Update Go Dependencies (#2863 )

--- github.com/IBM/sarama v1.41.2 [v1.41.3] github.com/elastic/crd-ref-docs v0.0.9 [v0.0.10] github.com/fsnotify/fsnotify v1.6.0 [v1.7.0] github.com/go-git/go-git/v5 v5.9.0 [v5.10.0] github.com/google/uuid v1.3.0 [v1.4.0] github.com/prometheus/common v0.44.0 [v0.45.0] google.golang.org/grpc v1.58.3 [v1.59.0] k8s.io/api v0.28.2 [v0.28.3] k8s.io/apiextensions-apiserver v0.28.2 [v0.28.3] k8s.io/apimachinery v0.28.2 [v0.28.3] k8s.io/client-go v0.28.2 [v0.28.3] k8s.io/metrics v0.28.2 [v0.28.3] sigs.k8s.io/controller-runtime v0.16.2 [v0.16.3] sigs.k8s.io/yaml v1.3.0 [v1.4.0] --- Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Add cause for all context timeouts (#2862 )
2023-10-30 11:11:06 +05:30 · 2023-10-29 13:19:06 +05:30 · 2023-10-27 15:05:20 +05:30 · 2023-10-26 14:40:38 +05:30 · 2023-10-26 12:09:11 +05:30 · 2023-10-23 19:40:09 +05:30
317 changed files with 9075 additions and 11978 deletions
@@ -25,10 +25,10 @@ jobs:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
          go-version-file: "go.mod"
          cache: true
@@ -19,12 +19,12 @@ jobs:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
-          go-version: 1.18.5
+          go-version-file: "go.mod"

      - name: Install dashboard linter
        run: |
@@ -18,7 +18,7 @@ on:
  workflow_dispatch:

 env:
-  GOLANGCI_LINT_VERSION: v1.49.0
+  GOLANGCI_LINT_VERSION: v1.51.1
  GOLANGCI_LINT_TIMEOUT: 5m

 jobs:
@@ -27,10 +27,10 @@ jobs:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
          go-version-file: "go.mod"
          cache: true
@@ -22,8 +22,9 @@ on:
  workflow_dispatch:

 env:
-  HELM_VERSION: v3.10.1
-  KIND_VERSION: v0.17.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.20.0
+  KIND_CLUSTER_NAME: kind

 jobs:
  # Job to run change detection
@@ -33,20 +34,20 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.19.16", "v1.20.15", "v1.21.14"]
+        kindversion: ["v1.23.17", "v1.25.11", "v1.27.3"]
        os: [ubuntu-latest]
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          repository: fission/examples
          path: examples
@@ -57,18 +58,19 @@ jobs:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@v1.8.0
        with:
-          image: kindest/node:${{ matrix.kindversion }}
+          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
          config: kind.yaml

      - name: Configuring and testing the Installation
        run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
          kubectl get nodes
          sudo apt-get install -y apache2-utils
-          kubectl config use-context kind-kind
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
          kubectl config view

      - name: Helm chart lint
@@ -77,12 +79,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v1.39.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v5
        with:
          install-only: true

@@ -91,7 +93,8 @@ jobs:
          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
          helm repo update
          kubectl create ns monitoring
-          helm install monitoring prometheus-community/prometheus -n monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false

      - name: Build and Install Fission CLI
        run: |
@@ -110,7 +113,6 @@ jobs:
      - name: Port-forward fission components
        run: |
          kubectl port-forward svc/router 8888:80 -nfission &
-          kubectl port-forward svc/controller 8889:80 -nfission &

      - name: Get fission version
        timeout-minutes: 10
@@ -131,7 +133,13 @@ jobs:
        timeout-minutes: 10
        if: ${{ always() }}
        run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh

      - name: Archive fission dump
        timeout-minutes: 10
@@ -142,6 +150,15 @@ jobs:
          path: fission-dump/*.zip
          retention-days: 5

+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
@@ -150,3 +167,148 @@ jobs:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
          retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.19.16"]
+        os: [ubuntu-latest]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+
+      - name: setup go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@v3
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@v1.8.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@v5
+        with:
+          install-only: true
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5
@@ -6,20 +6,21 @@ on:
      - v2.**

 env:
-  KIND_VERSION: v0.17.0
-  KIND_NODE_IMAGE_TAG: v1.19.16
+  KIND_VERSION: v0.20.0
+  KIND_NODE_IMAGE_TAG: v1.23.17
+  KIND_CLUSTER_NAME: kind

 jobs:
  create-draft-release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
          go-version-file: "go.mod"
          cache: true
@@ -29,22 +30,30 @@ jobs:
        run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v5
        with:
          install-only: true

      - name: Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@v1.8.0
        with:
-          image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
+          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
          version: ${{ env.KIND_VERSION }}
          config: kind.yaml
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3

-      - name: Docker Login
-        uses: docker/login-action@v2
+      - name: Login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to docker.io
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -69,7 +78,7 @@ jobs:
        shell: bash

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v5
        with:
          version: latest
          args: release
@@ -22,8 +22,9 @@ on:
  workflow_dispatch:

 env:
-  HELM_VERSION: v3.10.1
-  KIND_VERSION: v0.17.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.20.0
+  KIND_CLUSTER_NAME: kind

 jobs:
  upgrade-test:
@@ -32,14 +33,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindimage: ["kindest/node:v1.19.16"]
+        kindimage: ["kindest/node:v1.23.17"]
        os: [ubuntu-latest]
    steps:
      - name: Checkout action sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
        with:
          go-version-file: "go.mod"
          cache: true
@@ -50,22 +51,23 @@ jobs:
          version: ${{ env.HELM_VERSION }}

      - name: Setup Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@v1.8.0
        with:
-          image: ${{ matrix.kindimage }}
+          node_image: ${{ matrix.kindimage }}
          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v5
        with:
          install-only: true

      - name: Setup kubectl & fetch node information
        run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
          kubectl get nodes
          kubectl get storageclasses.storage.k8s.io
-          kubectl config use-context kind-kind
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
          kubectl config set-context --current --namespace=default
          kubectl config view

@@ -99,7 +101,7 @@ jobs:
      - name: Kind export logs
        if: ${{ always() }}
        run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs

      - name: Archive fission dump
        if: ${{ failure() || cancelled() }}
@@ -37,3 +37,6 @@ manifest/
 coverage.txt

 cosign.key
+
+# Dumps
+.dumps/
@@ -32,4 +32,4 @@ linters-settings:
  goimports:
    # put imports beginning with prefix after 3rd-party packages;
    # it's a comma-separated list of prefixes
-    local-prefixes: github.com/fission/fission
+    local: github.com/fission/fission
@@ -84,8 +84,11 @@ dockers:
    image_templates:
      - "fission/builder:latest-amd64"
      - "fission/builder:{{ .Tag }}-amd64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-amd64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -96,28 +99,60 @@ dockers:
    image_templates:
      - "fission/fetcher:latest-amd64"
      - "fission/fetcher:{{ .Tag }}-amd64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-amd64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-amd64
    ids:
      - fission-bundle
    image_templates:
      - "fission/fission-bundle:latest-amd64"
      - "fission/fission-bundle:{{ .Tag }}-amd64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-amd64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-amd64
    ids:
      - pre-upgrade-checks
    image_templates:
      - "fission/pre-upgrade-checks:latest-amd64"
      - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-amd64
    ids:
      - reporter
    image_templates:
      - "fission/reporter:latest-amd64"
      - "fission/reporter:{{ .Tag }}-amd64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "ghcr.io/fission/reporter:latest-amd64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - &docker-arm64
    use: buildx
    goos: linux
@@ -127,8 +162,11 @@ dockers:
    image_templates:
      - "fission/builder:latest-arm64"
      - "fission/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-arm64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -139,28 +177,60 @@ dockers:
    image_templates:
      - "fission/fetcher:latest-arm64"
      - "fission/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-arm64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-arm64
    ids:
      - fission-bundle
    image_templates:
      - "fission/fission-bundle:latest-arm64"
      - "fission/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-arm64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-arm64
    ids:
      - pre-upgrade-checks
    image_templates:
      - "fission/pre-upgrade-checks:latest-arm64"
      - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-arm64
    ids:
      - reporter
    image_templates:
      - "fission/reporter:latest-arm64"
      - "fission/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "ghcr.io/fission/reporter:latest-arm64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - &docker-armv7
    use: buildx
    goos: linux
@@ -171,8 +241,11 @@ dockers:
    image_templates:
      - "fission/builder:latest-armv7"
      - "fission/builder:{{ .Tag }}-armv7"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-armv7"
+      - "ghcr.io/fission/builder:{{ .Tag }}-armv7"
+    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm/v7"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -183,74 +256,156 @@ dockers:
    image_templates:
      - "fission/fetcher:latest-armv7"
      - "fission/fetcher:{{ .Tag }}-armv7"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-armv7"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-armv7"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-armv7
    ids:
      - fission-bundle
    image_templates:
      - "fission/fission-bundle:latest-armv7"
      - "fission/fission-bundle:{{ .Tag }}-armv7"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-armv7"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-armv7"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-armv7
    ids:
      - pre-upgrade-checks
    image_templates:
      - "fission/pre-upgrade-checks:latest-armv7"
      - "fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-armv7"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-armv7"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
  - <<: *docker-armv7
    ids:
      - reporter
    image_templates:
      - "fission/reporter:latest-armv7"
      - "fission/reporter:{{ .Tag }}-armv7"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "ghcr.io/fission/reporter:latest-armv7"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-armv7"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
 docker_manifests:
+  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/builder:{{ .Tag }}-amd64
+      - ghcr.io/fission/builder:{{ .Tag }}-arm64
+      - ghcr.io/fission/builder:{{ .Tag }}-armv7
  - name_template: fission/builder:{{ .Tag }}
    image_templates:
      - fission/builder:{{ .Tag }}-amd64
      - fission/builder:{{ .Tag }}-arm64
      - fission/builder:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
+      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
+      - ghcr.io/fission/fetcher:{{ .Tag }}-armv7
  - name_template: fission/fetcher:{{ .Tag }}
    image_templates:
      - fission/fetcher:{{ .Tag }}-amd64
      - fission/fetcher:{{ .Tag }}-arm64
      - fission/fetcher:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-armv7
  - name_template: fission/fission-bundle:{{ .Tag }}
    image_templates:
      - fission/fission-bundle:{{ .Tag }}-amd64
      - fission/fission-bundle:{{ .Tag }}-arm64
      - fission/fission-bundle:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-armv7
  - name_template: fission/pre-upgrade-checks:{{ .Tag }}
    image_templates:
      - fission/pre-upgrade-checks:{{ .Tag }}-amd64
      - fission/pre-upgrade-checks:{{ .Tag }}-arm64
      - fission/pre-upgrade-checks:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
+      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
+      - ghcr.io/fission/reporter:{{ .Tag }}-armv7
  - name_template: fission/reporter:{{ .Tag }}
    image_templates:
      - fission/reporter:{{ .Tag }}-amd64
      - fission/reporter:{{ .Tag }}-arm64
      - fission/reporter:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/builder:latest
+    image_templates:
+      - ghcr.io/fission/builder:latest-amd64
+      - ghcr.io/fission/builder:latest-arm64
+      - ghcr.io/fission/builder:latest-armv7
  - name_template: fission/builder:latest
    image_templates:
      - fission/builder:latest-amd64
      - fission/builder:latest-arm64
      - fission/builder:latest-armv7
+  - name_template: ghcr.io/fission/fetcher:latest
+    image_templates:
+      - ghcr.io/fission/fetcher:latest-amd64
+      - ghcr.io/fission/fetcher:latest-arm64
+      - ghcr.io/fission/fetcher:latest-armv7
  - name_template: fission/fetcher:latest
    image_templates:
      - fission/fetcher:latest-amd64
      - fission/fetcher:latest-arm64
-      - fission/fetcher:latest-armv7
+      - fission/fetcher:latest-armv7 
+  - name_template: ghcr.io/fission/fission-bundle:latest
+    image_templates:
+      - ghcr.io/fission/fission-bundle:latest-amd64
+      - ghcr.io/fission/fission-bundle:latest-arm64
+      - ghcr.io/fission/fission-bundle:latest-armv7
  - name_template: fission/fission-bundle:latest
    image_templates:
      - fission/fission-bundle:latest-amd64
      - fission/fission-bundle:latest-arm64
      - fission/fission-bundle:latest-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
+      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
+      - ghcr.io/fission/pre-upgrade-checks:latest-armv7
  - name_template: fission/pre-upgrade-checks:latest
    image_templates:
      - fission/pre-upgrade-checks:latest-amd64
      - fission/pre-upgrade-checks:latest-arm64
      - fission/pre-upgrade-checks:latest-armv7
+  - name_template: ghcr.io/fission/reporter:latest
+    image_templates:
+      - ghcr.io/fission/reporter:latest-amd64
+      - ghcr.io/fission/reporter:latest-arm64
+      - ghcr.io/fission/reporter:latest-armv7
  - name_template: fission/reporter:latest
    image_templates:
      - fission/reporter:latest-amd64
@@ -8,10 +8,10 @@ pull_request_rules:
      - check-success=CodeQL-Build
      - check-success=CodeQL
      - check-success=lint 
-      - check-success=upgrade-test (kindest/node:v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.20.7, ubuntu-latest)
-      - check-success=integration-test (v1.21.1, ubuntu-latest)
+      - check-success=upgrade-test (kindest/node:v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.25.11, ubuntu-latest)
+      - check-success=integration-test (v1.27.3, ubuntu-latest)
    actions:
      merge:
        method: squash
@@ -51,7 +51,7 @@ test-run: code-checks

