Track all Go tools version in tools package (#2628 )

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
add validation to avoid cross ns config and functions (#2627 )
2022-11-21 12:14:03 +05:30 · 2022-11-17 20:43:07 +05:30 · 2022-11-17 13:13:33 +05:30 · 2022-11-16 22:16:05 +05:30 · 2022-11-15 21:10:05 +05:30 · 2022-11-15 17:56:08 +05:30
332 changed files with 7574 additions and 3050 deletions
@@ -22,7 +22,7 @@ on:
 jobs:
  CodeQL-Build:
    runs-on: ubuntu-latest
-
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
        uses: actions/checkout@v3
@@ -1,23 +0,0 @@
-name: Greetings
-
-on: [pull_request, issues]
-
-jobs:
-  greeting:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-    - uses: actions/first-interaction@v1
-      if: env.month != 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! ✨😊'
-        pr-message: 'Thank you for contributing to this project! ✨😊'
-    - uses: actions/first-interaction@v1
-      if: env.month == 'Oct'
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: 'Thank you for your first issue! Happy Hacktoberfest!!! ✨🎃👕✨'
-        pr-message: 'Thank you for contributing to this project. Happy Hacktoberfest!!! ✨🎃👕'
@@ -16,7 +16,7 @@ on:
 jobs:
  lint-dashboards:
    runs-on: ubuntu-latest
-
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
        uses: actions/checkout@v3
@@ -24,7 +24,7 @@ env:
 jobs:
  lint:
    runs-on: ubuntu-latest
-
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
        uses: actions/checkout@v3
@@ -22,17 +22,18 @@ on:
  workflow_dispatch:

 env:
-  HELM_VERSION: v3.9.0
-  KIND_VERSION: v0.14.0
+  HELM_VERSION: v3.10.1
+  KIND_VERSION: v0.17.0

 jobs:
  # Job to run change detection
  integration-test:
    runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.19.16", "v1.20.15", "v1.21.12"]
+        kindversion: ["v1.19.16", "v1.20.15", "v1.21.14"]
        os: [ubuntu-latest]
    steps:
      - name: Checkout sources
@@ -55,7 +56,7 @@ jobs:
        with:
          version: ${{ env.HELM_VERSION }}

-      - name: Kind Clutser
+      - name: Kind Cluster
        uses: engineerd/setup-kind@v0.5.0
        with:
          image: kindest/node:${{ matrix.kindversion }}
@@ -67,6 +68,8 @@ jobs:
          kubectl cluster-info --context kind-kind
          kubectl get nodes
          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-kind
+          kubectl config view

      - name: Helm chart lint
        run: |
@@ -74,12 +77,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v1.39.2/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
        with:
          install-only: true

@@ -98,6 +101,7 @@ jobs:
          sudo chmod +x /usr/local/bin/fission

      - name: Build and Install Fission
+        timeout-minutes: 10
        run: |
          kubectl create ns fission
          make create-crds
@@ -109,33 +113,39 @@ jobs:
          kubectl port-forward svc/controller 8889:80 -nfission &

      - name: Get fission version
+        timeout-minutes: 10
        run: |
          fission version

      - name: Integration tests
+        timeout-minutes: 90
        run: ./test/kind_CI.sh

      - name: Collect Fission Dump
+        timeout-minutes: 5
        if: ${{ always() }}
        run: |
          command -v fission && fission support dump

      - name: Kind export logs
+        timeout-minutes: 10
        if: ${{ always() }}
        run: |
          kind export logs --name kind kind-logs

      - name: Archive fission dump
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@v3
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
          retention-days: 5

      - name: Archive kind logs
+        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -6,7 +6,7 @@ on:
      - v2.**

 env:
-  KIND_VERSION: v0.14.0
+  KIND_VERSION: v0.17.0
  KIND_NODE_IMAGE_TAG: v1.19.16

 jobs:
@@ -49,12 +49,32 @@ jobs:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

+      - name: Install Cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.12.0'
+      - name: Check cosign install!
+        run: cosign version
+
+      - name: Write cosign signing key to disk
+        run: 'echo "$KEY" > cosign.key'
+        shell: bash
+        env:
+          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+
+      - name: Generate yaml for manifest, Minikube and Openshift installation
+        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
+        env:
+          VERSION: ${{ steps.get_version.outputs.VERSION }}
+        shell: bash
+
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v3
        with:
          version: latest
          args: release
        env:
+          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"
@@ -22,12 +22,13 @@ on:
  workflow_dispatch:

 env:
-  HELM_VERSION: v3.9.0
-  KIND_VERSION: v0.14.0
+  HELM_VERSION: v3.10.1
+  KIND_VERSION: v0.17.0

 jobs:
  upgrade-test:
    runs-on: ${{ matrix.os }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    strategy:
      fail-fast: false
      matrix:
@@ -55,7 +56,7 @@ jobs:
          version: ${{ env.KIND_VERSION }}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
        with:
          install-only: true

@@ -64,6 +65,9 @@ jobs:
          kubectl cluster-info --context kind-kind
          kubectl get nodes
          kubectl get storageclasses.storage.k8s.io
+          kubectl config use-context kind-kind
+          kubectl config set-context --current --namespace=default
+          kubectl config view

      - name: Dump system info
        run: |
@@ -83,6 +87,7 @@ jobs:
          && install_fission_cli

      - name: Test previously created fission objects with new release
+        timeout-minutes: 10
        run: |
          source ./test/upgrade_test/fission_objects.sh test_fission_objects

@@ -91,10 +96,23 @@ jobs:
        run: |
          command -v fission && fission support dump

+      - name: Kind export logs
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
      - name: Archive fission dump
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@v3
        with:
-          name: fission-dump
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
          retention-days: 5
+
+      - name: Archive kind logs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5
@@ -35,3 +35,5 @@ dist/
 manifest/
 .vscode/
 coverage.txt
+
+cosign.key
@@ -14,6 +14,7 @@ linters:
    - misspell
    - nakedret
    - unconvert
+    - promlinter
    # Enable in future
    # - bodyclose
    # - dogsled
@@ -267,3 +267,29 @@ archives:
 checksum:
  name_template: "checksums.txt"
  algorithm: sha256
+
+# signs the checksum file
+# https://goreleaser.com/customization/sign
+signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - sign-blob
+    - '--key=cosign.key'
+    - '--output-certificate=${certificate}'
+    - '--output-signature=${signature}'
+    - '${artifact}'
+
+# signs our docker image
+# https://goreleaser.com/customization/docker_sign
+docker_signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - 'sign'
+    - '--key=cosign.key'
+    - '${artifact}'
@@ -58,18 +58,26 @@ install-fission-cli:
 	mv dist/fission-cli_$(GOOS)_$(GOARCH)_v1/fission$(FISSION-CLI-SUFFIX) /usr/local/bin/fission

 ### Codegen
-codegen:
+codegen: controller-gen-install
+	@controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
 	@./hack/update-codegen.sh

 ### CRDs
 controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.9.2
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.10.0

 generate-crds: controller-gen-install
 	controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1

+### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
+generate-webhooks: controller-gen-install
+	controller-gen webhook \
+	 paths=./pkg/apis/core/v1 \
+	 output:dir=charts/fission-all/templates/webhook-server
+
+
 create-crds:
 	@kubectl create -k crds/v1

@@ -91,7 +99,7 @@ generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"

 install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@master
+	go install github.com/elastic/crd-ref-docs@v0.0.8

 generate-crd-ref-docs: install-crd-ref-docs
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
@@ -100,7 +108,7 @@ generate-crd-ref-docs: install-crd-ref-docs
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md

