 8080
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/common/clusterrole.yaml

@@ -1,115 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - '*'
-- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - '*'
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - '*'
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - '*'
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - '*'
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - keda.sh
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - '*'
-{{- if .Values.mqt_keda.enabled }}
-- apiGroups:
-  - keda.k8s.io
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - '*'
-{{- end }}
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/controller/svc.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: controller
-  labels:
-    svc: controller
-    application: fission-api
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: {{ .Values.serviceType }}
-  ports:
-  - port: 80
-    targetPort: 8888
-{{- if eq .Values.serviceType "NodePort" }}
-    nodePort: {{ .Values.controllerPort }}
-{{- end }}
-  selector:
-    svc: controller

charts/fission-all/templates/dashboards/dashboards.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.grafana.dashboards.enable }}
+{{- $files := .Files }}
+{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
+{{- $filename := trimSuffix (ext $path) (base $path) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-%s" $.Chart.Name $filename | trunc 63 | trimSuffix "-" }}
+  namespace: {{ $.Values.grafana.namespace }}
+  labels:
+    grafana_dashboard: "1"
+    created_by: "{{ $.Chart.Name }}"
+data:
+  {{ base $path }}: '{{ $files.Get $path }}'
+---
+{{- end }}
+{{- end }}

charts/fission-all/templates/executor/configmap.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.runtimePodSpec.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: runtime-podspec-patch
+data: 
+  runtime-podspec-patch.yaml: |
+    {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
+{{- end -}}

charts/fission-all/templates/executor/deployment.yaml

@@ -19,19 +19,18 @@ spec:
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
+      {{- if .Values.executor.securityContext.enabled }}
+      securityContext: {{- omit .Values.executor.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: executor
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--executorPort", "8888", "--namespace", "{{ .Values.functionNamespace }}"]
+        args: ["--executorPort", "8888"]
         env:
         - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
         - name: FETCHER_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
         - name: RUNTIME_IMAGE_PULL_POLICY
@@ -54,9 +53,32 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        - name: OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.objectReaperInterval | quote }}
+        {{- if .Values.executor.poolmgr.objectReaperInterval }}
+        - name: POOLMGR_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.poolmgr.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.newdeploy.objectReaperInterval }}
+        - name: NEWDEPLOY_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.newdeploy.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.container.objectReaperInterval }}
+        - name: CONTAINER_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.container.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
+        {{- end}}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.executor.resources | nindent 10 }}
@@ -73,6 +95,13 @@ spec:
             port: 8888
           initialDelaySeconds: 35
           periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
         - containerPort: 8080
           name: metrics
@@ -92,14 +121,20 @@ spec:
         {{- else if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
 {{- if .Values.executor.priorityClassName }}
       priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-executor
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/executor/servicemonitor.yaml

@@ -6,6 +6,10 @@ metadata:
   {{- if .Values.serviceMonitor.namespace }}
   namespace: {{ .Values.serviceMonitor.namespace }}
   {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   namespaceSelector:
     matchNames:

charts/fission-all/templates/fluentbit/fluentbit.yaml

@@ -118,8 +118,7 @@ spec:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: spec.nodeName
-            - name: OPENTRACING_ENABLED
-              value: {{ .Values.openTracing.enabled | default false | quote }}
+            {{- include "fission-resource-namespace.envs" . | indent 12 }}
           command: ["/fission-bundle"]
           args: ["--logger"]
           volumeMounts:
@@ -129,10 +128,8 @@ spec:
             - name: docker-log
               mountPath: /var/lib/docker/containers
               readOnly: true
-{{- if .Values.logger.enableSecurityContext }}
           securityContext:
-            privileged: true
-{{- end }}
+            {{- toYaml .Values.logger.securityContext | nindent 12 }}
         - name: fluentbit
 {{- if .Values.repository }}
           image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -161,8 +158,6 @@ spec:
                   key: password
             - name: LOG_PATH
               value: /var/log/fission/*.log
-            - name: OPENTRACING_ENABLED
-              value: {{ .Values.openTracing.enabled | default false | quote }}
 {{- if .Values.logger.enableSecurityContext }}
           securityContext:
             privileged: true
@@ -177,7 +172,7 @@ spec:
             - name: fluentbit-config
               mountPath: /fluent-bit/etc/
               readOnly: true
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-fluentbit
       volumes:
         - name: container-log
           hostPath:
@@ -189,6 +184,10 @@ spec:
         - name: fluentbit-config
           configMap:
             name: {{ .Release.Name }}-fission-fluentbit
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
   updateStrategy:
     type: RollingUpdate
 {{- end }}

charts/fission-all/templates/fluentbit/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/fluentbit/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fluentbit
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/influxdb/deployment.yaml