 ### Binaries
 build-fission-cli:
-	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target --id fission-cli
+	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target --id fission-cli

 install-fission-cli:
 	# TODO: Fix this hack, replace v1 with GOAMD64
@@ -64,7 +64,7 @@ codegen: controller-gen-install

 ### CRDs
 controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.10.0
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.13.0

 generate-crds: controller-gen-install
 	controller-gen crd \
@@ -99,7 +99,7 @@ generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"

 install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@v0.0.8
+	go install github.com/elastic/crd-ref-docs@v0.0.9

 generate-crd-ref-docs: install-crd-ref-docs
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
@@ -111,12 +111,12 @@ generate-crd-ref-docs: install-crd-ref-docs
 all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs

 skaffold-prebuild:
-	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target
-	@cp -v cmd/builder/Dockerfile.fission-builder dist/builder_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fetcher/Dockerfile.fission-fetcher dist/fetcher_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fission-bundle/Dockerfile.fission-bundle dist/fission-bundle_linux_amd64_v1/Dockerfile
-	@cp -v cmd/reporter/Dockerfile.reporter dist/reporter_linux_amd64_v1/Dockerfile
-	@cp -v cmd/preupgradechecks/Dockerfile.fission-preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target
+	@cp -v cmd/builder/Dockerfile dist/builder_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fetcher/Dockerfile dist/fetcher_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
+	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
+	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile

 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)
@@ -127,3 +127,10 @@ release:
 	@./hack/release.sh $(VERSION)
 	@./hack/release-tag.sh $(VERSION)
 	@./hack/changelog.sh
+
+## Envtest
+install-envtest:
+	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+
+setup-envtest:
+	setup-envtest -p path use 1.23.x
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: fission-all
-version: v1.18.0-rc1
-appVersion: v1.18.0-rc1
+version: v1.20.0-rc1
+appVersion: v1.20.0-rc1
 description: Fission is a fast serverless framework for Kubernetes.
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
@@ -4,7 +4,7 @@

 ## Prerequisites

- Kubernetes 1.19+
+- Kubernetes 1.23+
 - Helm 3+

 ## Get Repo Info
@@ -93,6 +93,25 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen

 A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions.

+### Upgrade from 1.18.x to 1.20.x
+
+We have removed controller service from fission-all chart.
+
+### Upgrade from 1.17.x to 1.18.x
+
+With 1.18.x, we have major change in the way we are deploying Fission.
+We have added parameters `defaultNamespace`, `additionalFissionNamespaces`, `functionNamespace` and `builderNamespace` to manage the namespaces.
+We watch and manage specific namespaces for Fission resources configured via `defaultNamespace` and `additionalFissionNamespaces` parameters.
+You dont need to worry about `builderNamespace` and `functionNamespace` parameters, unless you want to consider legacy Fission resources.
+
+Please refer to [core changes](https://fission.io/docs/releases/v1.18.0/#fission-core-changes) for more details.
+
+### Upgrade from 1.16.x to 1.17.x
+
+By default, Fission runs with the default security context. This means that it will be run as root. We have added settings in Helm chart for securityContext across all services in Fission. You can enable recommended securityContext settings during Fission installation.
+
+Please refer to [security context settings](https://fission.io/docs/releases/v1.17.0/#security-context-setting-for-fission-installation) for more details.
+
 ### Upgrade from 1.15.x to 1.16.x

 If you have been using `prometheus.enabled=true` in your fission-all chart, you will need to deploy the prometheus using prometheus community supported chart.
@@ -11,14 +11,20 @@ Windows:

 2. You're ready to use Fission!

+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  You can create fission resources in the namespaces "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  You can create fission resources in the namespace "{{ .Values.defaultNamespace }}"
+{{- end }}
+
  # Create an environment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image fission/node-env --namespace {{ .Values.defaultNamespace }}

  # Get a hello world
  $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js

  # Register this function with Fission
-  $ fission function create --name hello --env nodejs --code hello.js
+  $ fission function create --name hello --env nodejs --code hello.js --namespace {{ .Values.defaultNamespace }}

 {{- if .Values.authentication.enabled }}

@@ -29,6 +35,6 @@ Windows:
 {{- end }}

  # Run this function
-  $ fission function test --name hello
+  $ fission function test --name hello --namespace {{ .Values.defaultNamespace }}
  Hello, world!

@@ -15,28 +15,6 @@ rules:
  - patch
  - delete
 {{- end }}
-{{- define "controller-rules" }}
-rules:
- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- end }}
 {{- define "executor-rules" }}
 rules:
 - apiGroups:
@@ -0,0 +1,364 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}
@@ -0,0 +1,64 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
@@ -14,9 +14,6 @@ metadata:
 {{- if eq "buildermgr" .component }}
 {{- include "buildermgr-rules" . }}
 {{- end }}
-{{- if eq "controller" .component }}
-{{- include "controller-rules" . }}
-{{- end }}
 {{- if eq "executor" .component }}
 {{- include "executor-rules" . }}
 {{- end }}
@@ -13,18 +13,12 @@ rules:
  - secrets
  verbs:
  - get
- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
 - apiGroups:
  - fission.io
  resources:
  - packages
  verbs:
-  - "get"
+  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -37,7 +31,7 @@ rules:
  resources:
  - packages
  verbs:
-  - "get"
+  - get
 - apiGroups:
  - ""
  resources:
@@ -45,6 +39,30 @@ rules:
  - secrets
  verbs:
  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
 {{- end -}}

 {{- define "fissionFunction.rolebindings" }}
@@ -61,7 +79,11 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: fission-fetcher
-    namespace: {{template "fission-function-ns" . }}
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -75,5 +97,27 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: fission-builder
-    namespace: {{ template "fission-builder-ns" . }}
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
 {{- end -}}
@@ -55,6 +55,22 @@ This template generates the image name for the deployment depending on the value
 {{- end }}
 {{- end -}}

+{{- define "reporterImage" -}}
+{{- if .Values.repository -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- else -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
 {{- define "opentelemtry.envs" }}
 - name: OTEL_EXPORTER_OTLP_ENDPOINT
  value: "{{ .Values.openTelemetry.otlpCollectorEndpoint }}"
@@ -73,8 +89,14 @@ This template generates the image name for the deployment depending on the value
 {{- end }}

