Allow service account check to run only once at start of executor (#2673)

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

.github/workflows/lint.yaml

@@ -18,7 +18,7 @@ on:
   workflow_dispatch:
 
 env:
-  GOLANGCI_LINT_VERSION: v1.49.0
+  GOLANGCI_LINT_VERSION: v1.50.1
   GOLANGCI_LINT_TIMEOUT: 5m
 
 jobs:

.github/workflows/push_pr.yaml

@@ -77,7 +77,7 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v1.39.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 
@@ -91,7 +91,8 @@ jobs:
           helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
           kubectl create ns monitoring
-          helm install monitoring prometheus-community/prometheus -n monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --set grafana.enabled=false --set alertmanager.enabled=false
 
       - name: Build and Install Fission CLI
         run: |
@@ -133,6 +134,12 @@ jobs:
         run: |
           kind export logs --name kind kind-logs
 
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
       - name: Archive fission dump
         timeout-minutes: 10
         if: ${{ failure() || cancelled() }}
@@ -142,6 +149,15 @@ jobs:
           path: fission-dump/*.zip
           retention-days: 5
 
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
       - name: Archive kind logs
         timeout-minutes: 10
         if: ${{ always() }}
@@ -150,3 +166,148 @@ jobs:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
           retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.19.16"]
+        os: [ubuntu-latest]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v3
+
+      - name: setup go
+        uses: actions/setup-go@v3
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@v3
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@v3
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: engineerd/setup-kind@v0.5.0
+        with:
+          image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-kind
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-kind
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@v3
+        with:
+          install-only: true
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+          kubectl port-forward svc/controller 8889:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.gitignore

@@ -37,3 +37,6 @@ manifest/
 coverage.txt
 
 cosign.key
+
+# Dumps
+.dumps/

.golangci.yaml

@@ -32,4 +32,4 @@ linters-settings:
   goimports:
     # put imports beginning with prefix after 3rd-party packages;
     # it's a comma-separated list of prefixes
-    local-prefixes: github.com/fission/fission
+    local: github.com/fission/fission

charts/fission-all/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: fission-all
-version: v1.18.0-rc1
+version: v1.18.0-rc2
-appVersion: v1.18.0-rc1
+appVersion: v1.18.0-rc2
 description: Fission is a fast serverless framework for Kubernetes.
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -0,0 +1,393 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "controller-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}

charts/fission-all/templates/_fission-kuberntes-role-generator.tpl

@@ -0,0 +1,67 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "controller" .component }}
+{{- include "controller-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_function-access-role.tpl

@@ -13,18 +13,12 @@ rules:
   - secrets
   verbs:
   - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
 - apiGroups:
   - fission.io
   resources:
   - packages
   verbs:
-  - "get"
+  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -37,7 +31,7 @@ rules:
   resources:
   - packages
   verbs:
-  - "get"
+  - get
 - apiGroups:
   - ""
   resources:
@@ -45,6 +39,30 @@ rules:
   - secrets
   verbs:
   - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
 {{- end -}}
 
 {{- define "fissionFunction.rolebindings" }}
@@ -61,7 +79,11 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher
-    namespace: {{template "fission-function-ns" . }}
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -75,5 +97,27 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-builder
-    namespace: {{ template "fission-builder-ns" . }}
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
 {{- end -}}

charts/fission-all/templates/_helpers.tpl

@@ -74,7 +74,7 @@ This template generates the image name for the deployment depending on the value
 
 {{- define "fission-resource-namespace.envs" }}
 - name: FISSION_RESOURCE_NAMESPACES
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
   value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
 {{- else }}
   value: {{ .Values.defaultNamespace }}  
@@ -100,6 +100,6 @@ Define the svc's name
 {{- if .Values.builderNamespace -}}
 {{- printf "%s" .Values.builderNamespace -}}
 {{- else -}}
-{{- printf "%s" .Values.builderNamespace -}}
+{{- printf "%s" .Values.defaultNamespace -}}
 {{- end -}}
 {{- end -}}

charts/fission-all/templates/buildermgr/clusterrole.yaml

@@ -1,53 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - services
-  - serviceaccounts
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - list
-  - create
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/buildermgr/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-subjects:
-  - kind: ServiceAccount
-    name: fission-buildermgr
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-buildermgr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/buildermgr/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: builder-podspec-patch
 data: 
-  spec: |
+  builder-podspec-patch.yaml: |
     {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -44,7 +44,7 @@ spec:
         - name: FISSION_FUNCTION_NAMESPACE
           value: "{{ .Values.functionNamespace }}"
         - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"      
+          value: "{{ .Values.defaultNamespace }}"
         - name: ENABLE_ISTIO
           value: "{{ .Values.enableIstio }}"
         - name: FETCHER_MINCPU
@@ -61,8 +61,15 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
           - containerPort: 8080
             name: metrics
@@ -75,11 +82,17 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
 {{- end }}

charts/fission-all/templates/buildermgr/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/canary-config/clusterrole.yaml