-all-generators: codegen generate-crds generate-swagger-doc
+all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs

 skaffold-prebuild:
 	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: fission-all
-version: v1.17.0-rc2
-appVersion: v1.17.0-rc2
+version: v1.18.0-rc1
+appVersion: v1.18.0-rc1
 description: Fission is a fast serverless framework for Kubernetes.
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
@@ -8,6 +8,4 @@ exclusions:
  target-instance-rule:
    reason: "Most panels dont need to be filtered by instance"
  panel-units-rule:
-    reason: "Some panels are using the 'number' unit which throws a linting error."
-  target-counter-agg-rule:
-    reason: "disabled for fission_archives_total. This metric should be not have total due to naming conventions as its a gauge, not a counter"
+    reason: "Some panels are using the 'number' unit which throws a linting error."
@@ -879,7 +879,7 @@
            "uid": "${datasource}"
          },
          "editorMode": "code",
-          "expr": "fission_archives_total",
+          "expr": "fission_archives",
          "legendFormat": "Namespace: {{namespace}} Pod: {{pod}}",
          "range": true,
          "refId": "A"
@@ -970,7 +970,7 @@
            "uid": "${datasource}"
          },
          "editorMode": "code",
-          "expr": "rate(fission_archives_total[$__rate_interval])",
+          "expr": "rate(fission_archives[$__rate_interval])",
          "legendFormat": "Namespace: {{namespace}} Pod: {{pod}}",
          "range": true,
          "refId": "A"
@@ -0,0 +1,43 @@
+
+
+{{- define "fision.selfSignedCABundleCertPEM" -}}
+  {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+  {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+  {{- $caKeypair.Cert -}}
+{{- end -}}
+
+{{- define "webhook.caBundleCertPEM" -}}
+  {{- if .Values.webhook.caBundlePEM -}}
+    {{- trim .Values.webhook.caBundlePEM -}}
+  {{- else -}}
+    {{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
+    {{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
+    {{- $caKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.certPEM" -}}
+  {{- if .Values.webhook.crtPEM -}}
+    {{- trim .Values.webhook.crtPEM -}}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace }}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) }}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Cert -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "webhook.keyPEM" -}}
+  {{- if .Values.webhook.keyPEM -}}
+    {{ trim .Values.webhook.keyPEM }}
+  {{- else -}}
+    {{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
+    {{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
+    {{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) -}}
+    {{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
+    {{- $webhookServerTLSKeypair.Key -}}
+  {{- end -}}
+{{- end -}}
@@ -0,0 +1,185 @@
+{{- define "buildermgr-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "controller-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "executor-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kubewatcher-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - kuberneteswatchtriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "kafka-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "keda-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "preupgrade-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - environments
+  - functions
+  - httptriggers
+  - kuberneteswatchtriggers
+  - messagequeuetriggers
+  - packages
+  - timetriggers
+  verbs:
+  - list
+{{- end }}
+{{- define "router-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - httptriggers
+  - packages
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "storagesvc-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "timer-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - environments
+  - functions
+  - packages
+  - timetriggers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+{{- define "canaryconfig-rules" }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - canaryconfigs
+  - httptriggers
+  verbs:
+  - list
+  - watch
+  - get
+  - update
+{{- end }}
@@ -0,0 +1,67 @@
+{{- define "fission-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-rules" . }}
+{{- end }}
+{{- if eq "controller" .component }}
+{{- include "controller-rules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-rules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-rules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-rules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-rules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-rules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-rules" . }}
+{{- end }}
+{{- if eq "storagesvc" .component }}
+{{- include "storagesvc-rules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-rules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-rules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}-fission-cr"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
@@ -0,0 +1,79 @@
+{{- define "fissionFunction.roles" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+rules:
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+{{- end -}}
+
+{{- define "fissionFunction.rolebindings" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    namespace: {{template "fission-function-ns" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-builder
+subjects:
+  - kind: ServiceAccount
+    name: fission-builder
+    namespace: {{ template "fission-builder-ns" . }}
+{{- end -}}
@@ -71,3 +71,35 @@ This template generates the image name for the deployment depending on the value
 - name: OTEL_PROPAGATORS
  value: "{{ .Values.openTelemetry.propagators }}"
 {{- end }}
+
+{{- define "fission-resource-namespace.envs" }}
+- name: FISSION_RESOURCE_NAMESPACES
+{{- if not .Values.singleDefaultNamespace }}
+  value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  value: {{ .Values.defaultNamespace }}  
+{{- end }}
+{{- end }}
+
+{{/*
+Define the svc's name
+*/}}
+{{- define "fission-webhook.svc" -}}
+{{- printf "webhook-service" -}}
+{{- end -}}
+
+{{- define "fission-function-ns" -}}
+{{- if .Values.functionNamespace -}}
+{{- printf "%s" .Values.functionNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.defaultNamespace -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-builder-ns" -}}
+{{- if .Values.builderNamespace -}}
+{{- printf "%s" .Values.builderNamespace -}}
+{{- else -}}
+{{- printf "%s" .Values.builderNamespace -}}
+{{- end -}}
+{{- end -}}
@@ -37,5 +37,4 @@ spec:
          env:
            - name: GA_TRACKING_ID
              value: "{{ .Values.gaTrackingID }}"
-      serviceAccountName: fission-svc
 {{- end }}
@@ -47,5 +47,4 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
 {{- end }}
@@ -47,5 +47,4 @@ spec:
          {{- if .Values.terminationMessagePolicy }}
          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
          {{- end }}
-      serviceAccountName: fission-svc
 {{- end }}
@@ -0,0 +1,53 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-buildermgr
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - services
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-buildermgr
 subjects:
  - kind: ServiceAccount
-    name: fission-svc
+    name: fission-buildermgr
    namespace: {{ .Release.Namespace }}
 roleRef:
  kind: ClusterRole
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-buildermgr
  apiGroup: rbac.authorization.k8s.io
@@ -27,7 +27,7 @@ spec:
        image: {{ include "fission-bundleImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: ["/fission-bundle"]
-        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
        env:
        - name: FETCHER_IMAGE
        {{- if eq .Values.fetcher.imageTag "" }}
@@ -39,6 +39,12 @@ spec:
          value: "{{ .Values.pullPolicy }}"
        - name: BUILDER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
+        - name: FISSION_BUILDER_NAMESPACE
+          value: "{{ .Values.builderNamespace }}"
+        - name: FISSION_FUNCTION_NAMESPACE
+          value: "{{ .Values.functionNamespace }}"
+        - name: FISSION_DEFAULT_NAMESPACE
+          value: "{{ .Values.defaultNamespace }}"      
        - name: ENABLE_ISTIO
          value: "{{ .Values.enableIstio }}"
        - name: FETCHER_MINCPU
@@ -55,6 +61,7 @@ spec:
          value: {{ .Values.pprof.enabled | quote }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
        {{- include "opentelemtry.envs" . | indent 8 }}
        ports:
          - containerPort: 8080
@@ -67,7 +74,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-buildermgr
 {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-buildermgr
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,43 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-canaryconfig
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
@@ -0,0 +1,14 @@
+{{- if .Values.canaryDeployment.enabled }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-canaryconfig
+subjects:
+  - kind: ServiceAccount
+    name: fission-canaryconfig
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-canaryconfig
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}
@@ -0,0 +1,81 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: canaryconfig
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: canaryconfig
+    application: fission-canaryconfig
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: canaryconfig
+      application: fission-canaryconfig
+  template:
+    metadata:
+      labels:
+        svc: canaryconfig
+        application: fission-canaryconfig
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.canaryDeployment.securityContext.enabled }}
+      securityContext: {{- omit .Values.canaryDeployment.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: canaryconfig
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--canaryConfig"]
+        env:
+        - name: DEBUG_ENV
+          value: {{ .Values.debugEnv | quote }}
+        - name: PPROF_ENABLED
+          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- include "opentelemtry.envs" . | indent 8 }}
+        resources:
+          {{- toYaml .Values.canaryDeployment.resources | nindent 10 }}
+        {{- if .Values.terminationMessagePath }}
+        terminationMessagePath: {{ .Values.terminationMessagePath }}
+        {{- end }}
+        {{- if .Values.terminationMessagePolicy }}
+        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
+        {{- end }}
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/config/config.yaml
+          subPath: config.yaml
+        ports:
+          - containerPort: 8080
+            name: metrics
+        {{- if .Values.pprof.enabled }}
+          - containerPort: 6060
+            name: pprof
+        {{- end }}
+  
+      serviceAccountName: fission-canaryconfig
+      volumes:
+      - name: config-volume
+        configMap:
+          name: feature-config
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}
+{{- end -}}
@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end -}}
@@ -0,0 +1,7 @@
+{{- if .Values.canaryDeployment.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-canaryconfig
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
@@ -0,0 +1,24 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: canaryconfig-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: canaryconfig
+  endpoints:
+  - targetPort: 8080
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,43 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-controller
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end -}}
@@ -0,0 +1,14 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-controller
+subjects:
+  - kind: ServiceAccount
+    name: fission-controller
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-controller
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}
@@ -1,3 +1,4 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -32,12 +33,17 @@ spec:
        command: ["/fission-bundle"]
        args: ["--controllerPort", "8888"]
        env:
+        - name: FISSION_DEFAULT_NAMESPACE
+          value: "{{ .Values.defaultNamespace }}"
+        - name: FISSION_BUILDER_NAMESPACE
+          value: "{{ .Values.builderNamespace }}"
        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
+          value: "{{ .Values.functionNamespace }}"  
        - name: DEBUG_ENV
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
@@ -78,7 +84,7 @@ spec:
            name: pprof
        {{- end }}
  
