Update chart version and app version to v1.20.4 (#3006)

Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>

.codecov.yml

@@ -1,11 +1,9 @@
 ignore:
   - "charts"
-  - "demos"
-  - "Documentation"
-  - "examples"
-  - "test"
+  - "test/"
   - "tools"
-  - "pkg/apis/genclient"
+  - "pkg/generated" # generated code
+  - "pkg/apis/*/*/zz_generated*" # generated code
 coverage:
   status:
     project:

.github/workflows/codeql.yaml

@@ -22,21 +22,21 @@ on:
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
-
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
         with:
           languages: go
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7

.github/workflows/greetings.yml

@@ -1,23 +0,0 @@
-name: Greetings
-
-on: [pull_request, issues]
-
-jobs:
-  greeting:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-    - uses: actions/first-interaction@v1
-      if: env.month != 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! ✨😊'
-        pr-message: 'Thank you for contributing to this project! ✨😊'
-    - uses: actions/first-interaction@v1
-      if: env.month == 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! Happy Hacktoberfest!!! ✨🎃👕✨'
-        pr-message: 'Thank you for contributing to this project. Happy Hacktoberfest!!! ✨🎃👕'

.github/workflows/lint-dashboards.yaml

@@ -16,15 +16,15 @@ on:
 jobs:
   lint-dashboards:
     runs-on: ubuntu-latest
-
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: 1.18.5
+          go-version-file: "go.mod"
 
       - name: Install dashboard linter
         run: |

.github/workflows/lint.yaml

@@ -18,19 +18,19 @@ on:
   workflow_dispatch:
 
 env:
-  GOLANGCI_LINT_VERSION: v1.49.0
+  GOLANGCI_LINT_VERSION: v1.57.0
   GOLANGCI_LINT_TIMEOUT: 5m
 
 jobs:
   lint:
     runs-on: ubuntu-latest
-
+    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
@@ -41,8 +41,9 @@ jobs:
           go mod download
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
+          skip-cache: true
           version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --timeout=${{ env.GOLANGCI_LINT_TIMEOUT }}
 
@@ -61,7 +62,7 @@ jobs:
         run: ./hack/runtests.sh
 
       - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           token: ${{secrets.CODECOV_TOKEN}}
           flags: unittests

.github/workflows/push_pr.yaml

@@ -22,51 +22,56 @@ on:
   workflow_dispatch:
 
 env:
-  HELM_VERSION: v3.9.0
-  KIND_VERSION: v0.14.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.23.0
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   # Job to run change detection
   integration-test:
     runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     strategy:
       fail-fast: false
       matrix:
-        kindversion: ["v1.19.16", "v1.20.15", "v1.21.12"]
+        kindversion: ["v1.25.16", "v1.27.13", "v1.30.0"]
         os: [ubuntu-latest]
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: fission/examples
           path: examples
 
       - name: Helm installation
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
         with:
           version: ${{ env.HELM_VERSION }}
 
-      - name: Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+      - name: Kind Cluster
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: kindest/node:${{ matrix.kindversion }}
+          node_image: kindest/node:${{ matrix.kindversion }}
           version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
           config: kind.yaml
 
       - name: Configuring and testing the Installation
         run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl get nodes
           sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
 
       - name: Helm chart lint
         run: |
@@ -74,21 +79,23 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Setup Prometheus Stack
         run: |
           helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
           kubectl create ns monitoring
-          helm install monitoring prometheus-community/prometheus -n monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
 
       - name: Build and Install Fission CLI
         run: |
@@ -98,6 +105,7 @@ jobs:
           sudo chmod +x /usr/local/bin/fission
 
       - name: Build and Install Fission
+        timeout-minutes: 10
         run: |
           kubectl create ns fission
           make create-crds
@@ -106,37 +114,203 @@ jobs:
       - name: Port-forward fission components
         run: |
           kubectl port-forward svc/router 8888:80 -nfission &
-          kubectl port-forward svc/controller 8889:80 -nfission &
 
       - name: Get fission version
+        timeout-minutes: 10
         run: |
           fission version
 
       - name: Integration tests
+        timeout-minutes: 90
         run: ./test/kind_CI.sh
 
       - name: Collect Fission Dump
+        timeout-minutes: 5
         if: ${{ always() }}
         run: |
           command -v fission && fission support dump
 
       - name: Kind export logs
+        timeout-minutes: 10
         if: ${{ always() }}
         run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
 
       - name: Archive fission dump
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
           retention-days: 5
 
-      - name: Archive kind logs
+      - name: Archive prometheus dump
+        timeout-minutes: 10
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
           retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.19.16"]
+        os: [ubuntu-latest]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: setup go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with:
+          install-only: true
+          version: "~> v1"
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.github/workflows/release.yaml

@@ -6,20 +6,21 @@ on:
       - v2.**
 
 env:
-  KIND_VERSION: v0.14.0
-  KIND_NODE_IMAGE_TAG: v1.19.16
+  KIND_VERSION: v0.23.0
+  KIND_NODE_IMAGE_TAG: v1.25.16
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   create-draft-release:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
       - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
@@ -29,32 +30,62 @@ jobs:
         run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
+          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
           version: ${{ env.KIND_VERSION }}
           config: kind.yaml
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
-      - name: Docker Login
-        uses: docker/login-action@v2
+      - name: Login to ghcr.io
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to docker.io
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
         with:
-          version: latest
+          cosign-release: "v2.2.1"
+
+      - name: Check cosign install!
+        run: cosign version
+
+      - name: Write cosign signing key to disk
+        run: 'echo "$KEY" > cosign.key'
+        shell: bash
+        env:
+          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+
+      - name: Generate yaml for manifest, Minikube and Openshift installation
+        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
+        env:
+          VERSION: ${{ steps.get_version.outputs.VERSION }}
+        shell: bash
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with:
+          version: "~> v1"
           args: release
         env:
+          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
           GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DOCKER_CLI_EXPERIMENTAL: "enabled"

.github/workflows/upgrade_test.yaml

@@ -22,48 +22,55 @@ on:
   workflow_dispatch:
 
 env:
-  HELM_VERSION: v3.9.0
-  KIND_VERSION: v0.14.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.23.0
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   upgrade-test:
     runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     strategy:
       fail-fast: false
       matrix:
-        kindimage: ["kindest/node:v1.19.16"]
+        kindimage: ["kindest/node:v1.25.16"]
         os: [ubuntu-latest]
     steps:
       - name: Checkout action sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Setup Helm
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Setup Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: ${{ matrix.kindimage }}
+          node_image: ${{ matrix.kindimage }}
           version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Setup kubectl & fetch node information
         run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl get nodes
           kubectl get storageclasses.storage.k8s.io
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config set-context --current --namespace=default
+          kubectl config view
 
       - name: Dump system info
         run: |
@@ -83,6 +90,7 @@ jobs:
           && install_fission_cli
 
       - name: Test previously created fission objects with new release
+        timeout-minutes: 10
         run: |
           source ./test/upgrade_test/fission_objects.sh test_fission_objects
 
@@ -91,10 +99,23 @@ jobs:
         run: |
           command -v fission && fission support dump
 
+      - name: Kind export logs
+        if: ${{ always() }}
+        run: |
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
       - name: Archive fission dump
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
-          name: fission-dump
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
           retention-days: 5
+
+      - name: Archive kind logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.gitignore