@@ -1,43 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end }}

charts/fission-all/templates/canary-config/clusterrolebinding.yaml

@@ -1,14 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-subjects:
-  - kind: ServiceAccount
-    name: fission-canaryconfig
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-canaryconfig
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}

charts/fission-all/templates/canary-config/role-fission-cr.yaml

@@ -1,7 +1,7 @@
 {{- if .Values.canaryDeployment.enabled }}
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
 {{- end }}

charts/fission-all/templates/canary-config/role-kubernetes.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/controller/clusterrole.yaml

@@ -1,43 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-controller
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end -}}

charts/fission-all/templates/controller/clusterrolebinding.yaml

@@ -1,14 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-controller
-subjects:
-  - kind: ServiceAccount
-    name: fission-controller
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-controller
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}

charts/fission-all/templates/controller/deployment.yaml

@@ -1,4 +1,4 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- if .Values.controller.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/fission-all/templates/controller/role-fission-cr.yaml

@@ -1,7 +1,7 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- if .Values.controller.enabled }}
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
 {{- end }}

charts/fission-all/templates/controller/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "controller") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "controller") $) }}
+{{- end }}

charts/fission-all/templates/controller/serviceaccount.yaml

@@ -1,4 +1,4 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- if .Values.controller.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/fission-all/templates/controller/servicemonitor.yaml

@@ -1,4 +1,4 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- if .Values.controller.enabled }}
 {{- if .Values.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor

charts/fission-all/templates/controller/svc.yaml

@@ -1,4 +1,4 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
+{{- if .Values.controller.enabled }}
 apiVersion: v1
 kind: Service
 metadata:

charts/fission-all/templates/executor/clusterrole.yaml

@@ -1,81 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-executor
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/executor/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-executor
-subjects:
-  - kind: ServiceAccount
-    name: fission-executor
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-executor
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: runtime-podspec-patch
 data: 
-  spec: |
+  runtime-podspec-patch.yaml: |
     {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/executor/deployment.yaml

@@ -42,7 +42,7 @@ spec:
         - name: FISSION_FUNCTION_NAMESPACE
           value: "{{ .Values.functionNamespace }}"
         - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"  
+          value: "{{ .Values.defaultNamespace }}"
         - name: RUNTIME_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
         - name: ADOPT_EXISTING_RESOURCES
@@ -77,6 +77,12 @@ spec:
         - name: CONTAINER_OBJECT_REAPER_INTERVAL
           value: {{ .Values.executor.container.objectReaperInterval | quote }}
         {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        {{- end}}  
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
@@ -96,6 +102,13 @@ spec:
             port: 8888
           initialDelaySeconds: 35
           periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
         - containerPort: 8080
           name: metrics
@@ -116,13 +129,19 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
 {{- if .Values.executor.priorityClassName }}
       priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
 {{- end }}

charts/fission-all/templates/executor/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/fluentbit/clusterrole.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch

charts/fission-all/templates/fluentbit/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-subjects:
-  - kind: ServiceAccount
-    name: fission-fluentbit
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-fluentbit
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/fluentbit/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/kubewatcher/clusterrole.yaml

@@ -1,56 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-kubewatcher
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kubewatcher
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
 {{- end }}

charts/fission-all/templates/kubewatcher/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/clusterrole.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-secret-configmap-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - secrets
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-package-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - packages
-    verbs:
-      - "*"
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - rolebindings
-    verbs:
-      - "*"

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,26 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ template "fission-function-ns" . }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - "events"
-  verbs:
-  - "get"
-  - "list"
-  - "watch"
-  - "create"
-  - "update"
-  - "patch"
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
 {{- end }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -4,22 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ template "fission-function-ns" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ template "fission-function-ns" . }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
 {{- end }}

charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml

@@ -1,62 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kafka
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kafka
-subjects:
-  - kind: ServiceAccount
-    name: fission-kafka
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kafka
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
 {{- end }}

charts/fission-all/templates/mqt-fission-kafka/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/clusterrole.yaml