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-controller
      volumes:
      - name: config-volume
        configMap:
@@ -92,4 +98,5 @@ spec:
    {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
-{{- end }}
+{{- end }}
+{{- end -}}
@@ -0,0 +1,9 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
+{{- end }}
+{{- end }}
+{{- end -}}
@@ -0,0 +1,7 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-controller
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
@@ -1,3 +1,4 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
 {{- if .Values.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -19,4 +20,5 @@ spec:
      svc: controller
  endpoints:
  - targetPort: 8080
+{{- end -}}
 {{- end -}}
@@ -1,3 +1,4 @@
+{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -15,4 +16,5 @@ spec:
    nodePort: {{ .Values.controllerPort }}
 {{- end }}
  selector:
-    svc: controller
+    svc: controller
+{{- end -}}
@@ -6,10 +6,10 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ printf "%s-%s" $.Chart.Name $filename | trunc 63 | trimSuffix "-" }}
-  namespace: {{ $.grafana.Namespace }}
+  namespace: {{ $.Values.grafana.namespace }}
  labels:
    grafana_dashboard: "1"
-    created_by: "{{ .Chart.Name }}"
+    created_by: "{{ $.Chart.Name }}"
 data:
  {{ base $path }}: '{{ $files.Get $path }}'
 ---
@@ -0,0 +1,81 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-executor
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-executor
+subjects:
+  - kind: ServiceAccount
+    name: fission-executor
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-executor
+  apiGroup: rbac.authorization.k8s.io
@@ -27,7 +27,7 @@ spec:
        image: {{ include "fission-bundleImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: ["/fission-bundle"]
-        args: ["--executorPort", "8888", "--namespace", "{{ .Values.functionNamespace }}"]
+        args: ["--executorPort", "8888"]
        env:
        - name: FETCHER_IMAGE
        {{- if eq .Values.fetcher.imageTag "" }}
@@ -37,6 +37,12 @@ spec:
        {{- end }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
+        - name: FISSION_BUILDER_NAMESPACE
+          value: "{{ .Values.builderNamespace }}"
+        - name: FISSION_FUNCTION_NAMESPACE
+          value: "{{ .Values.functionNamespace }}"
+        - name: FISSION_DEFAULT_NAMESPACE
+          value: "{{ .Values.defaultNamespace }}"  
        - name: RUNTIME_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: ADOPT_EXISTING_RESOURCES
@@ -57,6 +63,21 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
+        - name: OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.objectReaperInterval | quote }}
+        {{- if .Values.executor.poolmgr.objectReaperInterval }}
+        - name: POOLMGR_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.poolmgr.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.newdeploy.objectReaperInterval }}
+        - name: NEWDEPLOY_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.newdeploy.objectReaperInterval | quote }}
+        {{- end}}
+        {{- if .Values.executor.container.objectReaperInterval }}
+        - name: CONTAINER_OBJECT_REAPER_INTERVAL
+          value: {{ .Values.executor.container.objectReaperInterval | quote }}
+        {{- end}}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
        {{- include "opentelemtry.envs" . | indent 8 }}
@@ -94,7 +115,7 @@ spec:
        {{- else if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-executor
 {{- if .Values.executor.priorityClassName }}
      priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-executor
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-fluentbit
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-fluentbit
+subjects:
+  - kind: ServiceAccount
+    name: fission-fluentbit
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-fluentbit
+  apiGroup: rbac.authorization.k8s.io
@@ -173,7 +173,7 @@ spec:
            - name: fluentbit-config
              mountPath: /fluent-bit/etc/
              readOnly: true
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-fluentbit
      volumes:
        - name: container-log
          hostPath:
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-fluentbit
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,56 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-kubewatcher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-kubewatcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-kubewatcher
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-kubewatcher
+  apiGroup: rbac.authorization.k8s.io
@@ -29,6 +29,7 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.kubewatcher.resources | nindent 10 }}
@@ -38,7 +39,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kubewatcher
 {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kubewatcher
+  namespace: {{ .Release.Namespace }}
@@ -1,24 +1,29 @@
 {{- if .Values.createNamespace }}
+{{- if and (ne .Values.functionNamespace "default") (ne .Values.functionNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.functionNamespace }}
+  name: {{ template "fission-function-ns" . }}
  labels:
    name: fission-function
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    {{- if .Values.enableIstio }}
    istio-injection: enabled
    {{- end }}
+{{- end}}

 ---
+
+{{- if and (ne .Values.builderNamespace "default") (ne .Values.builderNamespace "") }}
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ .Values.builderNamespace }}
+  name: {{ template "fission-builder-ns" . }}
  labels:
    name: fission-builder
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    {{- if .Values.enableIstio }}
    istio-injection: enabled
    {{- end }}
+{{- end }}
 {{- end }}
@@ -1,70 +1,30 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+{{/* 
+Passing namespace as an argument to the "fissionFunction.roles" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ .Values.functionNamespace }}
+  namespace: {{ template "fission-function-ns" . }}
  name: {{ .Release.Name }}-event-fetcher
 rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}
@@ -1,38 +1,15 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-fission-builder
-subjects:
-  - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
+{{/* 
+Passing namespace as an argument to the "fissionFunction.rolebindings" template.
+Need to use merge function to pass in the current scope so that ".Release" values
+can be used
+ */}}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ .Values.functionNamespace }}
+  namespace: {{ template "fission-function-ns" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -40,4 +17,10 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+    namespace: {{ template "fission-function-ns" . }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
+{{- end }}
+{{- end }}
@@ -2,11 +2,11 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: fission-fetcher
-  namespace: {{ .Values.functionNamespace }}
+  namespace: {{ template "fission-function-ns" . }}