@@ -9,6 +9,7 @@ cmd/reporter/reporter
 
 # Logs
 test/logs/
+test/e2e/cli/fission-dump/
 
 # Pycharm IDE
 .idea
@@ -35,3 +36,8 @@ dist/
 manifest/
 .vscode/
 coverage.txt
+
+cosign.key
+
+# Dumps
+.dumps/

.golangci.yaml

@@ -14,6 +14,7 @@ linters:
     - misspell
     - nakedret
     - unconvert
+    - promlinter
     # Enable in future
     # - bodyclose
     # - dogsled
@@ -31,4 +32,4 @@ linters-settings:
   goimports:
     # put imports beginning with prefix after 3rd-party packages;
     # it's a comma-separated list of prefixes
-    local-prefixes: github.com/fission/fission
+    local: github.com/fission/fission

.goreleaser.yml

@@ -36,9 +36,6 @@ builds:
     goarch:
       - amd64
       - arm64
-      - arm
-    goarm:
-      - 7
     binary: builder
     dir: ./cmd/builder
   - <<: *build-linux
@@ -60,12 +57,6 @@ builds:
     ignore:
       - goos: windows
         goarch: arm64
-      - goos: darwin
-        goarch: arm
-        goarm: 7
-      - goos: windows
-        goarch: arm
-        goarm: 7
   - <<: *build-linux
     id: pre-upgrade-checks
     binary: pre-upgrade-checks
@@ -84,8 +75,12 @@ dockers:
     image_templates:
       - "fission/builder:latest-amd64"
       - "fission/builder:{{ .Tag }}-amd64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-amd64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/amd64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -96,28 +91,64 @@ dockers:
     image_templates:
       - "fission/fetcher:latest-amd64"
       - "fission/fetcher:{{ .Tag }}-amd64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-amd64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - fission-bundle
     image_templates:
       - "fission/fission-bundle:latest-amd64"
       - "fission/fission-bundle:{{ .Tag }}-amd64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-amd64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - pre-upgrade-checks
     image_templates:
       - "fission/pre-upgrade-checks:latest-amd64"
       - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - reporter
     image_templates:
       - "fission/reporter:latest-amd64"
       - "fission/reporter:{{ .Tag }}-amd64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "ghcr.io/fission/reporter:latest-amd64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - &docker-arm64
     use: buildx
     goos: linux
@@ -127,8 +158,12 @@ dockers:
     image_templates:
       - "fission/builder:latest-arm64"
       - "fission/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-arm64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -139,123 +174,145 @@ dockers:
     image_templates:
       - "fission/fetcher:latest-arm64"
       - "fission/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-arm64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - fission-bundle
     image_templates:
       - "fission/fission-bundle:latest-arm64"
       - "fission/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-arm64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - pre-upgrade-checks
     image_templates:
       - "fission/pre-upgrade-checks:latest-arm64"
       - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - reporter
     image_templates:
       - "fission/reporter:latest-arm64"
       - "fission/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
-  - &docker-armv7
-    use: buildx
-    goos: linux
-    goarch: arm
-    goarm: 7
-    ids:
-      - builder
-    image_templates:
-      - "fission/builder:latest-armv7"
-      - "fission/builder:{{ .Tag }}-armv7"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/reporter:latest-arm64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+    dockerfile: cmd/reporter/Dockerfile
     build_flag_templates:
-      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - fetcher
-    image_templates:
-      - "fission/fetcher:latest-armv7"
-      - "fission/fetcher:{{ .Tag }}-armv7"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
-  - <<: *docker-armv7
-    ids:
-      - fission-bundle
-    image_templates:
-      - "fission/fission-bundle:latest-armv7"
-      - "fission/fission-bundle:{{ .Tag }}-armv7"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
-  - <<: *docker-armv7
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "fission/pre-upgrade-checks:latest-armv7"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
-  - <<: *docker-armv7
-    ids:
-      - reporter
-    image_templates:
-      - "fission/reporter:latest-armv7"
-      - "fission/reporter:{{ .Tag }}-armv7"
-    dockerfile: cmd/reporter/Dockerfile.reporter
 docker_manifests:
+  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/builder:{{ .Tag }}-amd64
+      - ghcr.io/fission/builder:{{ .Tag }}-arm64
   - name_template: fission/builder:{{ .Tag }}
     image_templates:
       - fission/builder:{{ .Tag }}-amd64
       - fission/builder:{{ .Tag }}-arm64
-      - fission/builder:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
+      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
   - name_template: fission/fetcher:{{ .Tag }}
     image_templates:
       - fission/fetcher:{{ .Tag }}-amd64
       - fission/fetcher:{{ .Tag }}-arm64
-      - fission/fetcher:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
   - name_template: fission/fission-bundle:{{ .Tag }}
     image_templates:
       - fission/fission-bundle:{{ .Tag }}-amd64
       - fission/fission-bundle:{{ .Tag }}-arm64
-      - fission/fission-bundle:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
   - name_template: fission/pre-upgrade-checks:{{ .Tag }}
     image_templates:
       - fission/pre-upgrade-checks:{{ .Tag }}-amd64
       - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-      - fission/pre-upgrade-checks:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
+      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
   - name_template: fission/reporter:{{ .Tag }}
     image_templates:
       - fission/reporter:{{ .Tag }}-amd64
       - fission/reporter:{{ .Tag }}-arm64
-      - fission/reporter:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/builder:latest
+    image_templates:
+      - ghcr.io/fission/builder:latest-amd64
+      - ghcr.io/fission/builder:latest-arm64
   - name_template: fission/builder:latest
     image_templates:
       - fission/builder:latest-amd64
       - fission/builder:latest-arm64
-      - fission/builder:latest-armv7
+  - name_template: ghcr.io/fission/fetcher:latest
+    image_templates:
+      - ghcr.io/fission/fetcher:latest-amd64
+      - ghcr.io/fission/fetcher:latest-arm64
   - name_template: fission/fetcher:latest
     image_templates:
       - fission/fetcher:latest-amd64
       - fission/fetcher:latest-arm64
-      - fission/fetcher:latest-armv7
+  - name_template: ghcr.io/fission/fission-bundle:latest
+    image_templates:
+      - ghcr.io/fission/fission-bundle:latest-amd64
+      - ghcr.io/fission/fission-bundle:latest-arm64
   - name_template: fission/fission-bundle:latest
     image_templates:
       - fission/fission-bundle:latest-amd64
       - fission/fission-bundle:latest-arm64
-      - fission/fission-bundle:latest-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
+      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
   - name_template: fission/pre-upgrade-checks:latest
     image_templates:
       - fission/pre-upgrade-checks:latest-amd64
       - fission/pre-upgrade-checks:latest-arm64
-      - fission/pre-upgrade-checks:latest-armv7
+  - name_template: ghcr.io/fission/reporter:latest
+    image_templates:
+      - ghcr.io/fission/reporter:latest-amd64
+      - ghcr.io/fission/reporter:latest-arm64
   - name_template: fission/reporter:latest
     image_templates:
       - fission/reporter:latest-amd64
       - fission/reporter:latest-arm64
-      - fission/reporter:latest-armv7
 changelog:
   skip: false
 archives:
@@ -267,3 +324,31 @@ archives:
 checksum:
   name_template: "checksums.txt"
   algorithm: sha256
+
+# signs the checksum file
+# https://goreleaser.com/customization/sign
+signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - sign-blob
+    - '--key=cosign.key'
+    - '--output-certificate=${certificate}'
+    - '--output-signature=${signature}'
+    - '${artifact}'
+    - '--yes' # needed for cosign 2.0.0+
+
+# signs our docker image
+# https://goreleaser.com/customization/docker_sign
+docker_signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - 'sign'
+    - '--key=cosign.key'
+    - '${artifact}'
+    - '--yes' # needed for cosign 2.0.0+