@@ -1,105 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-keda
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - keda.sh
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- if .Values.mqt_keda.enabled }}
-- apiGroups:
-  - keda.k8s.io
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- end }}
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-keda
-subjects:
-  - kind: ServiceAccount
-    name: fission-keda
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-keda
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-keda/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
 {{- end }}

charts/fission-all/templates/mqt-keda/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
 {{- end }}

charts/fission-all/templates/router/clusterrole.yaml

@@ -1,60 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-router
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/router/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-router
-subjects:
-  - kind: ServiceAccount
-    name: fission-router
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-router
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/router/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
 {{- end }}

charts/fission-all/templates/router/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/storagesvc/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
 {{- end }}

charts/fission-all/templates/timer/clusterrole.yaml

@@ -1,48 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-timer
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch

charts/fission-all/templates/timer/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-timer
-subjects:
-  - kind: ServiceAccount
-    name: fission-timer
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-timer
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/timer/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
 {{- end }}

charts/fission-all/templates/timer/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/values.yaml

@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.18.0-rc1
+imageTag: v1.18.0-rc2
 
 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -65,7 +65,6 @@ routerPort: 31314
 ## This is different from the release namespace.
 ## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
 ## more than one namespace to be used for Fission custom resources.
-## Fission will watch the defaultNamespace only if `singleDefaultNamespace` is true.
 ##
 defaultNamespace: default
 
@@ -81,12 +80,7 @@ builderNamespace: ""
 ##
 functionNamespace: ""
 
-## If true, fission will only watch for fission custom resources created in the `defaultNamespace` above.
-##
-singleDefaultNamespace: true
-
 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
-## Only works if `singleDefaultNamespace` is false.
 ## additionalFissionNamespaces: 
 ## - namespace1
 ## - namespace2
@@ -110,7 +104,7 @@ fetcher:
   ## image represents the image of the fetcher component.
   image: fission/fetcher
   ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.18.0-rc1
+  imageTag: v1.18.0-rc2
 
   ## Fetcher is only for to downloading or uploading archive.
   ## Normally, you don't need to change the value here, unless necessary.
@@ -166,7 +160,7 @@ executor:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -193,6 +187,14 @@ executor:
     ##
     ## objectReaperInterval: 5
 
+  serviceAccountCheck:
+    ## enables fission to create service account, roles and rolebinding for missing permission for builder and fetcher.
+    enabled: true
+    ## indicates the time interval in minutes, after that fission will create service account, roles and rolebinding for builder and fetcher.
+    ## interval will be applicable only if enable value is set to true.
+    ## default timing will be 0 minutes. That means check will run only once.
+    ## if you want to run check every 30 minutes then set interval to 30.
+    interval: 0
 ## router is responsible for routing function calls to the appropriate function.
 ##
 router:
@@ -303,7 +305,7 @@ router:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -329,7 +331,7 @@ buildermgr:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -357,7 +359,7 @@ controller:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -394,7 +396,7 @@ webhook:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -421,7 +423,7 @@ kubewatcher:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -453,7 +455,7 @@ storagesvc:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -480,7 +482,7 @@ timer:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -684,7 +686,7 @@ preUpgradeChecks:
   image: fission/pre-upgrade-checks
   ## pre-install/pre-upgrade checks image version
   ##
-  imageTag: v1.18.0-rc1
+  imageTag: v1.18.0-rc2
 
 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -725,7 +727,7 @@ canaryDeployment:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001

cmd/fission-bundle/main.go

@@ -216,7 +216,7 @@ Options:
 	ctx := signals.SetupSignalHandler()
 	profile.ProfileIfEnabled(ctx, logger)
 
-	version := fmt.Sprintf("Fission Bundle Version: %v", info.BuildInfo().String())
+	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
 	arguments, err := docopt.ParseArgs(usage, nil, version)
 	if err != nil {
 		logger.Error("failed to parse arguments", zap.Error(err))

cmd/fission-bundle/mqtrigger/mqtrigger.go

@@ -35,10 +35,10 @@ import (
 )
 
 func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	fissionClient, _, _, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
-
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission or kubernetes client")
+		return errors.Wrap(err, "failed to get fission client")
 	}
 
 	err = crd.WaitForCRDs(ctx, logger, fissionClient)

cmd/preupgradechecks/checks.go

@@ -52,9 +52,18 @@ const (
 )
 
 func makePreUpgradeTaskClient(logger *zap.Logger) (*PreUpgradeTaskClient, error) {
-	fissionClient, k8sClient, apiExtClient, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making fission client")
+		return nil, errors.Wrap(err, "failed to get fission client")
+	}
+	k8sClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get kubernetes client")
+	}
+	apiExtClient, err := clientGen.GetApiExtensionsClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get apiextensions client")
 	}
 
 	return &PreUpgradeTaskClient{
@@ -123,7 +132,7 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Con
 	var fList *fv1.FunctionList
 	errs := &multierror.Error{}
 