 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: fission-builder
-  namespace: {{ .Values.builderNamespace }}
+  namespace: {{ template "fission-builder-ns" . }}
@@ -0,0 +1,62 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-kafka
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-kafka
+subjects:
+  - kind: ServiceAccount
+    name: fission-kafka
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-kafka
+  apiGroup: rbac.authorization.k8s.io
@@ -47,6 +47,7 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
        {{- include "opentelemtry.envs" . | indent 8 }}
        # TLS authentication is TLS with authentication (2 way)
        # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
@@ -67,7 +68,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-kafka
      {{- if .Values.kafka.authentication.tls.enabled }}
      volumes:
      - name: kafka-secrets
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-kafka
+  namespace: {{ .Release.Namespace }}
@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Release.Name }}-fission-cr-admin
+  name: {{ .Release.Name }}-keda
 rules:
 - apiGroups:
  - ""
@@ -12,7 +12,6 @@ rules:
  - services
  - serviceaccounts
  - replicationcontrollers
-  - namespaces
  - events
  verbs:
  - create
@@ -28,21 +27,13 @@ rules:
  - deployments/scale
  - replicasets
  verbs:
-  - '*'
- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
+  - create
  - get
  - list
  - watch
- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - '*'
+  - update
+  - patch
+  - delete
 - apiGroups:
  - apiextensions.k8s.io
  resources:
@@ -51,31 +42,18 @@ rules:
  - get
  - list
  - watch
- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - '*'
- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - '*'
 - apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 - apiGroups:
  - rbac.authorization.k8s.io
  resources:
@@ -92,7 +70,13 @@ rules:
  - triggerauthentications
  - triggerauthentications/status
  verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 {{- if .Values.mqt_keda.enabled }}
 - apiGroups:
  - keda.k8s.io
@@ -104,7 +88,13 @@ rules:
  - triggerauthentications
  - triggerauthentications/status
  verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 {{- end }}
 - apiGroups:
  - metrics.k8s.io
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-keda
+subjects:
+  - kind: ServiceAccount
+    name: fission-keda
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-keda
+  apiGroup: rbac.authorization.k8s.io
@@ -46,6 +46,7 @@ spec:
          value: "{{ .Values.mqt_keda.connector_images.gcp_pubsub.image }}:{{ .Values.mqt_keda.connector_images.gcp_pubsub.tag }}"
        - name: REDIS_IMAGE
          value: "{{ .Values.mqt_keda.connector_images.redis.image }}:{{ .Values.mqt_keda.connector_images.redis.tag }}"
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.mqt_keda.resources | nindent 10 }}
@@ -55,7 +56,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-keda
 {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}
@@ -1,5 +1,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: fission-svc
+  name: fission-keda
  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
@@ -0,0 +1,15 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-preupgrade
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+subjects:
+  - kind: ServiceAccount
+    name: fission-preupgrade
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-preupgrade
+  apiGroup: rbac.authorization.k8s.io
@@ -15,6 +15,7 @@ metadata:
    # job is considered part of the release.
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "1"
 spec:
  backoffLimit: 0
  template:
@@ -34,12 +35,13 @@ spec:
      {{- end }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: [ "/pre-upgrade-checks" ]
-        args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
+        env:
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        {{- if .Values.terminationMessagePath }}
        terminationMessagePath: {{ .Values.terminationMessagePath }}
        {{- end }}
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-preupgrade
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-preupgrade
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-1"
@@ -0,0 +1,60 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-router
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-router
+subjects:
+  - kind: ServiceAccount
+    name: fission-router
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-router
+  apiGroup: rbac.authorization.k8s.io
@@ -83,6 +83,7 @@ spec:
          value: {{ .Values.pprof.enabled | quote }}
        - name: DISPLAY_ACCESS_LOG
          value: {{ .Values.router.displayAccessLog | default false | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.router.resources | nindent 10 }}
@@ -122,7 +123,7 @@ spec:
        {{- else if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-router
      volumes:
      - name: config-volume
        configMap:
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-router
+  namespace: {{ .Release.Namespace }}
@@ -60,6 +60,7 @@ spec:
        - name: STORAGE_S3_REGION
          value: {{ .Values.persistence.s3.region }}
        {{- end }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.storagesvc.resources | nindent 10 }}
@@ -96,7 +97,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-storagesvc
      {{- if and (.Values.persistence.enabled) (ne (.Values.persistence.storageType | default "local") "s3") }}
      volumes:
      - name: fission-storage
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-storagesvc
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,48 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-timer
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - serviceaccounts
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - bind
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-timer
+subjects:
+  - kind: ServiceAccount
+    name: fission-timer
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-timer
+  apiGroup: rbac.authorization.k8s.io
@@ -29,6 +29,7 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.timer.resources | nindent 10 }}
@@ -38,7 +39,7 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
-      serviceAccountName: fission-svc
+      serviceAccountName: fission-timer
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
@@ -0,0 +1,7 @@
+{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if not .Values.singleDefaultNamespace }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-timer
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,38 @@
+{{- $certManagerEnabled := .Values.webhook.certManager.enabled }}
+
+{{- if not $certManagerEnabled }}
+kind: Secret
+apiVersion: v1
+metadata:
+  name: fission-webhook-certs
+  labels:
+    app.kubernetes.io/component: webhook-secret
+type: Opaque
+data:
+  ca.crt: {{ b64enc (include "webhook.caBundleCertPEM" .) }}
+  tls.crt: {{ b64enc (include "webhook.certPEM" .) }}
+  tls.key: {{ b64enc (include "webhook.keyPEM" .) }}
+
+{{- else }}
+apiVersion: cert-manager.io/v1 
+kind: Issuer  
+metadata:  
+  name: fission-selfsigned-issuer  
+  namespace: {{ .Release.Namespace }}  
+spec:  
+  selfSigned: {}  
+---  
+apiVersion: cert-manager.io/v1  
+kind: Certificate  
+metadata:  
+  name: fission-webhook-cert  
+  namespace: {{ .Release.Namespace }}  
+spec:  
+  secretName: fission-webhook-certs  
+  dnsNames:  
+    - "webhook-service.{{ .Release.Namespace }}.svc"  
+    - "webhook-service.{{ .Release.Namespace }}.svc.cluster.local " 
+  issuerRef:  
+    name: fission-selfsigned-issuer
+
+{{- end }}
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: webhook-service
+    application: fission-webhook
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      svc: webhook-service
+      application: fission-webhook
+  template:
+    metadata:
+      labels:
+        svc: webhook-service
+        application: fission-webhook
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "8080"
+    spec:
+      {{- if .Values.webhook.securityContext.enabled }}
+      securityContext: {{- omit .Values.webhook.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: webhook
+        image: {{ include "fission-bundleImage" . | quote }}
+        imagePullPolicy: {{ .Values.pullPolicy }}
+        command: ["/fission-bundle"]
+        args: ["--webhookPort", "9443"]
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: serving-certs
+          readOnly: true
+        ports:
+          - containerPort: 8080
+            name: metrics
+      volumes:
+      - name: serving-certs
+        secret:
+          secretName: fission-webhook-certs
+      serviceAccountName: fission-webhook
+{{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- if .Values.extraCoreComponentPodConfig }}
+{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
+{{- end }}
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-webhook
+  namespace: {{ .Release.Namespace }}
@@ -0,0 +1,22 @@
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: webhook-monitor
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- end }}
+  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      svc: webhook-service
+  endpoints:
+  - targetPort: 8080
+{{- end -}}
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-service
+  labels:
+    svc: webhook-service
+    application: fission-webhook
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  type: {{ .Values.serviceType }}
+  ports:
+  - port: 443
+    targetPort: 9443
+  selector:
+    svc: webhook-service
@@ -0,0 +1,203 @@
+---
+{{- $caCert := include "webhook.caBundleCertPEM" . -}}
+{{- $crtPEM := include "webhook.certPEM" . -}}
+{{- $keyPEM := include "webhook.keyPEM" . -}}
+
+{{- $certManagerEnabled := $.Values.webhook.certManager.enabled }}
+{{- $caBundleValue := "" -}}
+{{- if $certManagerEnabled }}
+{{- $caBundleValue = "Cg==" -}}
+{{- else }}
+{{- $caBundleValue = ternary (b64enc $caCert) (b64enc (trim $crtPEM)) (empty $crtPEM)  -}}
+{{- end }}
+
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: mutating-webhook-configuration
+  {{- if $certManagerEnabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /mutate-fission-io-v1-package
+  failurePolicy: Fail
+  name: mpackage.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - packages
+  sideEffects: None
+---
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: validating-webhook-configuration
+  {{- if $certManagerEnabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-environment
+  failurePolicy: Fail
+  name: venvironment.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    resources:
+    - environments
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-function
+  failurePolicy: Fail
+  name: vfunction.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - functions
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-httptrigger
+  failurePolicy: Fail
+  name: vhttptrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - httptriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-kuberneteswatchtrigger
+  failurePolicy: Fail
+  name: vkuberneteswatchtrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - kuberneteswatchtriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-messagequeuetrigger
+  failurePolicy: Fail
+  name: vmessagequeuetrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - messagequeuetriggers
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-package
+  failurePolicy: Fail
+  name: vpackage.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - packages
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: {{ $caBundleValue }}
+    service:
+      name: webhook-service
+      namespace:  {{ .Release.Namespace }}
+      path: /validate-fission-io-v1-timetrigger
+  failurePolicy: Fail
+  name: vtimetrigger.fission.io
+  rules:
+  - apiGroups:
+    - fission.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - timetriggers
+  sideEffects: None
@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.17.0-rc2
+imageTag: v1.18.0-rc1