.mergify.yml

@@ -8,10 +8,10 @@ pull_request_rules:
       - check-success=CodeQL-Build
       - check-success=CodeQL
       - check-success=lint 
-      - check-success=upgrade-test (kindest/node:v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.20.7, ubuntu-latest)
-      - check-success=integration-test (v1.21.1, ubuntu-latest)
+      - check-success=upgrade-test (kindest/node:v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.25.11, ubuntu-latest)
+      - check-success=integration-test (v1.27.3, ubuntu-latest)
     actions:
       merge:
         method: squash

Makefile

@@ -23,6 +23,7 @@ COMMITSHA ?= $(shell git rev-parse HEAD)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 GOAMD64 ?= $(shell go env GOAMD64)
+GOPATH ?= $(shell go env GOPATH)
 
 FISSION-CLI-SUFFIX :=
 ifeq ($(GOOS), windows)
@@ -51,25 +52,33 @@ test-run: code-checks
 
 ### Binaries
 build-fission-cli:
-	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target --id fission-cli
+	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target --id fission-cli
 
 install-fission-cli:
 	# TODO: Fix this hack, replace v1 with GOAMD64
 	mv dist/fission-cli_$(GOOS)_$(GOARCH)_v1/fission$(FISSION-CLI-SUFFIX) /usr/local/bin/fission
 
 ### Codegen
-codegen:
+codegen: controller-gen-install
 	@./hack/update-codegen.sh
+	$(GOPATH)/bin/controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
 
 ### CRDs
 controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.9.2
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.15.0
 
 generate-crds: controller-gen-install
-	controller-gen crd \
+	$(GOPATH)/bin/controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1
 
+### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
+generate-webhooks: controller-gen-install
+	$(GOPATH)/bin/controller-gen webhook \
+	 paths=./pkg/apis/core/v1 \
+	 output:dir=charts/fission-all/templates/webhook-server
+
+
 create-crds:
 	@kubectl create -k crds/v1
 
@@ -91,24 +100,24 @@ generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"
 
 install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@master
+	go install github.com/elastic/crd-ref-docs@v0.0.12
 
 generate-crd-ref-docs: install-crd-ref-docs
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	$(GOPATH)/bin/crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
 
-all-generators: codegen generate-crds generate-swagger-doc
+all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs
 
 skaffold-prebuild:
-	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target
-	@cp -v cmd/builder/Dockerfile.fission-builder dist/builder_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fetcher/Dockerfile.fission-fetcher dist/fetcher_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fission-bundle/Dockerfile.fission-bundle dist/fission-bundle_linux_amd64_v1/Dockerfile
-	@cp -v cmd/reporter/Dockerfile.reporter dist/reporter_linux_amd64_v1/Dockerfile
-	@cp -v cmd/preupgradechecks/Dockerfile.fission-preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target
+	@cp -v cmd/builder/Dockerfile dist/builder_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fetcher/Dockerfile dist/fetcher_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
+	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
+	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
 
 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)
@@ -119,3 +128,10 @@ release:
 	@./hack/release.sh $(VERSION)
 	@./hack/release-tag.sh $(VERSION)
 	@./hack/changelog.sh
+
+## Envtest
+install-envtest:
+	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+
+setup-envtest:
+	setup-envtest -p path use 1.23.x

README.md

@@ -40,8 +40,9 @@
 
 --------------
 
-Fission is a fast serverless framework for Kubernetes with a focus on
-developer productivity and high performance.
+Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. With Fission, developers can easily create and deploy serverless functions that can be triggered by a variety of events, such as HTTP requests, messages from a message queue, or scheduled tasks.
+
+Fission provides a simple, easy-to-use interface for developers to create serverless functions in their language of choice, without having to worry about the underlying infrastructure. The framework also offers automatic scaling, so functions can scale up or down based on demand, without any additional configuration.
 
 Fission operates on _just the code_: Docker and Kubernetes are
 abstracted away under normal operation, though you can use both to

charts/fission-all/Chart.yaml

@@ -1,8 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.17.0-rc2
-appVersion: v1.17.0-rc2
+version: v1.20.4
+appVersion: v1.20.4
 description: Fission is a fast serverless framework for Kubernetes.
+kubeVersion: ">=1.25.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -21,4 +22,8 @@ maintainers:
   - name: Sanket Sudake
     email: sanket@infracloud.io
 engine: gotpl
-type: application
+type: application
+annotations:
+  artifacthub.io/signKey: |
+    fingerprint: 2EAE29FDF8A387050C82CD5ABBDD4FD6A1FFCBF6
+    url: https://raw.githubusercontent.com/fission/fission-charts/main/public_key/pgp_keys.asc

charts/fission-all/README.md

@@ -4,7 +4,7 @@
 
 ## Prerequisites
 
-- Kubernetes 1.19+
+- Kubernetes 1.23+
 - Helm 3+
 
 ## Get Repo Info
@@ -93,6 +93,25 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen
 
 A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions.
 
+### Upgrade from 1.18.x to 1.20.x
+
+We have removed controller service from fission-all chart.
+
+### Upgrade from 1.17.x to 1.18.x
+
+With 1.18.x, we have major change in the way we are deploying Fission.
+We have added parameters `defaultNamespace`, `additionalFissionNamespaces`, `functionNamespace` and `builderNamespace` to manage the namespaces.
+We watch and manage specific namespaces for Fission resources configured via `defaultNamespace` and `additionalFissionNamespaces` parameters.
+You dont need to worry about `builderNamespace` and `functionNamespace` parameters, unless you want to consider legacy Fission resources.
+
+Please refer to [core changes](https://fission.io/docs/releases/v1.18.0/#fission-core-changes) for more details.
+
+### Upgrade from 1.16.x to 1.17.x
+
+By default, Fission runs with the default security context. This means that it will be run as root. We have added settings in Helm chart for securityContext across all services in Fission. You can enable recommended securityContext settings during Fission installation.
+
+Please refer to [security context settings](https://fission.io/docs/releases/v1.17.0/#security-context-setting-for-fission-installation) for more details.
+
 ### Upgrade from 1.15.x to 1.16.x
 
 If you have been using `prometheus.enabled=true` in your fission-all chart, you will need to deploy the prometheus using prometheus community supported chart.

charts/fission-all/dashboards/.lint

@@ -8,6 +8,4 @@ exclusions:
   target-instance-rule:
     reason: "Most panels dont need to be filtered by instance"
   panel-units-rule:
-    reason: "Some panels are using the 'number' unit which throws a linting error."
-  target-counter-agg-rule:
-    reason: "disabled for fission_archives_total. This metric should be not have total due to naming conventions as its a gauge, not a counter"
+    reason: "Some panels are using the 'number' unit which throws a linting error."

charts/fission-all/dashboards/fission-admin-dashboard.json

@@ -879,7 +879,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "fission_archives_total",
+          "expr": "fission_archives",
           "legendFormat": "Namespace: {{namespace}} Pod: {{pod}}",
           "range": true,
           "refId": "A"
@@ -970,7 +970,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "rate(fission_archives_total[$__rate_interval])",
+          "expr": "rate(fission_archives[$__rate_interval])",
           "legendFormat": "Namespace: {{namespace}} Pod: {{pod}}",
           "range": true,
           "refId": "A"

charts/fission-all/templates/NOTES.txt

@@ -11,14 +11,20 @@ Windows:
 
 2. You're ready to use Fission!
 
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  You can create fission resources in the namespaces "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  You can create fission resources in the namespace "{{ .Values.defaultNamespace }}"
+{{- end }}
+
   # Create an environment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image fission/node-env --namespace {{ .Values.defaultNamespace }}
 