 {{- define "fission-resource-namespace.envs" }}
+- name: FISSION_BUILDER_NAMESPACE
+  value: "{{ .Values.builderNamespace }}"
+- name: FISSION_FUNCTION_NAMESPACE
+  value: "{{ .Values.functionNamespace }}"
+- name: FISSION_DEFAULT_NAMESPACE
+  value: "{{ .Values.defaultNamespace }}"
 - name: FISSION_RESOURCE_NAMESPACES
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
  value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
 {{- else }}
  value: {{ .Values.defaultNamespace }}  
@@ -100,6 +122,6 @@ Define the svc's name
 {{- if .Values.builderNamespace -}}
 {{- printf "%s" .Values.builderNamespace -}}
 {{- else -}}
-{{- printf "%s" .Values.builderNamespace -}}
+{{- printf "%s" .Values.defaultNamespace -}}
 {{- end -}}
 {{- end -}}
@@ -26,15 +26,15 @@ spec:
      restartPolicy: Never
      containers:
        - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
          imagePullPolicy: {{ .Values.pullPolicy }}
          command: [ "/reporter" ]
          args: ["event", "-c", "fission-use", "-a", "yaml-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
          env:
            - name: GA_TRACKING_ID
              value: "{{ .Values.gaTrackingID }}"
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
@@ -30,11 +30,7 @@ spec:
      restartPolicy: Never
      containers:
        - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
          imagePullPolicy: {{ .Values.pullPolicy }}
          command: [ "/reporter" ]
          args: ["event", "-c", "fission-use", "-a", "helm-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,4 +43,8 @@ spec:
        {{- if .Values.terminationMessagePolicy }}
          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
@@ -30,11 +30,7 @@ spec:
      restartPolicy: Never
      containers:
        - name: post-upgrade-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
          imagePullPolicy: {{ .Values.pullPolicy }}
          command: [ "/reporter" ]
          args: ["event", "-c", "fission-use", "-a", "helm-post-upgrade", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,4 +43,8 @@ spec:
          {{- if .Values.terminationMessagePolicy }}
          terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
          {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
@@ -1,53 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - services
-  - serviceaccounts
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - list
-  - create
-  - delete
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-subjects:
-  - kind: ServiceAccount
-    name: fission-buildermgr
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-buildermgr
-  apiGroup: rbac.authorization.k8s.io
@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
  name: builder-podspec-patch
 data: 
-  spec: |
+  builder-podspec-patch.yaml: |
    {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
 {{- end -}}
@@ -39,12 +39,6 @@ spec:
          value: "{{ .Values.pullPolicy }}"
        - name: BUILDER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"      
        - name: ENABLE_ISTIO
          value: "{{ .Values.enableIstio }}"
        - name: FETCHER_MINCPU
@@ -61,8 +55,15 @@ spec:
          value: {{ .Values.pprof.enabled | quote }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
        ports:
          - containerPort: 8080
            name: metrics
@@ -75,11 +76,17 @@ spec:
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
      serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
 {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
@@ -1,7 +1,13 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}
@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}
@@ -1,43 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-rules:
- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end }}
@@ -1,14 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-subjects:
-  - kind: ServiceAccount
-    name: fission-canaryconfig
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-canaryconfig
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}
@@ -1,7 +1,7 @@
 {{- if .Values.canaryDeployment.enabled }}
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
 {{- end }}
@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -1,43 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-controller
-rules:
- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end -}}
@@ -1,14 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-controller
-subjects:
-  - kind: ServiceAccount
-    name: fission-controller
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-controller
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}
@@ -1,102 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    svc: controller
-    application: fission-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      svc: controller
-      application: fission-api
-  template:
-    metadata:
-      labels:
-        svc: controller
-        application: fission-api
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/path: "/metrics"
-        prometheus.io/port: "8080"
-    spec:
-      {{- if .Values.controller.securityContext.enabled }}
-      securityContext: {{- omit .Values.controller.securityContext "enabled" | toYaml | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: controller
-        image: {{ include "fission-bundleImage" . | quote }}
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--controllerPort", "8888"]
-        env:
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"  
-        - name: DEBUG_ENV
-          value: {{ .Values.debugEnv | quote }}
-        - name: PPROF_ENABLED
-          value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        {{- include "opentelemtry.envs" . | indent 8 }}
-        resources:
-          {{- toYaml .Values.controller.resources | nindent 10 }}
-        {{- if .Values.terminationMessagePath }}
-        terminationMessagePath: {{ .Values.terminationMessagePath }}
-        {{- end }}
-        {{- if .Values.terminationMessagePolicy }}
-        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
-        {{- end }}
-        readinessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          failureThreshold: 30
-        livenessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 35
-          periodSeconds: 5
-        volumeMounts:
-        - name: config-volume
-          mountPath: /etc/config/config.yaml
-          subPath: config.yaml
-        ports:
-          - containerPort: 8080
-            name: metrics
-          - containerPort: 8888
-            name: http
-        {{- if .Values.pprof.enabled }}
-          - containerPort: 6060
-            name: pprof
-        {{- end }}
-  
-      serviceAccountName: fission-controller
-      volumes:
-      - name: config-volume
-        configMap:
-          name: feature-config
-{{- if .Values.priorityClassName }}
-      priorityClassName: {{ .Values.priorityClassName }}
-{{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-{{- if .Values.extraCoreComponentPodConfig }}
-{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
-{{- end }}
-{{- end -}}
@@ -1,9 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
-
-{{- if not .Values.singleDefaultNamespace }}
-{{- range $namespace := $.Values.additionalFissionNamespaces }}
-{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
-{{- end }}
-{{- end }}
-{{- end -}}
@@ -1,7 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fission-controller
-  namespace: {{ .Release.Namespace }}
-{{- end -}}
@@ -1,24 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-{{- if .Values.serviceMonitor.enabled }}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: controller-monitor
-  {{- if .Values.serviceMonitor.namespace }}
-  namespace: {{ .Values.serviceMonitor.namespace }}
-  {{- end }}
-  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  namespaceSelector:
-    matchNames:
-      - {{ .Release.Namespace }}
-  selector:
-    matchLabels:
-      svc: controller
-  endpoints:
-  - targetPort: 8080
-{{- end -}}
-{{- end -}}
@@ -1,20 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: controller
-  labels:
-    svc: controller
-    application: fission-api
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: {{ .Values.serviceType }}
-  ports:
-  - port: 80
-    targetPort: 8888
-{{- if eq .Values.serviceType "NodePort" }}
-    nodePort: {{ .Values.controllerPort }}
-{{- end }}
-  selector:
-    svc: controller
-{{- end -}}
@@ -1,81 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-executor
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-executor
-subjects:
-  - kind: ServiceAccount
-    name: fission-executor
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-executor
-  apiGroup: rbac.authorization.k8s.io
@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
  name: runtime-podspec-patch
 data: 
-  spec: |
+  runtime-podspec-patch.yaml: |
    {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
 {{- end -}}
@@ -37,12 +37,6 @@ spec:
        {{- end }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"  
        - name: RUNTIME_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: ADOPT_EXISTING_RESOURCES
@@ -77,6 +71,12 @@ spec:
        - name: CONTAINER_OBJECT_REAPER_INTERVAL
          value: {{ .Values.executor.container.objectReaperInterval | quote }}
        {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        {{- end}}  
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
@@ -96,6 +96,13 @@ spec:
            port: 8888
          initialDelaySeconds: 35
          periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
        ports:
        - containerPort: 8080
          name: metrics
@@ -116,13 +123,19 @@ spec:
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
      serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
 {{- if .Values.executor.priorityClassName }}
      priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
@@ -1,7 +1,13 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}
@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}
@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-rules:
- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-subjects:
-  - kind: ServiceAccount
-    name: fission-fluentbit
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-fluentbit
-  apiGroup: rbac.authorization.k8s.io
@@ -185,6 +185,10 @@ spec:
        - name: fluentbit-config
          configMap:
            name: {{ .Release.Name }}-fission-fluentbit
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
  updateStrategy:
    type: RollingUpdate
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}
@@ -49,6 +49,10 @@ spec:
            secretKeyRef:
              name: influxdb
              key: password
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}
@@ -1,56 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-kubewatcher
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kubewatcher
-  apiGroup: rbac.authorization.k8s.io
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}
@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-secret-configmap-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - secrets
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-package-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - packages
-    verbs:
-      - "*"
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - rolebindings
-    verbs:
-      - "*"
@@ -4,26 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
 */}}
 {{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ template "fission-function-ns" . }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
- apiGroups:
-  - ""
-  resources:
-  - "events"
-  verbs:
-  - "get"
-  - "list"
-  - "watch"
-  - "create"
-  - "update"
-  - "patch"

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
 {{- end }}
@@ -4,22 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
 */}}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ template "fission-function-ns" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ template "fission-function-ns" . }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
 {{- end }}
@@ -1,62 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kafka
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kafka
-subjects:
-  - kind: ServiceAccount
-    name: fission-kafka
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kafka
-  apiGroup: rbac.authorization.k8s.io
@@ -25,11 +25,7 @@ spec:
    spec:
      containers:
      - name: mqtrigger
-      {{- if eq .Values.imageTag "" }}
-        image: "{{ .Values.image }}"
-      {{- else }}
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-      {{- end }}
+        image: {{ include "fission-bundleImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: ["/fission-bundle"]
        args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}
@@ -1,105 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-keda
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
- apiGroups:
-  - keda.sh
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- if .Values.mqt_keda.enabled }}
- apiGroups:
-  - keda.k8s.io
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- end }}
- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-keda
-subjects:
-  - kind: ServiceAccount
-    name: fission-keda
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-keda
-  apiGroup: rbac.authorization.k8s.io
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}
@@ -44,4 +44,8 @@ spec:
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
      serviceAccountName: fission-preupgrade
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
 {{- end }}
@@ -1,60 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-router
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-router
-subjects:
-  - kind: ServiceAccount
-    name: fission-router
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-router
-  apiGroup: rbac.authorization.k8s.io
@@ -12,7 +12,7 @@ metadata:
    application: fission-router
 spec:
 {{- if not .Values.router.deployAsDaemonSet }}
-  replicas: 1
+  replicas: {{ .Values.router.replicas | default 1 }}
 {{- end }}
  selector:
    matchLabels:
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}
@@ -6,7 +6,7 @@ metadata:
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  annotations:
-    "helm.sh/hook": pre-install
+    "helm.sh/hook": pre-install,pre-upgrade
 data:
  username: {{ .Values.authentication.authUsername | b64enc | quote }}
  password: {{ randAlphaNum 20 | b64enc | quote }}
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
 {{- end }}
@@ -1,48 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-timer
-rules:
- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-timer
-subjects:
-  - kind: ServiceAccount
-    name: fission-timer
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-timer
-  apiGroup: rbac.authorization.k8s.io
@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}