 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -61,20 +61,38 @@ controllerPort: 31313
 ##
 routerPort: 31314

-## functionNamespace represents the namespace in which Fission Function resources will be created.
+## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-##
-functionNamespace: fission-function
-
-## builderNamespace represents the namespace in which Fission Builder resources will be created.
-## This is different from the release namespace.
-##
-builderNamespace: fission-builder
-
-## defaultNamespace represents the default namespace in Kubernetes.
+## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
+## more than one namespace to be used for Fission custom resources.
+## Fission will watch the defaultNamespace only if `singleDefaultNamespace` is true.
 ##
 defaultNamespace: default

+## builderNamespace represents the namespace in which Fission Builder resources will be created.
+## if builderNamespace is set to empty then builder resources will be created in the same namespace as the Fission resources.
+## This is different from the release namespace.
+##
+builderNamespace: ""
+
+## functionNamespace represents the namespace in which Fission Function resources will be created.
+## if functionNamespace is set to empty then function resources will be created in the same namespace as the Fission resources.
+## This is different from the release namespace.
+##
+functionNamespace: ""
+
+## If true, fission will only watch for fission custom resources created in the `defaultNamespace` above.
+##
+singleDefaultNamespace: true
+
+## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
+## Only works if `singleDefaultNamespace` is false.
+## additionalFissionNamespaces: 
+## - namespace1
+## - namespace2
+## - namespace3
+additionalFissionNamespaces: []
+
 ## createNamespace decides to create namespaces by the chart.
 ## If set to true, functionNamespace and builderNamespace namespaces mentioned above will be created by the chart.
 ## Set to false if you want to create the namespaces manually.
@@ -92,7 +110,7 @@ fetcher:
  ## image represents the image of the fetcher component.
  image: fission/fetcher
  ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.17.0-rc2
+  imageTag: v1.18.0-rc1

  ## Fetcher is only for to downloading or uploading archive.
  ## Normally, you don't need to change the value here, unless necessary.
@@ -155,6 +173,26 @@ executor:
    runAsUser: 10001
    runAsGroup: 10001

+  ## Object Reaper
+  ## objectReaperInterval (seconds) represents GLOBAL interval to run process that reaps objects after certain idle time.
+  ## Also you can set different objectReaperInterval for specific executor type. See poolmgs/newdeploy/container section
+  ## Default: 5 (in seconds)
+  ##
+  objectReaperInterval: 5
+
+  poolmgr: {}
+    ## objectReaperInterval specific to poolmgr executor type
+    ##
+    ## objectReaperInterval: 5
+  newdeploy: {}
+    ## objectReaperInterval specific to newdeploy  executor type
+    ##
+    ## objectReaperInterval: 5
+  container: {}
+    ## objectReaperInterval specific to container executor type
+    ##
+    ## objectReaperInterval: 5
+
 ## router is responsible for routing function calls to the appropriate function.
 ##
 router:
@@ -231,7 +269,7 @@ router:
    maxRetries: 10

  ## Extend the container specs for the core fission pods.
-  ## Can be used to add things like affinty/tolerations/nodeSelectors/etc.
+  ## Can be used to add things like affinity/tolerations/nodeSelectors/etc.
  ## For example:
  ## extraCoreComponentPodConfig:
  ##   affinity:
@@ -302,6 +340,7 @@ buildermgr:
 ## It contains CRUD APIs for functions, triggers, environments, Kubernetes event watches, etc. and proxy APIs to internal 3rd-party services.
 ##
 controller:
+  enabled: false
  ## Pod resources as:
  ##  resources:
  ##    limits:
@@ -313,6 +352,43 @@ controller:
  ##
  resources: {}

+  ## Security Context
+  ## It holds pod-level and container level security configuration.
+  ## This is an experimental section, please verify before enabling in production.
+  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
+  securityContext:
+    enabled: false
+    ## Mark it false, if you want to stop the non root user validation
+    runAsNonRoot: true
+    fsGroup: 10001
+    runAsUser: 10001
+    runAsGroup: 10001 
+
+## webhook is the component that validates API calls.
+## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
+##
+webhook:
+  ## Pod resources as:
+  ##  resources:
+  ##    limits:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##    requests:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##
+  resources: {}
+
+  certManager:
+    enabled: false
+
+  caBundlePEM: |
+
+  crtPEM: |
+
+  keyPEM: |
+
+
  ## Security Context
  ## It holds pod-level and container level security configuration.
  ## This is an experimental section, please verify before enabling in production.
@@ -325,6 +401,7 @@ controller:
    runAsUser: 10001
    runAsGroup: 10001

+
 ## kubewatcher watches the Kubernetes API and invokes functions associated with watches, sending the watch event to the function.
 ##
 kubewatcher:
@@ -459,8 +536,8 @@ serviceMonitor:
  ##namespace in which you want to deploy servicemonitor
  ##
  namespace: ""
-  ## Map of additional lables to add to the ServiceMonitor resources
-  #  to allow selecting sepcific ServiceMonitors
+  ## Map of additional labels to add to the ServiceMonitor resources
+  #  to allow selecting specific ServiceMonitors
  #  in case of multiple prometheus deployments
  additionalServiceMonitorLabels: {}
  #  release: "monitoring"
@@ -473,8 +550,8 @@ podMonitor:
  ##namespace in which you want to deploy podmonitor
  ##
  namespace: ""
-  ## Map of additional lables to add to the PodMonitor resources
-  #  to allow selecting sepcific PodMonitor
+  ## Map of additional labels to add to the PodMonitor resources
+  #  to allow selecting specific PodMonitor
  #  in case of multiple prometheus deployments
  additionalPodMonitorLabels: {}
  #  release: "monitoring"
@@ -522,7 +599,7 @@ persistence:
  size: 8Gi

 ## Extend the container specs for the core fission pods.
-## Can be used to add things like affinty/tolerations/nodeSelectors/etc.
+## Can be used to add things like affinity/tolerations/nodeSelectors/etc.
 ## For example:
 ## extraCoreComponentPodConfig:
 ##   affinity:
@@ -607,7 +684,7 @@ preUpgradeChecks:
  image: fission/pre-upgrade-checks
  ## pre-install/pre-upgrade checks image version
  ##
-  imageTag: v1.17.0-rc2
+  imageTag: v1.18.0-rc1

 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -627,11 +704,34 @@ prometheus:
  ##
  serviceEndpoint: ""

-## set this flag to true if you need canary deployment feature
-##
+
 canaryDeployment:
+## set this flag to true if you need canary deployment feature
  enabled: false