   # Get a hello world
   $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
 
   # Register this function with Fission
-  $ fission function create --name hello --env nodejs --code hello.js
+  $ fission function create --name hello --env nodejs --code hello.js --namespace {{ .Values.defaultNamespace }}
 
 {{- if .Values.authentication.enabled }}
 
@@ -29,6 +35,6 @@ Windows:
 {{- end }}
 
   # Run this function
-  $ fission function test --name hello
+  $ fission function test --name hello --namespace {{ .Values.defaultNamespace }}
   Hello, world!
 

charts/fission-all/templates/_certs.tpl

@@ -0,0 +1,43 @@
+
+
+{{- define "fision.selfSignedCABundleCertPEM" -}}
+  {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+  {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+  {{- $caKeypair.Cert -}}
+{{- end -}}
+
+{{- define "webhook.caBundleCertPEM" -}}
+  {{- if .Values.webhook.caBundlePEM -}}
+    {{- trim .Values.webhook.caBundlePEM -}}
+  {{- else -}}
+    {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+    {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+    {{- $caKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.certPEM" -}}
+  {{- if .Values.webhook.crtPEM -}}
+    {{- trim .Values.webhook.crtPEM -}}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace }}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) }}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.keyPEM" -}}
+  {{- if .Values.webhook.keyPEM -}}
+    {{ trim .Values.webhook.keyPEM }}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) -}}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Key -}}
+  {{- end -}}
+{{- end -}}

charts/fission-all/templates/_fission-component-roles.tpl

@@ -0,0 +1,163 @@
+{{- define "buildermgr-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "executor-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kubewatcher-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kafka-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "keda-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "preupgrade-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+{{- end }}
+{{- define "router-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "storagesvc-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "timer-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "canaryconfig-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - httptriggers
+  verbs:
+  - list
+  - watch
+  - get
+  - update
+{{- end }}

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -0,0 +1,384 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}

charts/fission-all/templates/_fission-kuberntes-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_fission-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "fission-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-rules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-rules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-rules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-rules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-rules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-rules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-rules" . }}
+{{- end }}
+{{- if eq "storagesvc" .component }}
+{{- include "storagesvc-rules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-rules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-rules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_function-access-role.tpl

@@ -0,0 +1,123 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
+{{- end -}}

charts/fission-all/templates/_helpers.tpl

@@ -55,6 +55,22 @@ This template generates the image name for the deployment depending on the value
 {{- end }}
 {{- end -}}
 
+{{- define "reporterImage" -}}
+{{- if .Values.repository -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- else -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
 {{- define "opentelemtry.envs" }}
 - name: OTEL_EXPORTER_OTLP_ENDPOINT
   value: "{{ .Values.openTelemetry.otlpCollectorEndpoint }}"
@@ -71,3 +87,48 @@ This template generates the image name for the deployment depending on the value
 - name: OTEL_PROPAGATORS
   value: "{{ .Values.openTelemetry.propagators }}"
 {{- end }}
+
+{{- define "fission-resource-namespace.envs" }}
+- name: FISSION_BUILDER_NAMESPACE
+  value: "{{ .Values.builderNamespace }}"
+- name: FISSION_FUNCTION_NAMESPACE
+  value: "{{ .Values.functionNamespace }}"
+- name: FISSION_DEFAULT_NAMESPACE
+  value: "{{ .Values.defaultNamespace }}"
+- name: FISSION_RESOURCE_NAMESPACES
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  value: {{ .Values.defaultNamespace }}  
+{{- end }}
+{{- end }}
+
+{{- define "kube_client.envs" }}
+- name: KUBE_CLIENT_QPS
+  value: "{{ .Values.kubernetesClientQPS }}"
+- name: KUBE_CLIENT_BURST
+  value: "{{ .Values.kubernetesClientBurst }}"
+{{- end}}
+
+{{/*
+Define the svc's name
+*/}}
+{{- define "fission-webhook.svc" -}}
+{{- printf "webhook-service" -}}
+{{- end -}}
+
+{{- define "fission-function-ns" -}}
+{{- if .Values.functionNamespace -}}
+{{- printf "%s" .Values.functionNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-builder-ns" -}}
+{{- if .Values.builderNamespace -}}
+{{- printf "%s" .Values.builderNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/analytics/nonhelm-install-job.yaml

@@ -26,16 +26,15 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "yaml-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
           env:
             - name: GA_TRACKING_ID
               value: "{{ .Values.gaTrackingID }}"
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-install-job.yaml

@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,5 +43,8 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-upgrade-job.yaml

@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-upgrade-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-upgrade", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,5 +43,8 @@ spec:
           {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
           {{- end }}
-      serviceAccountName: fission-svc
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/buildermgr/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: builder-podspec-patch
 data: 
-  spec: |
+  builder-podspec-patch.yaml: |
     {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -27,7 +27,7 @@ spec:
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
         env:
         - name: FETCHER_IMAGE
         {{- if eq .Values.fetcher.imageTag "" }}
@@ -55,7 +55,16 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
           - containerPort: 8080
             name: metrics
@@ -67,12 +76,18 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-buildermgr
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/canary-config/deployment.yaml

@@ -1,69 +1,57 @@
+{{- if .Values.canaryDeployment.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller
+  name: canaryconfig
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    svc: controller
-    application: fission-api
+    svc: canaryconfig
+    application: fission-canaryconfig
 spec:
   replicas: 1
   selector:
     matchLabels:
-      svc: controller
-      application: fission-api
+      svc: canaryconfig
+      application: fission-canaryconfig
   template:
     metadata:
       labels:
-        svc: controller
-        application: fission-api
+        svc: canaryconfig
+        application: fission-canaryconfig
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/path: "/metrics"
         prometheus.io/port: "8080"
     spec:
-      {{- if .Values.controller.securityContext.enabled }}
-      securityContext: {{- omit .Values.controller.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- if .Values.canaryDeployment.securityContext.enabled }}
+      securityContext: {{- omit .Values.canaryDeployment.securityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       containers:
-      - name: controller
+      - name: canaryconfig
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--controllerPort", "8888"]
+        args: ["--canaryConfig"]
         env:
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
-          {{- toYaml .Values.controller.resources | nindent 10 }}
+          {{- toYaml .Values.canaryDeployment.resources | nindent 10 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-        readinessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          failureThreshold: 30
-        livenessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 35
-          periodSeconds: 5
         volumeMounts:
         - name: config-volume
           mountPath: /etc/config/config.yaml
@@ -71,14 +59,12 @@ spec:
         ports:
           - containerPort: 8080
             name: metrics
-          - containerPort: 8888
-            name: http
         {{- if .Values.pprof.enabled }}
           - containerPort: 6060
             name: pprof
         {{- end }}
   