-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
 {{- end }}
@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}
@@ -1,7 +1,7 @@
 ## Fission chart configuration
 ##

-## serviceType to consider while creating Fission Controller service.
+## serviceType to consider while creating Fission webhook service.
 ## For minikube/kind, set this to NodePort, elsewhere use LoadBalancer or ClusterIP.
 ##
 serviceType: ClusterIP
@@ -14,7 +14,7 @@ routerServiceType: LoadBalancer
 ## repository represents base repository for images used in the chart.
 ## Keep it empty for using existing local image
 ##
-repository: index.docker.io
+repository: ghcr.io

 ## image represents the base image fission-bundle used by multiple Fission components.
 ## We alter arguments to the image to run a particular component.
@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.18.0-rc1
+imageTag: v1.20.0-rc1

 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -53,19 +53,13 @@ terminationMessagePath: /dev/termination-log
 ##
 terminationMessagePolicy: File

-## controllerPort represents the port at which the Fission controller service should be exposed.
-##
-controllerPort: 31313
-
 ## routerPort represents the port at which the Fission Router service should be exposed.
 ##
 routerPort: 31314

 ## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
-## more than one namespace to be used for Fission custom resources.
-## Fission will watch the defaultNamespace only if `singleDefaultNamespace` is true.
+## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources.
 ##
 defaultNamespace: default

@@ -81,12 +75,7 @@ builderNamespace: ""
 ##
 functionNamespace: ""

-## If true, fission will only watch for fission custom resources created in the `defaultNamespace` above.
-##
-singleDefaultNamespace: true
-
 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
-## Only works if `singleDefaultNamespace` is false.
 ## additionalFissionNamespaces: 
 ## - namespace1
 ## - namespace2
@@ -110,7 +99,7 @@ fetcher:
  ## image represents the image of the fetcher component.
  image: fission/fetcher
  ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.18.0-rc1
+  imageTag: v1.20.0-rc1

  ## Fetcher is only for to downloading or uploading archive.
  ## Normally, you don't need to change the value here, unless necessary.
@@ -166,7 +155,7 @@ executor:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -193,6 +182,14 @@ executor:
    ##
    ## objectReaperInterval: 5

+  serviceAccountCheck:
+    ## enables fission to create service account, roles and rolebinding for missing permission for builder and fetcher.
+    enabled: true
+    ## indicates the time interval in minutes, after that fission will create service account, roles and rolebinding for builder and fetcher.
+    ## interval will be applicable only if enable value is set to true.
+    ## default timing will be 0 minutes. That means check will run only once.
+    ## if you want to run check every 30 minutes then set interval to 30.
+    interval: 0
 ## router is responsible for routing function calls to the appropriate function.
 ##
 router:
@@ -210,6 +207,9 @@ router:
  ## deployAsDaemonSet decides whether to deploy router as a DaemonSet or a Deployment.
  ##
  deployAsDaemonSet: false
+  ## replicas decides how many router pods to deploy. Only used when deployAsDaemonSet is false.
+  ##
+  replicas: 1
  ## svcAddressMaxRetries is the max times for router to retry with a specific function service address
  ##
  svcAddressMaxRetries: 5
@@ -303,7 +303,7 @@ router:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -329,41 +329,13 @@ buildermgr:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
    runAsUser: 10001
    runAsGroup: 10001

-## controller is the component that the client talks to.
-## It contains CRUD APIs for functions, triggers, environments, Kubernetes event watches, etc. and proxy APIs to internal 3rd-party services.
-##
-controller:
-  enabled: false
-  ## Pod resources as:
-  ##  resources:
-  ##    limits:
-  ##      cpu: <tbd>
-  ##      memory: <tbd>
-  ##    requests:
-  ##      cpu: <tbd>
-  ##      memory: <tbd>
-  ##
-  resources: {}
-
-  ## Security Context
-  ## It holds pod-level and container level security configuration.
-  ## This is an experimental section, please verify before enabling in production.
-  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
-  securityContext:
-    enabled: false
-    ## Mark it false, if you want to stop the non root user validation
-    runAsNonRoot: true
-    fsGroup: 10001
-    runAsUser: 10001
-    runAsGroup: 10001 
-
 ## webhook is the component that validates API calls.
 ## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
 ##
@@ -394,7 +366,7 @@ webhook:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -421,7 +393,7 @@ kubewatcher:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -453,7 +425,7 @@ storagesvc:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -480,7 +452,7 @@ timer:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -530,7 +502,7 @@ kafka:
  # version: "0.11.2.0"

 # The following components expose Prometheus metrics and have servicemonitors in this chart (disabled by default)
-# Controller, router, executor, storage svc
+# router, executor, storage svc
 serviceMonitor:
  enabled: false
  ##namespace in which you want to deploy servicemonitor
@@ -684,7 +656,7 @@ preUpgradeChecks:
  image: fission/pre-upgrade-checks
  ## pre-install/pre-upgrade checks image version
  ##
-  imageTag: v1.18.0-rc1
+  imageTag: v1.20.0-rc1

 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -725,7 +697,7 @@ canaryDeployment:
  ## This is an experimental section, please verify before enabling in production.
  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
  securityContext:
-    enabled: false
+    enabled: true
    ## Mark it false, if you want to stop the non root user validation
    runAsNonRoot: true
    fsGroup: 10001
@@ -816,7 +788,7 @@ mqt_keda:
  connector_images:
    kafka:
      image: fission/keda-kafka-http-connector
-      tag: v0.11
+      tag: v0.12
    rabbitmq:
      image: fission/keda-rabbitmq-http-connector
      tag: v0.10
@@ -825,16 +797,16 @@ mqt_keda:
      tag: v0.10
    aws_sqs:
      image: fission/keda-aws-sqs-http-connector
-      tag: v0.10
+      tag: v0.11
    nats_steaming:
      image: fission/keda-nats-streaming-http-connector
-      tag: v0.12
+      tag: v0.13
    nats_jetstream:
      image: fission/keda-nats-jetstream-http-connector
-      tag: v0.2
+      tag: v0.4
    gcp_pubsub:
      image: fission/keda-gcp-pubsub-http-connector
-      tag: v0.5
+      tag: v0.6
    redis:
      image: fission/keda-redis-http-connector
      tag: v0.3
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.18
 RUN apk add --update ca-certificates
 COPY builder /builder
 ENTRYPOINT ["/builder"]
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.18
 RUN apk add --update ca-certificates
 COPY fetcher /
 ENTRYPOINT ["/fetcher"]
@@ -28,6 +28,7 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.uber.org/zap"

+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/fetcher"
 	"github.com/fission/fission/pkg/utils/httpserver"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
@@ -37,7 +38,7 @@ var (
 	readyToServe uint32
 )

-func Run(ctx context.Context, logger *zap.Logger) {
+func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) {
 	flag.Usage = fetcherUsage
 	specializeOnStart := flag.Bool("specialize-on-startup", false, "Flag to activate specialize process at pod startup")
 	specializePayload := flag.String("specialize-request", "", "JSON payload for specialize request")
@@ -72,7 +73,7 @@ func Run(ctx context.Context, logger *zap.Logger) {
 	ctx, span := tracer.Start(ctx, "fetcher/Run")
 	defer span.End()

-	f, err := fetcher.MakeFetcher(logger, dir, *secretDir, *configDir)
+	f, err := fetcher.MakeFetcher(logger, clientGen, dir, *secretDir, *configDir)
 	if err != nil {
 		logger.Fatal("error making fetcher", zap.Error(err))
 	}
@@ -20,6 +20,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"

 	"github.com/fission/fission/cmd/fetcher/app"
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 	"github.com/fission/fission/pkg/utils/profile"
 )
@@ -31,5 +32,5 @@ func main() {

 	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)
-	app.Run(ctx, logger)
+	app.Run(ctx, crd.NewClientGenerator(), logger)
 }
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.18
 RUN apk add --update ca-certificates
 COPY fission-bundle /
 ENTRYPOINT ["/fission-bundle"]
@@ -30,7 +30,7 @@ import (
 	"github.com/fission/fission/cmd/fission-bundle/mqtrigger"
 	"github.com/fission/fission/pkg/buildermgr"
 	"github.com/fission/fission/pkg/canaryconfigmgr"
-	"github.com/fission/fission/pkg/controller"
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/executor"
 	"github.com/fission/fission/pkg/info"
 	"github.com/fission/fission/pkg/kubewatcher"
@@ -50,49 +50,45 @@ func runWebhook(ctx context.Context, logger *zap.Logger, port int) error {
 	return webhook.Start(ctx, logger, port)
 }

-func runController(ctx context.Context, logger *zap.Logger, port int) {
-	controller.Start(ctx, logger, port, false)
+func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
+	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, false)
 }

-func runCanaryConfigServer(ctx context.Context, logger *zap.Logger) error {
-	return canaryconfigmgr.StartCanaryServer(ctx, logger, false)
+func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int, executorUrl string) error {
+	return router.Start(ctx, clientGen, logger, port, executorUrl)
 }

-func runRouter(ctx context.Context, logger *zap.Logger, port int, executorUrl string) {
-	router.Start(ctx, logger, port, executorUrl)
+func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
+	return executor.StartExecutor(ctx, clientGen, logger, port)
 }

-func runExecutor(ctx context.Context, logger *zap.Logger, port int) error {
-	return executor.StartExecutor(ctx, logger, port)
+func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
+	return kubewatcher.Start(ctx, clientGen, logger, routerUrl)
 }

-func runKubeWatcher(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return kubewatcher.Start(ctx, logger, routerUrl)
+func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
+	return timer.Start(ctx, clientGen, logger, routerUrl)
 }