@@ -49,6 +49,10 @@ spec:
             secretKeyRef:
               name: influxdb
               key: password
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}

charts/fission-all/templates/kubewatcher/deployment.yaml

@@ -15,6 +15,9 @@ spec:
       labels:
         svc: kubewatcher
     spec:
+      {{- if .Values.kubewatcher.securityContext.enabled }}
+      securityContext: {{- omit .Values.kubewatcher.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: kubewatcher
         image: {{ include "fission-bundleImage" . | quote }}
@@ -26,7 +29,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.kubewatcher.resources | nindent 10 }}
@@ -36,7 +40,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kubewatcher
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kubewatcher
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/misc-functions/clusterrole.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-secret-configmap-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - secrets
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-package-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - packages
-    verbs:
-      - "*"
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - rolebindings
-    verbs:
-      - "*"

charts/fission-all/templates/misc-functions/namespace.yaml

@@ -1,24 +1,29 @@
 {{- if .Values.createNamespace }}
+{{- if and (ne .Values.functionNamespace "default") (ne .Values.functionNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.functionNamespace }}
+  name: {{ template "fission-function-ns" . }}
   labels:
     name: fission-function
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     {{- if .Values.enableIstio }}
     istio-injection: enabled
     {{- end }}
+{{- end}}
 
 ---
+
+{{- if and (ne .Values.builderNamespace "default") (ne .Values.builderNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.builderNamespace }}
+  name: {{ template "fission-builder-ns" . }}
   labels:
     name: fission-builder
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     {{- if .Values.enableIstio }}
     istio-injection: enabled
     {{- end }}
+{{- end }}
 {{- end }}

charts/fission-all/templates/misc-functions/role.yaml

@@ -1,70 +1,12 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
+{{/* 
+Passing namespace as an argument to the "fissionFunction.roles" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ .Values.functionNamespace }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -1,43 +1,12 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+{{/* 
+Passing namespace as an argument to the "fissionFunction.rolebindings" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/serviceaccount.yaml

@@ -2,11 +2,11 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
+  namespace: {{ template "fission-function-ns" . }}
 
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: fission-builder
-  namespace: {{ .Values.builderNamespace }}
+  namespace: {{ template "fission-builder-ns" . }}

charts/fission-all/templates/mqt-fission-kafka/deployment.yaml

@@ -25,14 +25,13 @@ spec:
     spec:
       containers:
       - name: mqtrigger
-      {{- if eq .Values.imageTag "" }}
-        image: "{{ .Values.image }}"
-      {{- else }}
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-      {{- end }}
+        image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
         args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
+        ports:
+          - containerPort: 8080
+            name: metrics
         env:
         - name: MESSAGE_QUEUE_TYPE
           value: kafka
@@ -44,7 +43,7 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
         {{- include "opentelemtry.envs" . | indent 8 }}
         # TLS authentication is TLS with authentication (2 way)
         # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
@@ -65,7 +64,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kafka
       {{- if .Values.kafka.authentication.tls.enabled }}
       volumes:
       - name: kafka-secrets

charts/fission-all/templates/mqt-fission-kafka/podmonitor.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.podMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: mqt-fission-kafka-monitor
+  {{- if .Values.podMonitor.namespace }}
+  namespace: {{ .Values.podMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.podMonitor.additionalPodMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: mqtrigger
+  podMetricsEndpoints:
+  - port: "metrics"
+    path: "/metrics"
+{{- end -}}

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kafka
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/mqt-keda/deployment.yaml

@@ -40,11 +40,14 @@ spec:
           value: "{{ .Values.mqt_keda.connector_images.aws_sqs.image }}:{{ .Values.mqt_keda.connector_images.aws_sqs.tag }}"
         - name: STAN_IMAGE
           value: "{{ .Values.mqt_keda.connector_images.nats_steaming.image }}:{{ .Values.mqt_keda.connector_images.nats_steaming.tag }}"
+        - name: NATS-JETSTREAM_IMAGE
+          value: "{{ .Values.mqt_keda.connector_images.nats_jetstream.image }}:{{ .Values.mqt_keda.connector_images.nats_jetstream.tag }}"
         - name: GCP-PUBSUB_IMAGE
           value: "{{ .Values.mqt_keda.connector_images.gcp_pubsub.image }}:{{ .Values.mqt_keda.connector_images.gcp_pubsub.tag }}"
         - name: REDIS_IMAGE
           value: "{{ .Values.mqt_keda.connector_images.redis.image }}:{{ .Values.mqt_keda.connector_images.redis.tag }}"
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.mqt_keda.resources | nindent 10 }}
@@ -54,7 +57,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-keda
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}

charts/fission-all/templates/mqt-keda/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/serviceaccount.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: fission-svc
+  name: fission-keda
   namespace: {{ .Release.Namespace }}

charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch

charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml

@@ -1,12 +1,15 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
 subjects:
   - kind: ServiceAccount
-    name: fission-svc
+    name: fission-preupgrade
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-preupgrade
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml