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-canaryconfig
       volumes:
       - name: config-volume
         configMap:
@@ -92,4 +78,5 @@ spec:
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
-{{- end }}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-fission-cr.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end -}}

charts/fission-all/templates/canary-config/role-kubernetes.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/canary-config/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-canaryconfig
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/fission-all/templates/canary-config/servicemonitor.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: canaryconfig-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: canaryconfig
+  endpoints:
+  - targetPort: 8080
+{{- end -}}
+{{- end -}}

charts/fission-all/templates/common/clusterrole.yaml

@@ -1,115 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - '*'
-- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - '*'
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - '*'
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - '*'
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - '*'
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - keda.sh
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - '*'
-{{- if .Values.mqt_keda.enabled }}
-- apiGroups:
-  - keda.k8s.io
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - '*'
-{{- end }}
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/controller/svc.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: controller
-  labels:
-    svc: controller
-    application: fission-api
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: {{ .Values.serviceType }}
-  ports:
-  - port: 80
-    targetPort: 8888
-{{- if eq .Values.serviceType "NodePort" }}
-    nodePort: {{ .Values.controllerPort }}
-{{- end }}
-  selector:
-    svc: controller

charts/fission-all/templates/dashboards/dashboards.yaml

@@ -6,10 +6,10 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ printf "%s-%s" $.Chart.Name $filename | trunc 63 | trimSuffix "-" }}
-  namespace: {{ $.grafana.Namespace }}
+  namespace: {{ $.Values.grafana.namespace }}
   labels:
     grafana_dashboard: "1"
-    created_by: "{{ .Chart.Name }}"
+    created_by: "{{ $.Chart.Name }}"
 data:
   {{ base $path }}: '{{ $files.Get $path }}'
 ---

charts/fission-all/templates/executor/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: runtime-podspec-patch
 data: 
-  spec: |
+  runtime-podspec-patch.yaml: |
     {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/executor/deployment.yaml

@@ -27,7 +27,7 @@ spec:
         image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
-        args: ["--executorPort", "8888", "--namespace", "{{ .Values.functionNamespace }}"]
+        args: ["--executorPort", "8888"]
         env:
         - name: FETCHER_IMAGE
         {{- if eq .Values.fetcher.imageTag "" }}
@@ -57,6 +57,28 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        - name: OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.objectReaperInterval | quote }}
+        {{- if .Values.executor.poolmgr.objectReaperInterval }}
+        - name: POOLMGR_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.poolmgr.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.newdeploy.objectReaperInterval }}
+        - name: NEWDEPLOY_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.newdeploy.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.container.objectReaperInterval }}
+        - name: CONTAINER_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.container.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        {{- end}}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
         {{- include "opentelemtry.envs" . | indent 8 }}
@@ -75,6 +97,13 @@ spec:
             port: 8888
           initialDelaySeconds: 35
           periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
         - containerPort: 8080
           name: metrics
@@ -94,14 +123,20 @@ spec:
         {{- else if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
 {{- if .Values.executor.priorityClassName }}
       priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -0,0 +1,13 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-executor
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/fluentbit/fluentbit.yaml

@@ -118,6 +118,7 @@ spec:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: spec.nodeName
+            {{- include "fission-resource-namespace.envs" . | indent 12 }}
           command: ["/fission-bundle"]
           args: ["--logger"]
           volumeMounts:
@@ -127,10 +128,8 @@ spec:
             - name: docker-log
               mountPath: /var/lib/docker/containers
               readOnly: true
-{{- if .Values.logger.enableSecurityContext }}
           securityContext:
-            privileged: true
-{{- end }}
+            {{- toYaml .Values.logger.securityContext | nindent 12 }}
         - name: fluentbit
 {{- if .Values.repository }}
           image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -173,7 +172,7 @@ spec:
             - name: fluentbit-config
               mountPath: /fluent-bit/etc/
               readOnly: true
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-fluentbit
       volumes:
         - name: container-log
           hostPath:
@@ -185,6 +184,10 @@ spec:
         - name: fluentbit-config
           configMap:
             name: {{ .Release.Name }}-fission-fluentbit
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
   updateStrategy:
     type: RollingUpdate
 {{- end }}

charts/fission-all/templates/fluentbit/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/fluentbit/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fluentbit
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/influxdb/deployment.yaml

@@ -49,6 +49,10 @@ spec:
             secretKeyRef:
               name: influxdb
               key: password
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}

charts/fission-all/templates/kubewatcher/deployment.yaml

@@ -29,6 +29,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.kubewatcher.resources | nindent 10 }}
@@ -38,7 +40,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kubewatcher
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kubewatcher
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/misc-functions/clusterrole.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-secret-configmap-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - secrets
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-package-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - packages
-    verbs:
-      - "*"
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - rolebindings
-    verbs:
-      - "*"

charts/fission-all/templates/misc-functions/namespace.yaml

@@ -1,24 +1,29 @@
 {{- if .Values.createNamespace }}
+{{- if and (ne .Values.functionNamespace "default") (ne .Values.functionNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.functionNamespace }}
+  name: {{ template "fission-function-ns" . }}
   labels:
     name: fission-function
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     {{- if .Values.enableIstio }}
     istio-injection: enabled
     {{- end }}
+{{- end}}
 
 ---
+
+{{- if and (ne .Values.builderNamespace "default") (ne .Values.builderNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.builderNamespace }}
+  name: {{ template "fission-builder-ns" . }}
   labels:
     name: fission-builder
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     {{- if .Values.enableIstio }}
     istio-injection: enabled
     {{- end }}
+{{- end }}
 {{- end }}

charts/fission-all/templates/misc-functions/role.yaml

@@ -1,70 +1,12 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
+{{/* 
+Passing namespace as an argument to the "fissionFunction.roles" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ .Values.functionNamespace }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -1,43 +1,12 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+{{/* 
+Passing namespace as an argument to the "fissionFunction.rolebindings" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ .Values.functionNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/serviceaccount.yaml

@@ -2,11 +2,11 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
+  namespace: {{ template "fission-function-ns" . }}
 
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: fission-builder
-  namespace: {{ .Values.builderNamespace }}
+  namespace: {{ template "fission-builder-ns" . }}

charts/fission-all/templates/mqt-fission-kafka/deployment.yaml

@@ -25,11 +25,7 @@ spec:
     spec:
       containers:
       - name: mqtrigger
-      {{- if eq .Values.imageTag "" }}
-        image: "{{ .Values.image }}"
-      {{- else }}
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-      {{- end }}
+        image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
         args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
@@ -47,6 +43,7 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
         {{- include "opentelemtry.envs" . | indent 8 }}
         # TLS authentication is TLS with authentication (2 way)
         # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
@@ -67,7 +64,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kafka
       {{- if .Values.kafka.authentication.tls.enabled }}
       volumes:
       - name: kafka-secrets

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-fission-kafka/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kafka
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/mqt-keda/deployment.yaml

@@ -46,6 +46,8 @@ spec:
           value: "{{ .Values.mqt_keda.connector_images.gcp_pubsub.image }}:{{ .Values.mqt_keda.connector_images.gcp_pubsub.tag }}"
         - name: REDIS_IMAGE
           value: "{{ .Values.mqt_keda.connector_images.redis.image }}:{{ .Values.mqt_keda.connector_images.redis.tag }}"
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.mqt_keda.resources | nindent 10 }}
@@ -55,7 +57,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-keda
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}

charts/fission-all/templates/mqt-keda/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/serviceaccount.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: fission-svc
+  name: fission-keda
   namespace: {{ .Release.Namespace }}

charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch

charts/fission-all/templates/pre-upgrade-checks/clusterrolebinding.yaml

@@ -1,12 +1,15 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
 subjects:
   - kind: ServiceAccount
-    name: fission-svc
+    name: fission-preupgrade
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-preupgrade
   apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml

@@ -15,6 +15,7 @@ metadata:
     # job is considered part of the release.
     "helm.sh/hook": pre-upgrade
     "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "1"
 spec:
   backoffLimit: 0
   template:
@@ -34,12 +35,18 @@ spec:
       {{- end }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: [ "/pre-upgrade-checks" ]
-        args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        env:
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-preupgrade
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/pre-upgrade-checks/serviceaccount.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-preupgrade
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-1"

charts/fission-all/templates/router/deployment.yaml

@@ -12,7 +12,7 @@ metadata:
     application: fission-router
 spec:
 {{- if not .Values.router.deployAsDaemonSet }}
-  replicas: 1
+  replicas: {{ .Values.router.replicas | default 1 }}
 {{- end }}
   selector:
     matchLabels:
@@ -83,6 +83,8 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: DISPLAY_ACCESS_LOG
           value: {{ .Values.router.displayAccessLog | default false | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.router.resources | nindent 10 }}
@@ -122,7 +124,7 @@ spec:
         {{- else if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-router
       volumes:
       - name: config-volume
         configMap:

charts/fission-all/templates/router/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Release.Namespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/secret.yaml