-func runTimer(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return timer.Start(ctx, logger, routerUrl)
-}
-
-func runMessageQueueMgr(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return mqtrigger.Start(ctx, logger, routerUrl)
+func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
+	return mqtrigger.Start(ctx, clientGen, logger, routerUrl)
 }

 // KEDA based MessageQueue Trigger Manager
-func runMQManager(ctx context.Context, logger *zap.Logger, routerURL string) error {
-	return mqt.StartScalerManager(ctx, logger, routerURL)
+func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerURL string) error {
+	return mqt.StartScalerManager(ctx, clientGen, logger, routerURL)
 }

-func runStorageSvc(ctx context.Context, logger *zap.Logger, port int, storage storagesvc.Storage) error {
-	return storagesvc.Start(ctx, logger, storage, port)
+func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int, storage storagesvc.Storage) error {
+	return storagesvc.Start(ctx, clientGen, logger, storage, port)
 }

-func runBuilderMgr(ctx context.Context, logger *zap.Logger, storageSvcUrl string) error {
-	return buildermgr.Start(ctx, logger, storageSvcUrl)
+func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, storageSvcUrl string) error {
+	return buildermgr.Start(ctx, clientGen, logger, storageSvcUrl)
 }

-func runLogger(ctx context.Context, logger *zap.Logger) {
-	functionLogger.Start(ctx, logger)
+func runLogger(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
+	return functionLogger.Start(ctx, clientGen, logger)
 }

 func getPort(logger *zap.Logger, portArg interface{}) int {
@@ -115,9 +111,7 @@ func getStringArgWithDefault(arg interface{}, defaultValue string) string {
 func getServiceName(arguments map[string]interface{}) string {
 	serviceName := "Fission-Unknown"

-	if arguments["--controllerPort"] != nil {
-		serviceName = "Fission-Controller"
-	} else if arguments["--routerPort"] != nil {
+	if arguments["--routerPort"] != nil {
 		serviceName = "Fission-Router"
 	} else if arguments["--executorPort"] != nil {
 		serviceName = "Fission-Executor"
@@ -155,18 +149,17 @@ func main() {
 	// TODO: fix the lint error. Error checking here is causing all components to crash with error "logtostderr not found"
 	flag.Set("logtostderr", "true") //nolint: errcheck

-	usage := `fission-bundle: Package of all fission microservices: controller, router, executor.
+	usage := `fission-bundle: Package of all fission microservices: router, executor.

 Use it to start one or more of the fission servers:

- Controller is a stateless API frontend for fission resources.

 Pool manager maintains a pool of generalized function containers, and
 specializes them on-demand. Executor must be run from a pod in a
 Kubernetes cluster.

 Router implements HTTP triggers: it routes to running instances,
- working with the controller and executor.
+ working with the executor.

 Kubewatcher implements Kubernetes Watch triggers: it watches
 Kubernetes resources and invokes functions described in the
@@ -177,7 +170,6 @@ Use it to start one or more of the fission servers:
 backends.

 Usage:
-  fission-bundle --controllerPort=<port>
  fission-bundle --canaryConfig
  fission-bundle --routerPort=<port> [--executorUrl=<url>]
  fission-bundle --executorPort=<port> [--namespace=<namespace>] [--fission-namespace=<namespace>]
@@ -191,7 +183,6 @@ Usage:
  fission-bundle --logger
  fission-bundle --version
 Options:
-  --controllerPort=<port>         Port that the controller should listen on.
  --canaryConfig		  		  Start canary config server.
  --webhookPort=<port>             Port that the webhook should listen on.
  --routerPort=<port>             Port that the router should listen on.
@@ -216,7 +207,7 @@ Options:
 	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)

-	version := fmt.Sprintf("Fission Bundle Version: %v", info.BuildInfo().String())
+	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
 	arguments, err := docopt.ParseArgs(usage, nil, version)
 	if err != nil {
 		logger.Error("failed to parse arguments", zap.Error(err))
@@ -235,6 +226,7 @@ Options:
 	executorUrl := getStringArgWithDefault(arguments["--executorUrl"], "http://executor.fission")
 	routerUrl := getStringArgWithDefault(arguments["--routerUrl"], "http://router.fission")
 	storageSvcUrl := getStringArgWithDefault(arguments["--storageSvcUrl"], "http://storagesvc.fission")
+	clientGen := crd.NewClientGenerator()

 	if arguments["--webhookPort"] != nil {
 		port := getPort(logger, arguments["--webhookPort"])
@@ -243,15 +235,8 @@ Options:
 		return
 	}

-	if arguments["--controllerPort"] != nil {
-		port := getPort(logger, arguments["--controllerPort"])
-		runController(ctx, logger, port)
-		logger.Error("controller exited")
-		return
-	}
-
 	if arguments["--canaryConfig"] == true {
-		err := runCanaryConfigServer(ctx, logger)
+		err := runCanaryConfigServer(ctx, clientGen, logger)
 		if err != nil {
 			logger.Error("canary config server exited with error: ", zap.Error(err))
 			return
@@ -260,14 +245,16 @@ Options:

 	if arguments["--routerPort"] != nil {
 		port := getPort(logger, arguments["--routerPort"])
-		runRouter(ctx, logger, port, executorUrl)
-		logger.Error("router exited")
-		return
+		err = runRouter(ctx, clientGen, logger, port, executorUrl)
+		if err != nil {
+			logger.Error("router exited", zap.Error(err))
+			return
+		}
 	}

 	if arguments["--executorPort"] != nil {
 		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, logger, port)
+		err = runExecutor(ctx, clientGen, logger, port)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
 			return
@@ -275,7 +262,7 @@ Options:
 	}

 	if arguments["--kubewatcher"] == true {
-		err = runKubeWatcher(ctx, logger, routerUrl)
+		err = runKubeWatcher(ctx, clientGen, logger, routerUrl)
 		if err != nil {
 			logger.Error("kubewatcher exited", zap.Error(err))
 			return
@@ -283,7 +270,7 @@ Options:
 	}

 	if arguments["--timer"] == true {
-		err = runTimer(ctx, logger, routerUrl)
+		err = runTimer(ctx, clientGen, logger, routerUrl)
 		if err != nil {
 			logger.Error("timer exited", zap.Error(err))
 			return
@@ -291,7 +278,7 @@ Options:
 	}

 	if arguments["--mqt"] == true {
-		err = runMessageQueueMgr(ctx, logger, routerUrl)
+		err = runMessageQueueMgr(ctx, clientGen, logger, routerUrl)
 		if err != nil {
 			logger.Error("message queue manager exited", zap.Error(err))
 			return
@@ -299,7 +286,7 @@ Options:
 	}

 	if arguments["--mqt_keda"] == true {
-		err = runMQManager(ctx, logger, routerUrl)
+		err = runMQManager(ctx, clientGen, logger, routerUrl)
 		if err != nil {
 			logger.Error("mqt scaler manager exited", zap.Error(err))
 			return
@@ -307,7 +294,7 @@ Options:
 	}

 	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, logger, storageSvcUrl)
+		err = runBuilderMgr(ctx, clientGen, logger, storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
 			return
@@ -315,8 +302,10 @@ Options:
 	}

 	if arguments["--logger"] == true {
-		runLogger(ctx, logger)
-		logger.Error("logger exited")
+		err = runLogger(ctx, clientGen, logger)
+		if err != nil {
+			logger.Error("logger exited", zap.Error(err))
+		}
 		return
 	}

@@ -330,7 +319,7 @@ Options:
 		} else if arguments["--storageType"] == string(storagesvc.StorageTypeLocal) {
 			storage = storagesvc.NewLocalStorage("/fission")
 		}
-		err := runStorageSvc(ctx, logger, port, storage)
+		err := runStorageSvc(ctx, clientGen, logger, port, storage)
 		if err != nil {
 			logger.Error("storage service exited", zap.Error(err))
 			return
@@ -34,11 +34,10 @@ import (
 	_ "github.com/fission/fission/pkg/mqtrigger/messageQueue/kafka"
 )

-func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	fissionClient, _, _, _, err := crd.MakeFissionClient()
-
+func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission or kubernetes client")
+		return errors.Wrap(err, "failed to get fission client")
 	}

 	err = crd.WaitForCRDs(ctx, logger, fissionClient)
@@ -74,7 +73,10 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		logger.Fatal("failed to connect to remote message queue server", zap.Error(err))
 	}
 	mqtMgr := mqtrigger.MakeMessageQueueTriggerManager(logger, fissionClient, mqType, mq)
-	mqtMgr.Run(ctx)
+	err = mqtMgr.Run(ctx)
+	if err != nil {
+		return err
+	}
 	return nil
 }

@@ -49,7 +49,7 @@ const (
 `
 )

-func App() *cobra.Command {
+func App(clientOptions cmd.ClientOptions) *cobra.Command {
 	cobra.EnableCommandSorting = false

 	rootCmd := &cobra.Command{
@@ -59,9 +59,7 @@ func App() *cobra.Command {
 		PersistentPreRunE: wrapper.Wrapper(
 			func(input cli.Input) error {
 				console.Verbosity = input.Int(flagkey.Verbosity)
-				clientOptions := cmd.ClientOptions{
-					KubeContext: input.String(flagkey.KubeContext),
-				}
+				clientOptions.KubeContext = input.String(flagkey.KubeContext)
 				// TODO: use fake rest client for offline spec generation
 				// if input.IsSet(flagkey.ClientOnly) || input.IsSet(flagkey.PreCheckOnly) {
 				// }
@@ -20,11 +20,12 @@ import (
 	"os"

 	"github.com/fission/fission/cmd/fission-cli/app"
+	"github.com/fission/fission/pkg/fission-cli/cmd"
 	"github.com/fission/fission/pkg/fission-cli/console"
 )

 func main() {
-	cmd := app.App()
+	cmd := app.App(cmd.ClientOptions{})
 	cmd.SilenceErrors = true // use our own error message printer

 	err := cmd.Execute()
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.18
 RUN apk add --update ca-certificates
 COPY pre-upgrade-checks /
 ENTRYPOINT ["/pre-upgrade-checks"]
@@ -18,11 +18,10 @@ package main

 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"