+  ## Pod resources as:
+  ##  resources:
+  ##    limits:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##    requests:
+  ##      cpu: <tbd>
+  ##      memory: <tbd>
+  ##
+  resources: {}
+
+  ## Security Context
+  ## It holds pod-level and container level security configuration.
+  ## This is an experimental section, please verify before enabling in production.
+  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
+  securityContext:
+    enabled: false
+    ## Mark it false, if you want to stop the non root user validation
+    runAsNonRoot: true
+    fsGroup: 10001
+    runAsUser: 10001
+    runAsGroup: 10001
+
 ## Enable authentication for fission function invocation via Fission router
 ##
 authentication:
@@ -20,18 +20,18 @@ import (
 	"os"

 	"go.uber.org/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"

 	"github.com/fission/fission/cmd/builder/app"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 	"github.com/fission/fission/pkg/utils/profile"
-	"github.com/fission/fission/pkg/utils/signals"
 )

 // Usage: builder <shared volume path>
 func main() {
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()
-	ctx := signals.SetupSignalHandlerWithContext(logger)
+	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)
 	shareVolume := os.Args[1]
 	if _, err := os.Stat(shareVolume); err != nil {
@@ -17,10 +17,11 @@ limitations under the License.
 package main

 import (
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
+
 	"github.com/fission/fission/cmd/fetcher/app"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 	"github.com/fission/fission/pkg/utils/profile"
-	"github.com/fission/fission/pkg/utils/signals"
 )

 // Usage: fetcher <shared volume path>
@@ -28,7 +29,7 @@ func main() {
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()

-	ctx := signals.SetupSignalHandlerWithContext(logger)
+	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)
 	app.Run(ctx, logger)
 }
@@ -24,11 +24,12 @@ import (
 	"strconv"

 	docopt "github.com/docopt/docopt-go"
-
 	"go.uber.org/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"

 	"github.com/fission/fission/cmd/fission-bundle/mqtrigger"
 	"github.com/fission/fission/pkg/buildermgr"
+	"github.com/fission/fission/pkg/canaryconfigmgr"
 	"github.com/fission/fission/pkg/controller"
 	"github.com/fission/fission/pkg/executor"
 	"github.com/fission/fission/pkg/info"
@@ -41,19 +42,28 @@ import (
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 	"github.com/fission/fission/pkg/utils/otel"
 	"github.com/fission/fission/pkg/utils/profile"
-	"github.com/fission/fission/pkg/utils/signals"
+	"github.com/fission/fission/pkg/webhook"
 )

+// runWebhook starts admission webhook server
+func runWebhook(ctx context.Context, logger *zap.Logger, port int) error {
+	return webhook.Start(ctx, logger, port)
+}
+
 func runController(ctx context.Context, logger *zap.Logger, port int) {
 	controller.Start(ctx, logger, port, false)
 }

+func runCanaryConfigServer(ctx context.Context, logger *zap.Logger) error {
+	return canaryconfigmgr.StartCanaryServer(ctx, logger, false)
+}
+
 func runRouter(ctx context.Context, logger *zap.Logger, port int, executorUrl string) {
 	router.Start(ctx, logger, port, executorUrl)
 }

-func runExecutor(ctx context.Context, logger *zap.Logger, port int, functionNamespace, envBuilderNamespace string) error {
-	return executor.StartExecutor(ctx, logger, functionNamespace, envBuilderNamespace, port)
+func runExecutor(ctx context.Context, logger *zap.Logger, port int) error {
+	return executor.StartExecutor(ctx, logger, port)
 }

 func runKubeWatcher(ctx context.Context, logger *zap.Logger, routerUrl string) error {
@@ -77,8 +87,8 @@ func runStorageSvc(ctx context.Context, logger *zap.Logger, port int, storage st
 	return storagesvc.Start(ctx, logger, storage, port)
 }

-func runBuilderMgr(ctx context.Context, logger *zap.Logger, storageSvcUrl string, envBuilderNamespace string) error {
-	return buildermgr.Start(ctx, logger, storageSvcUrl, envBuilderNamespace)
+func runBuilderMgr(ctx context.Context, logger *zap.Logger, storageSvcUrl string) error {
+	return buildermgr.Start(ctx, logger, storageSvcUrl)
 }

 func runLogger(ctx context.Context, logger *zap.Logger) {
@@ -168,6 +178,7 @@ Use it to start one or more of the fission servers:

 Usage:
  fission-bundle --controllerPort=<port>
+  fission-bundle --canaryConfig
  fission-bundle --routerPort=<port> [--executorUrl=<url>]
  fission-bundle --executorPort=<port> [--namespace=<namespace>] [--fission-namespace=<namespace>]
  fission-bundle --kubewatcher [--routerUrl=<url>]
@@ -176,10 +187,13 @@ Usage:
  fission-bundle --timer [--routerUrl=<url>]
  fission-bundle --mqt   [--routerUrl=<url>]
  fission-bundle --mqt_keda [--routerUrl=<url>]
+  fission-bundle --webhookPort=<port>
  fission-bundle --logger
  fission-bundle --version
 Options:
  --controllerPort=<port>         Port that the controller should listen on.
+  --canaryConfig		  		  Start canary config server.
+  --webhookPort=<port>             Port that the webhook should listen on.
  --routerPort=<port>             Port that the router should listen on.
  --executorPort=<port>           Port that the executor should listen on.
  --storageServicePort=<port>     Port that the storage service should listen on.
@@ -199,7 +213,7 @@ Options:
 	logger := loggerfactory.GetLogger()
 	defer exitWithSync(logger)

-	ctx := signals.SetupSignalHandlerWithContext(logger)
+	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)

 	version := fmt.Sprintf("Fission Bundle Version: %v", info.BuildInfo().String())
@@ -218,13 +232,17 @@ Options:
 		defer shutdown(ctx)
 	}

-	functionNs := getStringArgWithDefault(arguments["--namespace"], "fission-function")
-	envBuilderNs := getStringArgWithDefault(arguments["--envbuilder-namespace"], "fission-builder")
-
 	executorUrl := getStringArgWithDefault(arguments["--executorUrl"], "http://executor.fission")
 	routerUrl := getStringArgWithDefault(arguments["--routerUrl"], "http://router.fission")
 	storageSvcUrl := getStringArgWithDefault(arguments["--storageSvcUrl"], "http://storagesvc.fission")

+	if arguments["--webhookPort"] != nil {
+		port := getPort(logger, arguments["--webhookPort"])
+		err = runWebhook(ctx, logger, port)
+		logger.Error("webhook server exited:", zap.Error(err))
+		return
+	}
+
 	if arguments["--controllerPort"] != nil {
 		port := getPort(logger, arguments["--controllerPort"])
 		runController(ctx, logger, port)
@@ -232,6 +250,14 @@ Options:
 		return
 	}

+	if arguments["--canaryConfig"] == true {
+		err := runCanaryConfigServer(ctx, logger)
+		if err != nil {
+			logger.Error("canary config server exited with error: ", zap.Error(err))
+			return
+		}
+	}
+
 	if arguments["--routerPort"] != nil {
 		port := getPort(logger, arguments["--routerPort"])
 		runRouter(ctx, logger, port, executorUrl)
@@ -241,7 +267,7 @@ Options:

 	if arguments["--executorPort"] != nil {
 		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, logger, port, functionNs, envBuilderNs)
+		err = runExecutor(ctx, logger, port)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
 			return
@@ -281,7 +307,7 @@ Options:
 	}

 	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, logger, storageSvcUrl, envBuilderNs)
+		err = runBuilderMgr(ctx, logger, storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
 			return
@@ -41,7 +41,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}

-	err = crd.WaitForCRDs(fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
@@ -14,10 +14,9 @@ limitations under the License.
 package app

 import (
+	"github.com/pkg/errors"
 	"github.com/spf13/cobra"