@@ -6,9 +6,9 @@ metadata:
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
   annotations:
-    "helm.sh/hook": pre-install
+    "helm.sh/hook": pre-install,pre-upgrade
 data:
   username: {{ .Values.authentication.authUsername | b64enc | quote }}
   password: {{ randAlphaNum 20 | b64enc | quote }}
-  jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
+  jwtSigningKey: {{ default (randAlphaNum 20) .Values.authentication.jwtSigningKey | b64enc | quote }}
 {{- end }}

charts/fission-all/templates/router/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-router
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/storagesvc/deployment.yaml

@@ -60,6 +60,8 @@ spec:
         - name: STORAGE_S3_REGION
           value: {{ .Values.persistence.s3.region }}
         {{- end }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.storagesvc.resources | nindent 10 }}
@@ -96,7 +98,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-storagesvc
       {{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }}
       volumes:
       - name: fission-storage

charts/fission-all/templates/storagesvc/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/storagesvc/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-storagesvc
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/timer/deployment.yaml

@@ -29,6 +29,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.timer.resources | nindent 10 }}
@@ -38,7 +40,7 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-timer
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}

charts/fission-all/templates/timer/role-fission-cr.yaml

@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/timer/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/timer/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-timer
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/webhook-server/cert.yaml

@@ -0,0 +1,38 @@
+{{- $certManagerEnabled := .Values.webhook.certManager.enabled }}
+
+{{- if not $certManagerEnabled }}
+kind: Secret
+apiVersion: v1
+metadata:
+  name: fission-webhook-certs
+  labels:
+    app.kubernetes.io/component: webhook-secret
+type: Opaque
+data:
+  ca.crt: {{ b64enc (include "webhook.caBundleCertPEM" .) }}
+  tls.crt: {{ b64enc (include "webhook.certPEM" .) }}
+  tls.key: {{ b64enc (include "webhook.keyPEM" .) }}
+
+{{- else }}
+apiVersion: cert-manager.io/v1 
+kind: Issuer  
+metadata:  
+  name: fission-selfsigned-issuer  
+  namespace: {{ .Release.Namespace }}  
+spec:  
+  selfSigned: {}  
+---  
+apiVersion: cert-manager.io/v1  
+kind: Certificate  
+metadata:  
+  name: fission-webhook-cert  
+  namespace: {{ .Release.Namespace }}  
+spec:  
+  secretName: fission-webhook-certs  
+  dnsNames:  
+    - "webhook-service.{{ .Release.Namespace }}.svc"  
+    - "webhook-service.{{ .Release.Namespace }}.svc.cluster.local " 
+  issuerRef:  
+    name: fission-selfsigned-issuer
+
+{{- end }}

charts/fission-all/templates/webhook-server/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: webhook-service
+    application: fission-webhook
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: webhook-service
+      application: fission-webhook
+  template:
+    metadata:
+      labels:
+        svc: webhook-service
+        application: fission-webhook
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.webhook.securityContext.enabled }}
+      securityContext: {{- omit .Values.webhook.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: webhook
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--webhookPort", "9443"]
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: serving-certs
+          readOnly: true
+        ports:
+          - containerPort: 8080
+            name: metrics
+      volumes:
+      - name: serving-certs
+        secret:
+          secretName: fission-webhook-certs
+      serviceAccountName: fission-webhook
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}

charts/fission-all/templates/webhook-server/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-webhook
+  namespace: {{ .Release.Namespace }}

charts/fission-all/templates/webhook-server/servicemonitor.yaml

@@ -2,7 +2,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: controller-monitor
+  name: webhook-monitor
   {{- if .Values.serviceMonitor.namespace }}
   namespace: {{ .Values.serviceMonitor.namespace }}
   {{- end }}
@@ -16,7 +16,7 @@ spec:
       - {{ .Release.Namespace }}
   selector:
     matchLabels:
-      svc: controller
+      svc: webhook-service
   endpoints:
   - targetPort: 8080
 {{- end -}}

charts/fission-all/templates/webhook-server/webhook-service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-service
+  labels:
+    svc: webhook-service
+    application: fission-webhook
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  type: {{ .Values.serviceType }}
+  ports:
+  - port: 443
+    targetPort: 9443
+  selector:
+    svc: webhook-service

charts/fission-all/templates/webhook-server/webhooks.yaml

@@ -0,0 +1,203 @@
+---
+{{- $caCert := include "webhook.caBundleCertPEM" . -}}
+{{- $crtPEM := include "webhook.certPEM" . -}}
+{{- $keyPEM := include "webhook.keyPEM" . -}}
+
+{{- $certManagerEnabled := $.Values.webhook.certManager.enabled }}
+{{- $caBundleValue := "" -}}
+{{- if $certManagerEnabled }}
+{{- $caBundleValue = "Cg==" -}}
+{{- else }}
+{{- $caBundleValue = ternary (b64enc $caCert) (b64enc (trim $crtPEM)) (empty $crtPEM)  -}}
+{{- end }}
+
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: fission-mutating-webhooks
+  {{- if $certManagerEnabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /mutate-fission-io-v1-package
+  failurePolicy: Fail
+  name: mpackage.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - packages
+  sideEffects: None
+---
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: fission-validating-webhooks
+  {{- if $certManagerEnabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-environment
+  failurePolicy: Fail
+  name: venvironment.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    resources:
+    - environments
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-function
+  failurePolicy: Fail
+  name: vfunction.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - functions
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-httptrigger
+  failurePolicy: Fail
+  name: vhttptrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - httptriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-kuberneteswatchtrigger
+  failurePolicy: Fail
+  name: vkuberneteswatchtrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - kuberneteswatchtriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-messagequeuetrigger
+  failurePolicy: Fail
+  name: vmessagequeuetrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - messagequeuetriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-package
+  failurePolicy: Fail
+  name: vpackage.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - packages
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-timetrigger
+  failurePolicy: Fail
+  name: vtimetrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - timetriggers
+  sideEffects: None

charts/fission-all/values.yaml

@@ -1,7 +1,7 @@
 ## Fission chart configuration
 ##
 
-## serviceType to consider while creating Fission Controller service.
+## serviceType to consider while creating Fission webhook service.
 ## For minikube/kind, set this to NodePort, elsewhere use LoadBalancer or ClusterIP.
 ##
 serviceType: ClusterIP
@@ -14,7 +14,7 @@ routerServiceType: LoadBalancer
 ## repository represents base repository for images used in the chart.
 ## Keep it empty for using existing local image
 ##
-repository: index.docker.io
+repository: ghcr.io
 
 ## image represents the base image fission-bundle used by multiple Fission components.
 ## We alter arguments to the image to run a particular component.
@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.17.0-rc2
+imageTag: v1.20.4
 
 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -53,28 +53,35 @@ terminationMessagePath: /dev/termination-log
 ##
 terminationMessagePolicy: File
 
-## controllerPort represents the port at which the Fission controller service should be exposed.
-##
-controllerPort: 31313
-
 ## routerPort represents the port at which the Fission Router service should be exposed.
 ##
 routerPort: 31314
 