-	multierror "github.com/hashicorp/go-multierror"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
@@ -51,10 +50,19 @@ const (
 	MqtCRD      = "messagequeuetriggers.fission.io"
 )

-func makePreUpgradeTaskClient(logger *zap.Logger) (*PreUpgradeTaskClient, error) {
-	fissionClient, k8sClient, apiExtClient, _, err := crd.MakeFissionClient()
+func makePreUpgradeTaskClient(clientGen crd.ClientGeneratorInterface, logger *zap.Logger) (*PreUpgradeTaskClient, error) {
+	var err error
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making fission client")
+		return nil, fmt.Errorf("failed to get fission client: %w", err)
+	}
+	k8sClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get kubernetes client: %w", err)
+	}
+	apiExtClient, err := clientGen.GetApiExtensionsClient()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get apiextensions client: %w", err)
 	}

 	return &PreUpgradeTaskClient{
@@ -121,9 +129,9 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Con

 	var err error
 	var fList *fv1.FunctionList
-	errs := &multierror.Error{}
+	var errs error

-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		for i := 0; i < maxRetries; i++ {
 			fList, err = client.fissionClient.CoreV1().Functions(namespace).List(ctx, metav1.ListOptions{})
 			if err == nil {
@@ -142,24 +150,25 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Con
 			secrets := fn.Spec.Secrets
 			for _, secret := range secrets {
 				if secret.Namespace != "" && secret.Namespace != fn.ObjectMeta.Namespace {
-					errs = multierror.Append(errs, fmt.Errorf("function : %s.%s cannot reference a secret : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, secret.Name, secret.Namespace))
+					errs = errors.Join(errs, fmt.Errorf("function : %s.%s cannot reference a secret : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, secret.Name, secret.Namespace))
 				}
 			}

 			configmaps := fn.Spec.ConfigMaps
 			for _, configmap := range configmaps {
 				if configmap.Namespace != "" && configmap.Namespace != fn.ObjectMeta.Namespace {
-					errs = multierror.Append(errs, fmt.Errorf("function : %s.%s cannot reference a configmap : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, configmap.Name, configmap.Namespace))
+					errs = errors.Join(errs, fmt.Errorf("function : %s.%s cannot reference a configmap : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, configmap.Name, configmap.Namespace))
+
 				}
 			}

 			if fn.Spec.Package.PackageRef.Namespace != "" && fn.Spec.Package.PackageRef.Namespace != fn.ObjectMeta.Namespace {
-				errs = multierror.Append(errs, fmt.Errorf("function : %s.%s cannot reference a package : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, fn.Spec.Package.PackageRef.Name, fn.Spec.Package.PackageRef.Namespace))
+				errs = errors.Join(errs, fmt.Errorf("function : %s.%s cannot reference a package : %s in namespace : %s", fn.ObjectMeta.Name, fn.ObjectMeta.Namespace, fn.Spec.Package.PackageRef.Name, fn.Spec.Package.PackageRef.Namespace))
 			}
 		}
 	}

-	if errs.ErrorOrNil() != nil {
+	if errs != nil {
 		client.logger.Fatal("installation failed",
 			zap.Error(errs),
 			zap.String("summary", "a function cannot reference secrets, configmaps and packages outside it's own namespace"))
@@ -20,6 +20,7 @@ import (
 	"go.uber.org/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"

+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 )

@@ -27,7 +28,7 @@ func main() {
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()