-	"github.com/fission/fission/pkg/controller/client"
-	"github.com/fission/fission/pkg/controller/client/rest"
 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
 	wrapper "github.com/fission/fission/pkg/fission-cli/cliwrapper/driver/cobra"
 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/driver/cobra/helptemplate"
@@ -39,7 +38,6 @@ import (
 	"github.com/fission/fission/pkg/fission-cli/console"
 	"github.com/fission/fission/pkg/fission-cli/flag"
 	flagkey "github.com/fission/fission/pkg/fission-cli/flag/key"
-	"github.com/fission/fission/pkg/fission-cli/util"
 	_ "github.com/fission/fission/pkg/mqtrigger/messageQueue/kafka"
 )

@@ -61,19 +59,17 @@ func App() *cobra.Command {
 		PersistentPreRunE: wrapper.Wrapper(
 			func(input cli.Input) error {
 				console.Verbosity = input.Int(flagkey.Verbosity)
-
-				if input.IsSet(flagkey.ClientOnly) || input.IsSet(flagkey.PreCheckOnly) {
-					// TODO: use fake rest client for offline spec generation
-					cmd.SetClientset(client.MakeFakeClientset(nil))
-				} else {
-					serverUrl, err := util.GetServerURL(input)
-					if err != nil {
-						return err
-					}
-					restClient := rest.NewRESTClient(serverUrl)
-					cmd.SetClientset(client.MakeClientset(restClient))
+				clientOptions := cmd.ClientOptions{
+					KubeContext: input.String(flagkey.KubeContext),
 				}
-
+				// TODO: use fake rest client for offline spec generation
+				// if input.IsSet(flagkey.ClientOnly) || input.IsSet(flagkey.PreCheckOnly) {
+				// }
+				client, err := cmd.NewClient(clientOptions)
+				if err != nil {
+					return errors.Wrap(err, "failed to get fission client")
+				}
+				cmd.SetClientset(*client)
 				return nil
 			},
 		),
@@ -87,7 +83,7 @@ func App() *cobra.Command {
 	})

 	wrapper.SetFlags(rootCmd, flag.FlagSet{
-		Global: []flag.Flag{flag.GlobalServer, flag.GlobalVerbosity, flag.KubeContext},
+		Global: []flag.Flag{flag.GlobalServer, flag.GlobalVerbosity, flag.KubeContext, flag.Namespace},
 	})

 	groups := helptemplate.CommandGroups{}
@@ -101,7 +97,7 @@ func App() *cobra.Command {

 	flagExposer := helptemplate.ActsAsRootCommand(rootCmd, nil, groups...)
 	// show global options in usage
-	flagExposer.ExposeFlags(rootCmd, flagkey.Server, flagkey.Verbosity, flagkey.KubeContext)
+	flagExposer.ExposeFlags(rootCmd, flagkey.Server, flagkey.Verbosity, flagkey.KubeContext, flagkey.Namespace)