-## functionNamespace represents the namespace in which Fission Function resources will be created.
+## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-##
-functionNamespace: fission-function
-
-## builderNamespace represents the namespace in which Fission Builder resources will be created.
-## This is different from the release namespace.
-##
-builderNamespace: fission-builder
-
-## defaultNamespace represents the default namespace in Kubernetes.
+## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources.
 ##
 defaultNamespace: default
 
+## builderNamespace represents the namespace in which Fission Builder resources will be created.
+## if builderNamespace is set to empty then builder resources will be created in the same namespace as the Fission resources.
+## This is different from the release namespace.
+##
+builderNamespace: ""
+
+## functionNamespace represents the namespace in which Fission Function resources will be created.
+## if functionNamespace is set to empty then function resources will be created in the same namespace as the Fission resources.
+## This is different from the release namespace.
+##
+functionNamespace: ""
+
+## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
+## additionalFissionNamespaces: 
+## - namespace1
+## - namespace2
+## - namespace3
+additionalFissionNamespaces: []
+
 ## createNamespace decides to create namespaces by the chart.
 ## If set to true, functionNamespace and builderNamespace namespaces mentioned above will be created by the chart.
 ## Set to false if you want to create the namespaces manually.
@@ -85,6 +92,13 @@ createNamespace: true
 ##
 enableIstio: false
 
+## Kubernetes client QPS and Burst settings
+##
+## kubernetesClientQPS represents the maximum queries per second to the kubernetes api server from client instances of fission components.
+kubernetesClientQPS: 200
+## kubernetesClientBurst represents the maximum burst queries to the kubernetes api server from client instances of fission components.
+kubernetesClientBurst: 500
+
 ## fetcher is a light weight component that helps in running functions.
 ## fetcher helps in fetching function source code/build and uploading it when function is invoked.
 ##
@@ -92,7 +106,7 @@ fetcher:
   ## image represents the image of the fetcher component.
   image: fission/fetcher
   ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.17.0-rc2
+  imageTag: v1.20.4
 
   ## Fetcher is only for to downloading or uploading archive.
   ## Normally, you don't need to change the value here, unless necessary.
@@ -148,13 +162,41 @@ executor:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
     runAsUser: 10001
     runAsGroup: 10001
 
+  ## Object Reaper
+  ## objectReaperInterval (seconds) represents GLOBAL interval to run process that reaps objects after certain idle time.
+  ## Also you can set different objectReaperInterval for specific executor type. See poolmgs/newdeploy/container section
+  ## Default: 5 (in seconds)
+  ##
+  objectReaperInterval: 5
+
+  poolmgr: {}
+    ## objectReaperInterval specific to poolmgr executor type
+    ##
+    ## objectReaperInterval: 5
+  newdeploy: {}
+    ## objectReaperInterval specific to newdeploy  executor type
+    ##
+    ## objectReaperInterval: 5
+  container: {}
+    ## objectReaperInterval specific to container executor type
+    ##
+    ## objectReaperInterval: 5
+
+  serviceAccountCheck:
+    ## enables fission to create service account, roles and rolebinding for missing permission for builder and fetcher.
+    enabled: true
+    ## indicates the time interval in minutes, after that fission will create service account, roles and rolebinding for builder and fetcher.
+    ## interval will be applicable only if enable value is set to true.
+    ## default timing will be 0 minutes. That means check will run only once.
+    ## if you want to run check every 30 minutes then set interval to 30.
+    interval: 0
 ## router is responsible for routing function calls to the appropriate function.
 ##
 router:
@@ -172,6 +214,9 @@ router:
   ## deployAsDaemonSet decides whether to deploy router as a DaemonSet or a Deployment.
   ##
   deployAsDaemonSet: false
+  ## replicas decides how many router pods to deploy. Only used when deployAsDaemonSet is false.
+  ##
+  replicas: 1
   ## svcAddressMaxRetries is the max times for router to retry with a specific function service address
   ##
   svcAddressMaxRetries: 5
@@ -231,7 +276,7 @@ router:
     maxRetries: 10
 
   ## Extend the container specs for the core fission pods.
-  ## Can be used to add things like affinty/tolerations/nodeSelectors/etc.
+  ## Can be used to add things like affinity/tolerations/nodeSelectors/etc.
   ## For example:
   ## extraCoreComponentPodConfig:
   ##   affinity:
@@ -265,7 +310,7 @@ router:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -291,17 +336,17 @@ buildermgr:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
     runAsUser: 10001
     runAsGroup: 10001
 
-## controller is the component that the client talks to.
-## It contains CRUD APIs for functions, triggers, environments, Kubernetes event watches, etc. and proxy APIs to internal 3rd-party services.
+## webhook is the component that validates API calls.
+## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
 ##
-controller:
+webhook:
   ## Pod resources as:
   ##  resources:
   ##    limits:
@@ -313,18 +358,29 @@ controller:
   ##
   resources: {}
 
+  certManager:
+    enabled: false
+
+  caBundlePEM: |
+
+  crtPEM: |
+
+  keyPEM: |
+
+
   ## Security Context
   ## It holds pod-level and container level security configuration.
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
     runAsUser: 10001
     runAsGroup: 10001
 
+
 ## kubewatcher watches the Kubernetes API and invokes functions associated with watches, sending the watch event to the function.
 ##
 kubewatcher:
@@ -344,7 +400,7 @@ kubewatcher:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -376,7 +432,7 @@ storagesvc:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -403,7 +459,7 @@ timer:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -453,14 +509,14 @@ kafka:
   # version: "0.11.2.0"
 
 # The following components expose Prometheus metrics and have servicemonitors in this chart (disabled by default)
-# Controller, router, executor, storage svc
+# router, executor, storage svc
 serviceMonitor:
   enabled: false
   ##namespace in which you want to deploy servicemonitor
   ##
   namespace: ""
-  ## Map of additional lables to add to the ServiceMonitor resources
-  #  to allow selecting sepcific ServiceMonitors
+  ## Map of additional labels to add to the ServiceMonitor resources
+  #  to allow selecting specific ServiceMonitors
   #  in case of multiple prometheus deployments
   additionalServiceMonitorLabels: {}
   #  release: "monitoring"
@@ -473,8 +529,8 @@ podMonitor:
   ##namespace in which you want to deploy podmonitor
   ##
   namespace: ""
-  ## Map of additional lables to add to the PodMonitor resources
-  #  to allow selecting sepcific PodMonitor
+  ## Map of additional labels to add to the PodMonitor resources
+  #  to allow selecting specific PodMonitor
   #  in case of multiple prometheus deployments
   additionalPodMonitorLabels: {}
   #  release: "monitoring"
@@ -522,7 +578,7 @@ persistence:
   size: 8Gi
 
 ## Extend the container specs for the core fission pods.
-## Can be used to add things like affinty/tolerations/nodeSelectors/etc.
+## Can be used to add things like affinity/tolerations/nodeSelectors/etc.
 ## For example:
 ## extraCoreComponentPodConfig:
 ##   affinity:
@@ -564,11 +620,22 @@ logger:
 
   ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked
   ## files and a state of offsets, this is very useful to resume a state if the ser-
-  ## vice is restarted. For Kubernetes environment with constraints like OpenShift,
+  ## vice is restarted.
+  ##
+  ## For Kubernetes environment with constraints like OpenShift,
   ## the containers are limited to write hostPath volume. Hence, we have to enable
   ## security context and set privileged to true.
   ##
-  enableSecurityContext: false
+  ## The user ID in runAsUser should have access to the `/var/log` and
+  ## `/var/lib/docker/containers` directories on your host.
+  ## On many hosts, this user might be root ,i.e., `runAsUser: 0`.
+  ## Although it is recommended not to use root user for security reasons.
+  ##
+  ## The `/var/log` and `/var/lib/docker/containers` directories on host are mounted
+  ## to logger container with volumeType `HostPath`.
+  securityContext: {}
+    # privileged: true
+    # runAsUser: 0
 