@@ -15,6 +15,7 @@ metadata:
     # job is considered part of the release.
     "helm.sh/hook": pre-upgrade
     "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "1"
 spec:
   backoffLimit: 0
   template:
@@ -27,19 +28,21 @@ spec:
       restartPolicy: Never
       containers:
       - name: pre-upgrade-job
-      {{- if .Values.preUpgradeChecks.imageTag }}
-        image: {{ .Values.preUpgradeChecks.image }}:{{ .Values.preUpgradeChecks.imageTag }}
-      {{- else }}
-        image: {{ .Values.preUpgradeChecks.image }}
-      {{- end }}
+        image: {{ include "preUpgradeChecksImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: [ "/pre-upgrade-checks" ]
-        args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        env:
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-preupgrade
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-preupgrade
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-1"

charts/fission-all/templates/router/deployment.yaml

@@ -12,7 +12,7 @@ metadata:
     application: fission-router
 spec:
 {{- if not .Values.router.deployAsDaemonSet }}
-  replicas: 1
+  replicas: {{ .Values.router.replicas | default 1 }}
 {{- end }}
   selector:
     matchLabels:
@@ -28,6 +28,9 @@ spec:
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
+      {{- if .Values.router.securityContext.enabled }}
+      securityContext: {{- omit .Values.router.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: router
         image: {{ include "fission-bundleImage" . | quote }}
@@ -80,7 +83,8 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: DISPLAY_ACCESS_LOG
           value: {{ .Values.router.displayAccessLog | default false | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.router.resources | nindent 10 }}
@@ -120,7 +124,7 @@ spec:
         {{- else if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-router
       volumes:
       - name: config-volume
         configMap:

charts/fission-all/templates/router/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Release.Namespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/secret.yaml

@@ -6,9 +6,9 @@ metadata:
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
   annotations:
-    "helm.sh/hook": pre-install
+    "helm.sh/hook": pre-install,pre-upgrade
 data:
   username: {{ .Values.authentication.authUsername | b64enc | quote }}
   password: {{ randAlphaNum 20 | b64enc | quote }}
-  jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
+  jwtSigningKey: {{ default (randAlphaNum 20) .Values.authentication.jwtSigningKey | b64enc | quote }}
 {{- end }}

charts/fission-all/templates/router/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-router
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/router/servicemonitor.yaml

@@ -6,6 +6,10 @@ metadata:
   {{- if .Values.serviceMonitor.namespace }}
   namespace: {{ .Values.serviceMonitor.namespace }}
   {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   namespaceSelector:
     matchNames:

charts/fission-all/templates/storagesvc/deployment.yaml

@@ -12,6 +12,12 @@ spec:
     matchLabels:
       svc: storagesvc
       application: fission-storage
+  strategy:
+    type: {{ .Values.storagesvc.deploymentStrategy.type }}
+    {{- if eq .Values.storagesvc.deploymentStrategy.type "RollingUpdate" }}
+    rollingUpdate:
+      {{- toYaml .Values.storagesvc.deploymentStrategy.rollingUpdate | nindent 6}}
+    {{- end }}
   template:
     metadata:
       labels:
@@ -22,6 +28,9 @@ spec:
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
+      {{- if .Values.storagesvc.securityContext.enabled }}
+      securityContext: {{- omit .Values.storagesvc.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: storagesvc
         image: {{ include "fission-bundleImage" . | quote }}
@@ -33,8 +42,12 @@ spec:
         args: ["--storageServicePort", "8000", "--storageType", "local"]
         {{- end }}
         env:
+        - name: PRUNE_ENABLED
+          value: "{{.Values.storagesvc.archivePruner.enabled}}"
+        {{- if .Values.storagesvc.archivePruner.enabled }}
         - name: PRUNE_INTERVAL
-          value: "{{.Values.pruneInterval}}"
+          value: "{{.Values.storagesvc.archivePruner.interval}}"
+        {{- end }}
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
@@ -53,7 +66,8 @@ spec:
         - name: STORAGE_S3_REGION
           value: {{ .Values.persistence.s3.region }}
         {{- end }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.storagesvc.resources | nindent 10 }}
@@ -90,7 +104,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-storagesvc
       {{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }}
       volumes:
       - name: fission-storage
@@ -105,7 +119,7 @@ spec:
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/storagesvc/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/storagesvc/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-storagesvc
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/storagesvc/servicemonitor.yaml

@@ -5,7 +5,11 @@ metadata:
   name: storagesvc-monitor
   {{- if .Values.serviceMonitor.namespace }}
   namespace: {{ .Values.serviceMonitor.namespace }}
-  {{- end }}  
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   namespaceSelector:
     matchNames:

charts/fission-all/templates/timer/deployment.yaml

@@ -15,6 +15,9 @@ spec:
       labels:
         svc: timer
     spec:
+      {{- if .Values.timer.securityContext.enabled }}
+      securityContext: {{- omit .Values.timer.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
       containers:
       - name: timer
         image: {{ include "fission-bundleImage" . | quote }}
@@ -26,7 +29,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
-        {{- include "opentracing.envs" . | indent 8 }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.timer.resources | nindent 10 }}
@@ -36,7 +40,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-timer
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}

charts/fission-all/templates/timer/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/timer/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/timer/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-timer
+  namespace: {{ .Release.Namespace }}