 	return rootCmd
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sanket SudakeandGitHub	68286fe44e	Track all Go tools version in tools package (#2628 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-21 12:14:03 +05:30
neha_guptaandGitHub	d559628f29	add validation to avoid cross ns config and functions (#2627 )	2022-11-17 20:43:07 +05:30
neha_guptaandGitHub	4cbe6a7061	Get logs from Pods using Kubernetes API for function log command (#2623 ) * add controller enablement flag * throw an error if service not found * add logs from Kubernetes in function log command * pass context in function param * add pod-namespace in function log command * pass context in function param * search for the pod in fn ns in the test	2022-11-17 13:13:33 +05:30
Shubham BansalandGitHub	6d117ad43a	Allow empty namespace for fission function and builder (#2621 ) Currently, we create Fission resources in the default namespace, function-related resources are created in the fission-function namespace, whereas builder resources are created in the fission-builder namespace. This causes confusion for a lot of users. In this fix, we allow the user to set the function and builder namespace empty so that function and builder resources are created in the same namespace as the function resource always. If the user desires older behaviour they can functionNamespace and builderNamespace the same previous before the upgrade. * use default namespace for fission function and builder * support for existing fission namespaces * Replace builder and function namespace with template * Fix namespace creation template Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-16 22:16:05 +05:30
neha_guptaandGitHub	70a0afd624	use namespace flag from global options for watch command (#2622 )	2022-11-15 21:10:05 +05:30
neha_guptaandGitHub	d2f201b721	Add Controller enable/disable flag in Helm Charts (#2620 ) * add controller enablement flag * throw error if service not found	2022-11-15 17:56:08 +05:30
neha_guptaandGitHub	3b2a86a8c9	Run canary config server separate from controller (#2617 ) * add canary config server * remove the canary config code from the controller * remove port exposure for canary config	2022-11-15 13:08:42 +05:30
neha_gupta GitHub shaunak_deshmukh	9a07d7d96b	Add validation/mutating webhook server for Fission custom resources (#2608 ) * add webhook server * add metrics port * Add self-signed cert generation in helm chart for webhooks (#2611) * remove cert-manager installation * update fission webhook charts * remove extra cluster role * add mutating webhook for pkg creation * Service name and bundle fixes (#2614) * caBundle templating * Rename fission.svc to fission-webhook.svc * update package build status Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-11-13 17:31:31 +05:30
Runit Misra GitHub shaunak_deshmukh Sanket Sudake	31dfc3e4d3	Convert ClusterRoles to Roles for all components for multiple namespaces (#2584 ) * Convert ClusterRoles to Roles for all components for multiple namespaces * Added templates for rules and role generator to dynamically generate roles for each component * Fix role-generator component templating * Enable namespaces variable for preupgradechecks Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io> Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-12 20:36:17 +05:30
Shubham BansalandGitHub	66897cb9d0	Delete builder service associated with environment name (#2616 )	2022-11-12 09:11:05 +05:30
Shubham Bansal GitHub Sanket Sudake	57d3a80fc6	Allow different namespaces in CI for fission-function and fission-builder (#2609 ) * Add variables for function/builder namespace in the test * Allow different namespaces in integration tests Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-11 18:56:20 +05:30
neha_guptaandGitHub	fa037166e1	Add Fission version API to router for CLI consumption (#2612 ) * add version API to router * return empty struct in case of error in getserverinfo	2022-11-11 12:58:40 +05:30
Shubham BansalandGitHub	32bd874ab6	List fission resources in specific namespace instead of all namespace (#2604 )	2022-11-08 10:25:09 +05:30
neha_gupta GitHub Sanket Sudake	b71a36dc1c	Use Kubernetes Client instead of Controller APIs from CLI (#2605 ) Use the Kubernetes and Fission Client from CLI instead of Controller API. This removes port-forwarding for the controller across Fission CLI mostly. * Use configurable client in CLI * Move resource namespace under cmd client * use server to get fission version * get archive with URL Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-07 21:42:39 +05:30
Shubham BansalandGitHub	261bf24974	Use informer for environment handling in buildermanager with multiple namespaces (#2603 ) * changes to add informer for environment * remove unnecessary code * code refactor * code review changes	2022-11-04 11:57:37 +05:30
Sanket SudakeandGitHub	6af53807aa	Monitor specific namespaces for configmap/secret updates (#2598 ) We allow functions to refer to configmap/secrets. We are monitoring all namespaces for config maps and secrets and also allow cross-namespace references. This fix monitors configmaps/secret updates in specific namespaces. Also, we ignore cross-namespace references for configmap/secret updates. Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-03 14:12:22 +05:30
Shubham BansalandGitHub	f37e9e6f89	Use informer for kube watcher handling with multiple namespace support (#2594 ) * changes to add informer for kube watcher * code refactor and fix cli issue for deleting watch	2022-11-02 19:10:06 +05:30
Shubham Bansal GitHub Sanket Sudake	b9fa6ca20a	Use informer for time trigger handling with multiple namespace support (#2593 ) * changes to add informer in timer for time trigger * Refactor timer trigger handlers and remove unwanted code Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>	2022-11-02 16:08:48 +05:30
Shubham BansalandGitHub	c33842c94c	Run package informer in go routine for multiple namespaces in buildermanager (#2592 )	2022-11-01 20:01:03 +05:30
Shubham BansalandGitHub	9ff9a6e075	newdeploy executor to work with specific namespaces (#2590 )	2022-10-31 12:55:57 +05:30
neha_guptaandGitHub	a64fcc3faf	use controller-runtime signals (#2589 )	2022-10-31 12:03:06 +05:30
Shubham BansalandGitHub	47cbbef06f	List Fission resource for specific namespace in executor reaper (#2587 ) * pool manager to work with specific namespaces * code review changes and revert changes for go.mod and values.yaml file	2022-10-28 20:39:08 +05:30
Shubham BansalandGitHub	dbd2153181	Fission failed to list resources if namespace flag is not provided (#2585 ) * use default namespace if no namespace is available * remove the current-context namespace from push_pr GitHub workflow	2022-10-28 17:39:49 +05:30
Sanket SudakeandGitHub	2bd005c387	Refactor code generator for deepcopy files (#2580 ) * Refactor code generator for deep copy files * Add timeout to push PR workflow * Add timeout for the fission-dump command * Update helm and kind versions Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-10-27 16:24:59 +05:30
Shubham BansalandGitHub	3a9e5ab65d	Error if rolebinding exists with different role reference in namespace (#2579 ) * added unit test for setup role binding method * changes to throw an error in case of mismatch in cluster role name * changes to add a check for role kind	2022-10-27 14:10:38 +05:30
Sanket SudakeandGitHub	ee790b3e1e	Update chart version to v1.18.0-rc1 (#2576 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-10-20 11:44:10 +05:30
Runit MisraandGitHub	7eeb3ead66	Role and RoleBinding for fission-fetcher and fission-builder for user configured namespaces (#2574 ) * Role and RoleBinding for fission-fetcher and fission-builder can be created in additional namespaces * Added template file for fetcher and builder role and rolebinding	2022-10-19 18:06:17 +05:30
Sanket Sudake GitHub shubham bansal	827baea974	Allow namespace configuration for different CRD resources in Fission (#2539 ) * Allow multiple namespaces for builder manager * Enable multiple namespaces for executor informers * Added missing context * helm chart support for multiple namespaces * Directly consume map type from GetInformerForNamespaces fn * Optimize function resolver by choosing namespace-specific informer * helm chart support for multiple namespaces * consider default namespace and move duplicate code to helm template * Improve documentation for fission namespace values Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: shubham bansal <shubhambansaliimtgn@gmail.com>	2022-10-19 15:48:47 +05:30
neha_guptaandGitHub	facd14de90	mprove warning/verbose messages around namespace in Fission CLI (#2572 ) Removed extra warning message while creating HTTP trigger, and updated some verbose logs to show info related to the namespace.	2022-10-17 17:52:34 +05:30
Runit MisraandGitHub	8d65b062f1	Extract out permissions for fission.io componenets per-component (#2570 ) * Extract out permissions for fission.io components per-component * PR review changes * Fix file names * Fix the filename for the router	2022-10-17 14:01:19 +05:30
Sanket SudakeandGitHub	d933f0ba6c	Skip CI if label added to PR (#2571 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-10-15 17:52:12 +05:30
Sanket SudakeandGitHub	f2b790921b	Remove unwanted permissions from Fission components (#2568 ) * Remove unwanted permissions from Fission components * Remove unwanted permission from buildermgr * Remove rbac permissions from controller * Remove unwanted namespace permission * Remove unwanted fission resource permissions * Add deployment list permission for buildermgr * add deployment create permission for buildermgr * Update action version * Add rolebinding permission for buildermanager * Reduce permissions for fetcher and builder components * Aded deployment delete permission to buildermgr * Add logger to wait crds function * Revert "Grant CustomResourcedefintion read permission to specific components (#2567)" This reverts commit `8fe62b755c`. Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-10-13 15:04:49 +05:30
Sanket SudakeandGitHub	8fe62b755c	Grant CustomResourcedefintion read permission to specific components (#2567 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-10-12 12:50:51 +05:30
neha_guptaandGitHub	b9513868ed	add namespace param for fn and env (#2556 ) This PR moves fission CLI as closer as possible to kubectl command behaviour. We have improved namespace handling behaviour across CLI. * add namespace param for fn and env * use common fn for ns check * update validation * default namespace for httpTrigger, env and package, config and triggers * use default ns * add namespace filter to spec * add forceNamespace flag * set current namespace * add default namespace in config * add namespace specific destroy * add all namespace in the list of resources * add namespace as global tag * use %s instead of %v * add test cases for namespace * use ns in get all functions	2022-10-11 13:23:47 +05:30
Runit MisraandGitHub	0739aca920	Separate service accounts for each fission component (#2560 ) * Separate service accounts for each component * Permission changes per component * Fixed fluentbit permissions * added hooks to pre-upgrade service account and role * Adjusted hook weights for pre-upgrade hook * Replaced * with explicit permissions	2022-10-06 19:17:34 +05:30
Sanket SudakeandGitHub	18225db2bd	Delete greetings.yml (#2563 )	2022-10-04 16:34:10 +05:30
Sanket SudakeandGitHub	8008a5420a	Update deps (#2558 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-09-29 13:19:14 +05:30
Sanket SudakeandGitHub	3fa0f4bde3	Ensuring passing context across fission (#2555 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-09-26 16:05:45 +05:30
Runit MisraandGitHub	a8a81ef5be	Remove `--force` option from upgrade strategy in skaffold.yaml (#2557 )	2022-09-26 11:34:33 +05:30
Andrey DudinandGitHub	1102999b4d	Add ability to configure object reaper interval for different executor types (#2543 ) Added properties to configure object reaper interval, global and specific to exec type. OBJECT_REAPER_INTERVAL - global NEWDEPLOY_OBJECT_REAPER_INTERVAL - for new deploy type CONTAINER_OBJECT_REAPER_INTERVAL - for container type POOLMGR_OBJECT_REAPER_INTERVAL - for poolmgr	2022-09-23 11:35:13 +05:30
AmborandGitHub	da50c3759d	feat: add the fn annotations to newdeploy function based deployment (#2554 ) * feat: add copy the fn annotations to the deploy annotations * feat: add copy the fn labels to the deploy labels	2022-09-22 14:21:27 +05:30
Sanket SudakeandGitHub	e87c84ee2c	Capture context from cobra CLI and pass forward (#2551 ) Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>	2022-09-22 13:54:05 +05:30
Shubham BansalandGitHub	d03395949b	changes to inject of otelhttp transport in executor (#2552 )	2022-09-22 10:47:47 +05:30
Shaunak Deshmukh GitHub shaunak_deshmukh	b19d18c8bc	Enable promlinter and enhance exposed metrics. (#2550 ) * Enable promlinter * Rename archives metric and update dashboard, linter Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-09-20 12:40:34 +05:30
Shaunak Deshmukh GitHub shaunak_deshmukh	b36e0516f4	Update chart version v1.17.0 (#2549 ) Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-09-16 18:40:41 +05:30
Shaunak Deshmukh GitHub shaunak_deshmukh	121f962399	Add yaml manifest generation (#2548 ) Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-09-16 18:13:46 +05:30
Shaunak Deshmukh GitHub shaunak_deshmukh	58f33d6f6c	Add artifact and image signing (#2547 ) Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-09-15 19:31:10 +05:30
Shaunak Deshmukh GitHub shaunak_deshmukh	61f4d4f5ad	Fix dashboard template (#2546 ) Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>	2022-09-15 19:17:31 +05:30
Shubham BansalandGitHub	dc4c6e20e3	Add metric fission_mqt_message_lag for kafka mqt connector (#2544 ) These changes have specifically been made for Kafka connector. This will expose a new metric named `fission_mqt_message_lag`, which will show a number of messages lag per topic and partition. We can use this metric in the auto-scaling of the pod for the new deploy type executor function. While creating a new deploy function we need to add hpa metrics of external type inside the function definition.	2022-09-15 14:45:51 +05:30