   ## Enable PodSecurityPolicies to allow privileged container
   ## Only required in some clusters and when enableSecurityContext is true
@@ -607,7 +674,7 @@ preUpgradeChecks:
   image: fission/pre-upgrade-checks
   ## pre-install/pre-upgrade checks image version
   ##
-  imageTag: v1.17.0-rc2
+  imageTag: v1.20.4
 
 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -627,11 +694,34 @@ prometheus:
   ##
   serviceEndpoint: ""
 
-## set this flag to true if you need canary deployment feature
-##
+
 canaryDeployment:
+## set this flag to true if you need canary deployment feature
   enabled: false
 
+  ## Pod resources as:
+  ##  resources:
+  ##    limits:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##    requests:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##
+  resources: {}
+
+  ## Security Context
+  ## It holds pod-level and container level security configuration.
+  ## This is an experimental section, please verify before enabling in production.
+  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
+  securityContext:
+    enabled: true
+    ## Mark it false, if you want to stop the non root user validation
+    runAsNonRoot: true
+    fsGroup: 10001
+    runAsUser: 10001
+    runAsGroup: 10001
+
 ## Enable authentication for fission function invocation via Fission router
 ##
 authentication:
@@ -652,7 +742,7 @@ authentication:
   ## jwtSigningKey is the signing key used for
   ## signing the JWT token
   ##
-  jwtSigningKey: serverless
+  jwtSigningKey: 
   ## jwtExpiryTime is the JWT expiry time
   ## in seconds
   ## default '120'
@@ -715,29 +805,29 @@ mqt_keda:
   enabled: true
   connector_images:
     kafka:
-      image: fission/keda-kafka-http-connector
-      tag: v0.11
+      image: ghcr.io/fission/keda-kafka-http-connector
+      tag: v0.15
     rabbitmq:
-      image: fission/keda-rabbitmq-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-rabbitmq-http-connector
+      tag: v0.13
     awskinesis:
-      image: fission/keda-aws-kinesis-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-aws-kinesis-http-connector
+      tag: v0.13
     aws_sqs:
-      image: fission/keda-aws-sqs-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-aws-sqs-http-connector
+      tag: v0.14
     nats_steaming:
-      image: fission/keda-nats-streaming-http-connector
-      tag: v0.12
+      image: ghcr.io/fission/keda-nats-streaming-http-connector
+      tag: v0.16
     nats_jetstream:
-      image: fission/keda-nats-jetstream-http-connector
-      tag: v0.2
+      image: ghcr.io/fission/keda-nats-jetstream-http-connector
+      tag: v0.7
     gcp_pubsub:
-      image: fission/keda-gcp-pubsub-http-connector
-      tag: v0.5
+      image: ghcr.io/fission/keda-gcp-pubsub-http-connector
+      tag: v0.9
     redis:
-      image: fission/keda-redis-http-connector
-      tag: v0.3
+      image: ghcr.io/fission/keda-redis-http-connector
+      tag: v0.6
 
   ## Pod resources as:
   ##  resources:

cmd/builder/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest
+COPY builder /builder
+ENTRYPOINT ["/builder"]

cmd/builder/Dockerfile.fission-builder

@@ -1,4 +0,0 @@
-FROM alpine:3.16
-RUN apk add --update ca-certificates
-COPY builder /builder
-ENTRYPOINT ["/builder"]

cmd/builder/app/server.go

@@ -24,16 +24,18 @@ import (
 
 	builder "github.com/fission/fission/pkg/builder"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 )
 
 // Usage: builder <shared volume path>
-func Run(ctx context.Context, logger *zap.Logger, shareVolume string) {
+func Run(ctx context.Context, logger *zap.Logger, mgr manager.Interface, shareVolume string) {
 	builder := builder.MakeBuilder(logger, shareVolume)
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", builder.Handler)
+	mux.HandleFunc("/clean", builder.Clean)
 	mux.HandleFunc("/version", builder.VersionHandler)
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
-	httpserver.StartServer(ctx, logger, "builder", "8001", mux)
+	httpserver.StartServer(ctx, logger, mgr, "builder", "8001", mux)
 }

cmd/builder/main.go

@@ -20,19 +20,25 @@ import (
 	"os"
 
 	"go.uber.org/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 
 	"github.com/fission/fission/cmd/builder/app"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/profile"
-	"github.com/fission/fission/pkg/utils/signals"
 )
 
 // Usage: builder <shared volume path>
 func main() {
+
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()
-	ctx := signals.SetupSignalHandlerWithContext(logger)
-	profile.ProfileIfEnabled(ctx, logger)
+	ctx := signals.SetupSignalHandler()
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
 	shareVolume := os.Args[1]
 	if _, err := os.Stat(shareVolume); err != nil {
 		if os.IsNotExist(err) {
@@ -42,5 +48,5 @@ func main() {
 			}
 		}
 	}
-	app.Run(ctx, logger, shareVolume)
+	app.Run(ctx, logger, mgr, shareVolume)
 }

cmd/fetcher/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest
+COPY fetcher /
+ENTRYPOINT ["/fetcher"]

cmd/fetcher/Dockerfile.fission-fetcher

@@ -1,4 +0,0 @@
-FROM alpine:3.16
-RUN apk add --update ca-certificates
-COPY fetcher /
-ENTRYPOINT ["/fetcher"]

cmd/fetcher/app/server.go

@@ -28,8 +28,10 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.uber.org/zap"
 
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/fetcher"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
 
@@ -37,7 +39,7 @@ var (
 	readyToServe uint32
 )
 
-func Run(ctx context.Context, logger *zap.Logger) {
+func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port string, podInfoMountDir string) {
 	flag.Usage = fetcherUsage
 	specializeOnStart := flag.Bool("specialize-on-startup", false, "Flag to activate specialize process at pod startup")
 	specializePayload := flag.String("specialize-request", "", "JSON payload for specialize request")
@@ -72,13 +74,13 @@ func Run(ctx context.Context, logger *zap.Logger) {
 	ctx, span := tracer.Start(ctx, "fetcher/Run")
 	defer span.End()
 
-	f, err := fetcher.MakeFetcher(logger, dir, *secretDir, *configDir)
+	f, err := fetcher.MakeFetcher(logger, clientGen, dir, *secretDir, *configDir, podInfoMountDir)
 	if err != nil {
 		logger.Fatal("error making fetcher", zap.Error(err))
 	}
 
 	// do specialization in other goroutine to prevent blocking in newdeploy
-	go func() {
+	mgr.Add(ctx, func(_ context.Context) {
 		if *specializeOnStart {
 			var specializeReq fetcher.FunctionSpecializeRequest
 
@@ -93,7 +95,7 @@ func Run(ctx context.Context, logger *zap.Logger) {
 			}
 		}
 		atomic.StoreUint32(&readyToServe, 1)
-	}()
+	})
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/fetch", f.FetchHandler)
@@ -119,7 +121,7 @@ func Run(ctx context.Context, logger *zap.Logger) {
 	logger.Info("fetcher ready to receive requests")
 
 	handler := otelUtils.GetHandlerWithOTEL(mux, "fission-fetcher", otelUtils.UrlsToIgnore("/healthz", "/readiness-healthz"))
-	httpserver.StartServer(ctx, logger, "fetcher", "8000", handler)
+	httpserver.StartServer(ctx, logger, mgr, "fetcher", port, handler)
 }
 
 func fetcherUsage() {