-	crdBackedClient, err := makePreUpgradeTaskClient(logger)
+	crdBackedClient, err := makePreUpgradeTaskClient(crd.NewClientGenerator(), logger)
 	if err != nil {
 		logger.Fatal("error creating a crd client, please retry helm upgrade",
 			zap.Error(err))
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.18
 RUN apk add --update ca-certificates
 COPY reporter /
 ENTRYPOINT ["/reporter"]
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.13.0
  name: canaryconfigs.fission.io
 spec:
  group: fission.io
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.13.0
  name: httptriggers.fission.io
 spec:
  group: fission.io
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.13.0
  name: kuberneteswatchtriggers.fission.io
 spec:
  group: fission.io
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.13.0
  name: messagequeuetriggers.fission.io
 spec:
  group: fission.io
@@ -1250,7 +1249,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -1349,7 +1351,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -1431,8 +1436,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -1464,7 +1468,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -1639,8 +1645,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -1672,7 +1677,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -1762,10 +1769,54 @@ spec:
                              format: int32
                              type: integer
                          type: object
+                        resizePolicy:
+                          description: Resources resize policy for the container.
+                          items:
+                            description: ContainerResizePolicy represents resource
+                              resize policy for the container.
+                            properties:
+                              resourceName:
+                                description: 'Name of the resource to which this resource
+                                  resize policy applies. Supported values: cpu, memory.'
+                                type: string
+                              restartPolicy:
+                                description: Restart policy to apply when specified
+                                  resource is resized. If not specified, it defaults
+                                  to NotRequired.
+                                type: string
+                            required:
+                            - resourceName
+                            - restartPolicy
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        resources:
                          description: 'Compute Resources required by this container.
                            Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                          properties:
+                            claims:
+                              description: "Claims lists the names of resources, defined
+                                in spec.resourceClaims, that are used by this container.
+                                \n This is an alpha field and requires enabling the
+                                DynamicResourceAllocation feature gate. \n This field
+                                is immutable. It can only be set for containers."
+                              items:
+                                description: ResourceClaim references one entry in
+                                  PodSpec.ResourceClaims.
+                                properties:
+                                  name:
+                                    description: Name must match the name of one entry
+                                      in pod.spec.resourceClaims of the Pod where
+                                      this field is used. It makes that resource available
+                                      inside a container.
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - name
+                              x-kubernetes-list-type: map
                            limits:
                              additionalProperties:
                                anyOf:
@@ -1787,9 +1838,30 @@ spec:
                                of compute resources required. If Requests is omitted
                                for a container, it defaults to Limits if that is
                                explicitly specified, otherwise to an implementation-defined
-                                value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                              type: object
                          type: object
+                        restartPolicy:
+                          description: 'RestartPolicy defines the restart behavior
+                            of individual containers in a pod. This field may only
+                            be set for init containers, and the only allowed value
+                            is "Always". For non-init containers or when this field
+                            is not specified, the restart behavior is defined by the
+                            Pod''s restart policy and the container type. Setting
+                            the RestartPolicy as "Always" for the init container will
+                            have the following effect: this init container will be
+                            continually restarted on exit until all regular containers
+                            have terminated. Once all regular containers have completed,
+                            all init containers with restartPolicy "Always" will be
+                            shut down. This lifecycle differs from normal init containers
+                            and is often referred to as a "sidecar" container. Although
+                            this init container still starts in the init container
+                            sequence, it does not wait for the container to complete
+                            before proceeding to the next init container. Instead,
+                            the next init container starts immediately after this
+                            init container is started, or after any startupProbe has
+                            successfully completed.'
+                          type: string
                        securityContext:
                          description: 'SecurityContext defines the security options
                            the container should be run with. If set, the fields of
@@ -1914,7 +1986,8 @@ spec:
                                    The profile must be preconfigured on the node
                                    to work. Must be a descending path, relative to
                                    the kubelet's configured seccomp profile location.
-                                    Must only be set if type is "Localhost".
+                                    Must be set if type is "Localhost". Must NOT be
+                                    set for any other type.
                                  type: string
                                type:
                                  description: "type indicates which kind of seccomp
@@ -1947,15 +2020,11 @@ spec:
                                  type: string
                                hostProcess:
                                  description: HostProcess determines if a container
-                                    should be run as a 'Host Process' container. This
-                                    field is alpha-level and will only be honored
-                                    by components that enable the WindowsHostProcessContainers
-                                    feature flag. Setting this field without the feature
-                                    flag will result in errors when validating the
-                                    Pod. All of a Pod's containers must have the same
-                                    effective HostProcess value (it is not allowed
-                                    to have a mix of HostProcess containers and non-HostProcess
-                                    containers).  In addition, if HostProcess is true
+                                    should be run as a 'Host Process' container. All
+                                    of a Pod's containers must have the same effective
+                                    HostProcess value (it is not allowed to have a
+                                    mix of HostProcess containers and non-HostProcess
+                                    containers). In addition, if HostProcess is true
                                    then HostNetwork must also be set to true.
                                  type: boolean
                                runAsUserName:
@@ -2004,8 +2073,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -2037,7 +2105,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -2557,7 +2627,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -2656,7 +2729,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -2736,8 +2812,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -2769,7 +2844,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -2935,8 +3012,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -2968,7 +3044,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -3058,11 +3136,55 @@ spec:
                              format: int32
                              type: integer
                          type: object
+                        resizePolicy:
+                          description: Resources resize policy for the container.
+                          items:
+                            description: ContainerResizePolicy represents resource
+                              resize policy for the container.
+                            properties:
+                              resourceName:
+                                description: 'Name of the resource to which this resource
+                                  resize policy applies. Supported values: cpu, memory.'
+                                type: string
+                              restartPolicy:
+                                description: Restart policy to apply when specified
+                                  resource is resized. If not specified, it defaults
+                                  to NotRequired.
+                                type: string
+                            required:
+                            - resourceName
+                            - restartPolicy
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        resources:
                          description: Resources are not allowed for ephemeral containers.
                            Ephemeral containers use spare resources already allocated
                            to the pod.
                          properties:
+                            claims:
+                              description: "Claims lists the names of resources, defined
+                                in spec.resourceClaims, that are used by this container.
+                                \n This is an alpha field and requires enabling the
+                                DynamicResourceAllocation feature gate. \n This field
+                                is immutable. It can only be set for containers."
+                              items:
+                                description: ResourceClaim references one entry in
+                                  PodSpec.ResourceClaims.
+                                properties:
+                                  name:
+                                    description: Name must match the name of one entry
+                                      in pod.spec.resourceClaims of the Pod where
+                                      this field is used. It makes that resource available
+                                      inside a container.
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - name
+                              x-kubernetes-list-type: map
                            limits:
                              additionalProperties:
                                anyOf:
@@ -3084,9 +3206,15 @@ spec:
                                of compute resources required. If Requests is omitted
                                for a container, it defaults to Limits if that is
                                explicitly specified, otherwise to an implementation-defined
-                                value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                              type: object
                          type: object
+                        restartPolicy:
+                          description: Restart policy for the container to manage
+                            the restart behavior of each container within a pod. This
+                            may only be set for init containers. You cannot set this
+                            field on ephemeral containers.
+                          type: string
                        securityContext:
                          description: 'Optional: SecurityContext defines the security
                            options the ephemeral container should be run with. If
@@ -3211,7 +3339,8 @@ spec:
                                    The profile must be preconfigured on the node
                                    to work. Must be a descending path, relative to
                                    the kubelet's configured seccomp profile location.
-                                    Must only be set if type is "Localhost".
+                                    Must be set if type is "Localhost". Must NOT be
+                                    set for any other type.
                                  type: string
                                type:
                                  description: "type indicates which kind of seccomp
@@ -3244,15 +3373,11 @@ spec:
                                  type: string
                                hostProcess:
                                  description: HostProcess determines if a container
-                                    should be run as a 'Host Process' container. This
-                                    field is alpha-level and will only be honored
-                                    by components that enable the WindowsHostProcessContainers
-                                    feature flag. Setting this field without the feature
-                                    flag will result in errors when validating the
-                                    Pod. All of a Pod's containers must have the same
-                                    effective HostProcess value (it is not allowed
-                                    to have a mix of HostProcess containers and non-HostProcess
-                                    containers).  In addition, if HostProcess is true
+                                    should be run as a 'Host Process' container. All
+                                    of a Pod's containers must have the same effective
+                                    HostProcess value (it is not allowed to have a
+                                    mix of HostProcess containers and non-HostProcess
+                                    containers). In addition, if HostProcess is true
                                    then HostNetwork must also be set to true.
                                  type: boolean
                                runAsUserName:
@@ -3293,8 +3418,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -3326,7 +3450,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -3877,7 +4003,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -3976,7 +4105,10 @@ spec:
                                          header to be used in HTTP probes
                                        properties:
                                          name:
-                                            description: The header field name
+                                            description: The header field name. This
+                                              will be canonicalized upon output, so
+                                              case-variant names will be understood
+                                              as the same header.
                                            type: string
                                          value:
                                            description: The header field value
@@ -4058,8 +4190,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -4091,7 +4222,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -4266,8 +4399,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -4299,7 +4431,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -4389,10 +4523,54 @@ spec:
                              format: int32
                              type: integer
                          type: object
+                        resizePolicy:
+                          description: Resources resize policy for the container.
+                          items:
+                            description: ContainerResizePolicy represents resource
+                              resize policy for the container.
+                            properties:
+                              resourceName:
+                                description: 'Name of the resource to which this resource
+                                  resize policy applies. Supported values: cpu, memory.'
+                                type: string
+                              restartPolicy:
+                                description: Restart policy to apply when specified
+                                  resource is resized. If not specified, it defaults
+                                  to NotRequired.
+                                type: string
+                            required:
+                            - resourceName
+                            - restartPolicy
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        resources:
                          description: 'Compute Resources required by this container.
                            Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                          properties:
+                            claims:
+                              description: "Claims lists the names of resources, defined
+                                in spec.resourceClaims, that are used by this container.
+                                \n This is an alpha field and requires enabling the
+                                DynamicResourceAllocation feature gate. \n This field
+                                is immutable. It can only be set for containers."
+                              items:
+                                description: ResourceClaim references one entry in
+                                  PodSpec.ResourceClaims.
+                                properties:
+                                  name:
+                                    description: Name must match the name of one entry
+                                      in pod.spec.resourceClaims of the Pod where
+                                      this field is used. It makes that resource available
+                                      inside a container.
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              type: array
+                              x-kubernetes-list-map-keys:
+                              - name
+                              x-kubernetes-list-type: map
                            limits:
                              additionalProperties:
                                anyOf:
@@ -4414,9 +4592,30 @@ spec:
                                of compute resources required. If Requests is omitted
                                for a container, it defaults to Limits if that is
                                explicitly specified, otherwise to an implementation-defined
-                                value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                              type: object
                          type: object
+                        restartPolicy:
+                          description: 'RestartPolicy defines the restart behavior
+                            of individual containers in a pod. This field may only
+                            be set for init containers, and the only allowed value
+                            is "Always". For non-init containers or when this field
+                            is not specified, the restart behavior is defined by the
+                            Pod''s restart policy and the container type. Setting
+                            the RestartPolicy as "Always" for the init container will
+                            have the following effect: this init container will be
+                            continually restarted on exit until all regular containers
+                            have terminated. Once all regular containers have completed,
+                            all init containers with restartPolicy "Always" will be
+                            shut down. This lifecycle differs from normal init containers
+                            and is often referred to as a "sidecar" container. Although
+                            this init container still starts in the init container
+                            sequence, it does not wait for the container to complete
+                            before proceeding to the next init container. Instead,
+                            the next init container starts immediately after this
+                            init container is started, or after any startupProbe has
+                            successfully completed.'
+                          type: string
                        securityContext:
                          description: 'SecurityContext defines the security options
                            the container should be run with. If set, the fields of
@@ -4541,7 +4740,8 @@ spec:
                                    The profile must be preconfigured on the node
                                    to work. Must be a descending path, relative to
                                    the kubelet's configured seccomp profile location.
-                                    Must only be set if type is "Localhost".
+                                    Must be set if type is "Localhost". Must NOT be
+                                    set for any other type.
                                  type: string
                                type:
                                  description: "type indicates which kind of seccomp
@@ -4574,15 +4774,11 @@ spec:
                                  type: string
                                hostProcess:
                                  description: HostProcess determines if a container
-                                    should be run as a 'Host Process' container. This
-                                    field is alpha-level and will only be honored
-                                    by components that enable the WindowsHostProcessContainers
-                                    feature flag. Setting this field without the feature
-                                    flag will result in errors when validating the
-                                    Pod. All of a Pod's containers must have the same
-                                    effective HostProcess value (it is not allowed
-                                    to have a mix of HostProcess containers and non-HostProcess
-                                    containers).  In addition, if HostProcess is true
+                                    should be run as a 'Host Process' container. All
+                                    of a Pod's containers must have the same effective
+                                    HostProcess value (it is not allowed to have a
+                                    mix of HostProcess containers and non-HostProcess
+                                    containers). In addition, if HostProcess is true
                                    then HostNetwork must also be set to true.
                                  type: boolean
                                runAsUserName:
@@ -4631,8 +4827,7 @@ spec:
                              type: integer
                            grpc:
                              description: GRPC specifies an action involving a GRPC
-                                port. This is a beta field and requires enabling GRPCContainerProbe
-                                feature gate.
+                                port.
                              properties:
                                port:
                                  description: Port number of the gRPC service. Number
@@ -4664,7 +4859,9 @@ spec:
                                      to be used in HTTP probes
                                    properties:
                                      name:
-                                        description: The header field name
+                                        description: The header field name. This will
+                                          be canonicalized upon output, so case-variant
+                                          names will be understood as the same header.
                                        type: string
                                      value:
                                        description: The header field value
@@ -4966,9 +5163,56 @@ spec:
                      - conditionType
                      type: object
                    type: array
+                  resourceClaims:
+                    description: "ResourceClaims defines which ResourceClaims must
+                      be allocated and reserved before the Pod is allowed to start.
+                      The resources will be made available to those containers which
+                      consume them by name. \n This is an alpha field and requires
+                      enabling the DynamicResourceAllocation feature gate. \n This
+                      field is immutable."
+                    items:
+                      description: PodResourceClaim references exactly one ResourceClaim
+                        through a ClaimSource. It adds a name to it that uniquely
+                        identifies the ResourceClaim inside the Pod. Containers that
+                        need access to the ResourceClaim reference it with this name.
+                      properties:
+                        name:
+                          description: Name uniquely identifies this resource claim
+                            inside the pod. This must be a DNS_LABEL.
+                          type: string
+                        source:
+                          description: Source describes where to find the ResourceClaim.
+                          properties:
+                            resourceClaimName:
+                              description: ResourceClaimName is the name of a ResourceClaim
+                                object in the same namespace as this pod.
+                              type: string
+                            resourceClaimTemplateName:
+                              description: "ResourceClaimTemplateName is the name
+                                of a ResourceClaimTemplate object in the same namespace
+                                as this pod. \n The template will be used to create
+                                a new ResourceClaim, which will be bound to this pod.
+                                When this pod is deleted, the ResourceClaim will also
+                                be deleted. The pod name and resource name, along
+                                with a generated component, will be used to form a
+                                unique name for the ResourceClaim, which will be recorded
+                                in pod.status.resourceClaimStatuses. \n This field
+                                is immutable and no changes will be made to the corresponding
+                                ResourceClaim by the control plane after creating
+                                the ResourceClaim."
+                              type: string
+                          type: object
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
                  restartPolicy:
                    description: 'Restart policy for all containers within the pod.
-                      One of Always, OnFailure, Never. Default to Always. More info:
+                      One of Always, OnFailure, Never. In some contexts, only a subset
+                      of those values may be permitted. Default to Always. More info:
                      https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy'
                    type: string
                  runtimeClassName:
@@ -4984,6 +5228,29 @@ spec:
                      scheduler. If not specified, the pod will be dispatched by default
                      scheduler.
                    type: string
+                  schedulingGates:
+                    description: "SchedulingGates is an opaque list of values that
+                      if specified will block scheduling the pod. If schedulingGates
+                      is not empty, the pod will stay in the SchedulingGated state
+                      and the scheduler will not attempt to schedule the pod. \n SchedulingGates
+                      can only be set at pod creation time, and be removed only afterwards.
+                      \n This is a beta feature enabled by the PodSchedulingReadiness
+                      feature gate."
+                    items:
+                      description: PodSchedulingGate is associated to a Pod to guard
+                        its scheduling.
+                      properties:
+                        name:
+                          description: Name of the scheduling gate. Each scheduling
+                            gate must have a unique name field.
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
                  securityContext:
                    description: 'SecurityContext holds pod-level security attributes
                      and common container settings. Optional: Defaults to empty.  See
@@ -5075,7 +5342,8 @@ spec:
                              in a file on the node should be used. The profile must
                              be preconfigured on the node to work. Must be a descending
                              path, relative to the kubelet's configured seccomp profile
-                              location. Must only be set if type is "Localhost".
+                              location. Must be set if type is "Localhost". Must NOT
+                              be set for any other type.
                            type: string
                          type:
                            description: "type indicates which kind of seccomp profile
@@ -5090,9 +5358,13 @@ spec:
                      supplementalGroups:
                        description: A list of groups applied to the first process
                          run in each container, in addition to the container's primary
-                          GID.  If unspecified, no groups will be added to any container.
-                          Note that this field cannot be set when spec.os.name is
-                          windows.
+                          GID, the fsGroup (if specified), and group memberships defined
+                          in the container image for the uid of the container process.
+                          If unspecified, no additional groups are added to any container.
+                          Note that group memberships defined in the container image
+                          for the uid of the container process are still effective,
+                          even if they are not included in this list. Note that this
+                          field cannot be set when spec.os.name is windows.
                        items:
                          format: int64
                          type: integer
@@ -5136,15 +5408,12 @@ spec:
                            type: string
                          hostProcess:
                            description: HostProcess determines if a container should
-                              be run as a 'Host Process' container. This field is
-                              alpha-level and will only be honored by components that
-                              enable the WindowsHostProcessContainers feature flag.
-                              Setting this field without the feature flag will result
-                              in errors when validating the Pod. All of a Pod's containers
-                              must have the same effective HostProcess value (it is
-                              not allowed to have a mix of HostProcess containers
-                              and non-HostProcess containers).  In addition, if HostProcess
-                              is true then HostNetwork must also be set to true.
+                              be run as a 'Host Process' container. All of a Pod's
+                              containers must have the same effective HostProcess
+                              value (it is not allowed to have a mix of HostProcess
+                              containers and non-HostProcess containers). In addition,
+                              if HostProcess is true then HostNetwork must also be
+                              set to true.
                            type: boolean
                          runAsUserName:
                            description: The UserName in Windows to run the entrypoint
@@ -5299,14 +5568,19 @@ spec:
                          type: object
                          x-kubernetes-map-type: atomic
                        matchLabelKeys:
-                          description: MatchLabelKeys is a set of pod label keys to
-                            select the pods over which spreading will be calculated.
+                          description: "MatchLabelKeys is a set of pod label keys
+                            to select the pods over which spreading will be calculated.
                            The keys are used to lookup values from the incoming pod
                            labels, those key-value labels are ANDed with labelSelector
                            to select the group of existing pods over which spreading
-                            will be calculated for the incoming pod. Keys that don't
-                            exist in the incoming pod labels will be ignored. A null
-                            or empty list means only match against labelSelector.
+                            will be calculated for the incoming pod. The same key
+                            is forbidden to exist in both MatchLabelKeys and LabelSelector.
+                            MatchLabelKeys cannot be set when LabelSelector isn't
+                            set. Keys that don't exist in the incoming pod labels
+                            will be ignored. A null or empty list means only match
+                            against labelSelector. \n This is a beta field and requires
+                            the MatchLabelKeysInPodTopologySpread feature gate to
+                            be enabled (enabled by default)."
                          items:
                            type: string
                          type: array
@@ -5366,7 +5640,7 @@ spec:
                            - Ignore: nodeAffinity/nodeSelector are ignored. All nodes
                            are included in the calculations. \n If this value is
                            nil, the behavior is equivalent to the Honor policy. This
-                            is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
+                            is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread
                            feature flag."
                          type: string
                        nodeTaintsPolicy:
@@ -5376,8 +5650,8 @@ spec:
                            tainted nodes for which the incoming pod has a toleration,
                            are included. - Ignore: node taints are ignored. All nodes
                            are included. \n If this value is nil, the behavior is
-                            equivalent to the Ignore policy. This is a alpha-level
-                            feature enabled by the NodeInclusionPolicyInPodTopologySpread
+                            equivalent to the Ignore policy. This is a beta-level
+                            feature default enabled by the NodeInclusionPolicyInPodTopologySpread
                            feature flag."
                          type: string
                        topologyKey:
@@ -5825,7 +6099,7 @@ spec:
                                value between the SizeLimit specified here and the
                                sum of memory limits of all containers in a pod. The
                                default is nil which means that the limit is undefined.
-                                More info: http://kubernetes.io/docs/user-guide/volumes#emptydir'
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir'
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                          type: object
@@ -5900,10 +6174,13 @@ spec:
                                        If the provisioner or an external controller
                                        can support the specified data source, it
                                        will create a new volume based on the contents
-                                        of the specified data source. If the AnyVolumeDataSource
-                                        feature gate is enabled, this field will always
-                                        have the same contents as the DataSourceRef
-                                        field.'
+                                        of the specified data source. When the AnyVolumeDataSource
+                                        feature gate is enabled, dataSource contents
+                                        will be copied to dataSourceRef, and dataSourceRef
+                                        contents will be copied to dataSource when
+                                        dataSourceRef.namespace is not specified.
+                                        If the namespace is specified, then dataSourceRef
+                                        will not be copied to dataSource.'
                                      properties:
                                        apiGroup:
                                          description: APIGroup is the group for the
@@ -5929,29 +6206,37 @@ spec:
                                      description: 'dataSourceRef specifies the object
                                        from which to populate the volume with data,
                                        if a non-empty volume is desired. This may
-                                        be any local object from a non-empty API group
-                                        (non core object) or a PersistentVolumeClaim
-                                        object. When this field is specified, volume
-                                        binding will only succeed if the type of the
-                                        specified object matches some installed volume
-                                        populator or dynamic provisioner. This field
-                                        will replace the functionality of the DataSource
-                                        field and as such if both fields are non-empty,
+                                        be any object from a non-empty API group (non
+                                        core object) or a PersistentVolumeClaim object.
+                                        When this field is specified, volume binding
+                                        will only succeed if the type of the specified
+                                        object matches some installed volume populator
+                                        or dynamic provisioner. This field will replace
+                                        the functionality of the dataSource field
+                                        and as such if both fields are non-empty,
                                        they must have the same value. For backwards
-                                        compatibility, both fields (DataSource and
-                                        DataSourceRef) will be set to the same value
-                                        automatically if one of them is empty and
-                                        the other is non-empty. There are two important
-                                        differences between DataSource and DataSourceRef:
-                                        * While DataSource only allows two specific
-                                        types of objects, DataSourceRef allows any
-                                        non-core object, as well as PersistentVolumeClaim
-                                        objects. * While DataSource ignores disallowed
-                                        values (dropping them), DataSourceRef preserves
-                                        all values, and generates an error if a disallowed
-                                        value is specified. (Beta) Using this field
-                                        requires the AnyVolumeDataSource feature gate
-                                        to be enabled.'
+                                        compatibility, when namespace isn''t specified
+                                        in dataSourceRef, both fields (dataSource
+                                        and dataSourceRef) will be set to the same
+                                        value automatically if one of them is empty
+                                        and the other is non-empty. When namespace
+                                        is specified in dataSourceRef, dataSource
+                                        isn''t set to the same value and must be empty.
+                                        There are three important differences between
+                                        dataSource and dataSourceRef: * While dataSource
+                                        only allows two specific types of objects,
+                                        dataSourceRef allows any non-core object,
+                                        as well as PersistentVolumeClaim objects.
+                                        * While dataSource ignores disallowed values
+                                        (dropping them), dataSourceRef preserves all
+                                        values, and generates an error if a disallowed
+                                        value is specified. * While dataSource only
+                                        allows local objects, dataSourceRef allows
+                                        objects in any namespaces. (Beta) Using this
+                                        field requires the AnyVolumeDataSource feature
+                                        gate to be enabled. (Alpha) Using the namespace
+                                        field of dataSourceRef requires the CrossNamespaceVolumeDataSource
+                                        feature gate to be enabled.'
                                      properties:
                                        apiGroup:
                                          description: APIGroup is the group for the
@@ -5968,11 +6253,21 @@ spec:
                                          description: Name is the name of resource
                                            being referenced
                                          type: string
+                                        namespace:
+                                          description: Namespace is the namespace
+                                            of resource being referenced Note that
+                                            when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant
+                                            object is required in the referent namespace
+                                            to allow that namespace's owner to accept
+                                            the reference. See the ReferenceGrant
+                                            documentation for details. (Alpha) This
+                                            field requires the CrossNamespaceVolumeDataSource
+                                            feature gate to be enabled.
+                                          type: string
                                      required:
                                      - kind
                                      - name
                                      type: object
-                                      x-kubernetes-map-type: atomic
                                    resources:
                                      description: 'resources represents the minimum
                                        resources the volume should have. If RecoverVolumeExpansionFailure
@@ -5982,6 +6277,32 @@ spec:
                                        capacity recorded in the status field of the
                                        claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources'
                                      properties:
+                                        claims:
+                                          description: "Claims lists the names of
+                                            resources, defined in spec.resourceClaims,
+                                            that are used by this container. \n This
+                                            is an alpha field and requires enabling
+                                            the DynamicResourceAllocation feature
+                                            gate. \n This field is immutable. It can
+                                            only be set for containers."
+                                          items:
+                                            description: ResourceClaim references
+                                              one entry in PodSpec.ResourceClaims.
+                                            properties:
+                                              name:
+                                                description: Name must match the name
+                                                  of one entry in pod.spec.resourceClaims
+                                                  of the Pod where this field is used.
+                                                  It makes that resource available
+                                                  inside a container.
+                                                type: string
+                                            required:
+                                            - name
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-map-keys:
+                                          - name
+                                          x-kubernetes-list-type: map
                                        limits:
                                          additionalProperties:
                                            anyOf:
@@ -6005,7 +6326,8 @@ spec:
                                            If Requests is omitted for a container,
                                            it defaults to Limits if that is explicitly
                                            specified, otherwise to an implementation-defined
-                                            value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                                            value. Requests cannot exceed Limits.
+                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                                          type: object
                                      type: object
                                    selector:
--- a/Show More
+++ b/Show More