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		for i := 0; i < maxRetries; i++ {
 			fList, err = client.fissionClient.CoreV1().Functions(namespace).List(ctx, metav1.ListOptions{})
 			if err == nil {

go.mod

@@ -4,6 +4,7 @@ go 1.19
 
 require (
 	github.com/Shopify/sarama v1.37.2
+	github.com/bep/debounce v1.2.1
 	github.com/dchest/uniuri v1.2.0
 	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/dustin/go-humanize v1.0.0
@@ -14,13 +15,14 @@ require (
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/go-git/go-git/v5 v5.4.2
 	github.com/go-openapi/spec v0.20.7
-	github.com/golang-jwt/jwt/v4 v4.4.2
+	github.com/golang-jwt/jwt/v4 v4.4.3
+	github.com/google/go-cmp v0.5.9
 	github.com/gorilla/mux v1.8.0
 	github.com/graymeta/stow v0.2.8
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-retryablehttp v0.7.1
 	github.com/imdario/mergo v0.3.13
-	github.com/influxdata/influxdb v1.10.0
+	github.com/influxdata/influxdb v1.11.0
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/minio/minio-go v6.0.14+incompatible
 	github.com/ory/dockertest v3.3.5+incompatible
@@ -34,15 +36,15 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.8.1
 	github.com/wcharczuk/go-chart v2.0.1+incompatible
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.36.4
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0
-	go.opentelemetry.io/contrib/propagators/autoprop v0.36.4
+	go.opentelemetry.io/contrib/propagators/autoprop v0.37.0
-	go.opentelemetry.io/otel v1.11.1
+	go.opentelemetry.io/otel v1.11.2
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.1
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.2
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.1
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.2
-	go.opentelemetry.io/otel/sdk v1.11.1
+	go.opentelemetry.io/otel/sdk v1.11.2
-	go.opentelemetry.io/otel/trace v1.11.1
+	go.opentelemetry.io/otel/trace v1.11.2
-	go.uber.org/zap v1.23.0
+	go.uber.org/zap v1.24.0
-	golang.org/x/net v0.2.0
+	golang.org/x/net v0.4.0
 	google.golang.org/grpc v1.51.0
 	k8s.io/api v0.25.4
 	k8s.io/apiextensions-apiserver v0.25.4
@@ -66,17 +68,18 @@ require (
 	github.com/Masterminds/goutils v1.1.0 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4 // indirect
 	github.com/acomagu/bufpipe v1.0.3 // indirect
 	github.com/andybalholm/brotli v1.0.1 // indirect
 	github.com/aws/aws-sdk-go v1.42.34 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blend/go-sdk v1.20220112.5 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cloudflare/circl v1.1.0 // indirect
 	github.com/containerd/continuity v0.2.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -86,7 +89,7 @@ require (
 	github.com/eapache/go-resiliency v1.3.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/emirpasic/gods v1.12.0 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
@@ -107,7 +110,6 @@ require (
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
@@ -126,7 +128,7 @@ require (
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.15.11 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/lib/pq v1.10.4 // indirect
@@ -155,27 +157,27 @@ require (
 	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/ulikunitz/xz v0.5.9 // indirect
-	github.com/xanzy/ssh-agent v0.3.0 // indirect
+	github.com/xanzy/ssh-agent v0.3.2 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	go.opentelemetry.io/contrib/propagators/aws v1.11.1 // indirect
+	go.opentelemetry.io/contrib/propagators/aws v1.12.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.11.1 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.12.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.11.1 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.12.0 // indirect
-	go.opentelemetry.io/contrib/propagators/ot v1.11.1 // indirect
+	go.opentelemetry.io/contrib/propagators/ot v1.12.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.1 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.2 // indirect
-	go.opentelemetry.io/otel/metric v0.33.0 // indirect
+	go.opentelemetry.io/otel/metric v0.34.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
+	golang.org/x/crypto v0.3.0 // indirect
 	golang.org/x/image v0.0.0-20190802002840-cff245a6509b // indirect
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
 	golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
-	golang.org/x/sys v0.2.0 // indirect
+	golang.org/x/sys v0.3.0 // indirect
-	golang.org/x/term v0.2.0 // indirect
+	golang.org/x/term v0.3.0 // indirect
-	golang.org/x/text v0.4.0 // indirect
+	golang.org/x/text v0.5.0 // indirect
 	golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
 	golang.org/x/tools v0.1.12 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03 // indirect

go.sum

@@ -83,13 +83,15 @@ github.com/Masterminds/sprig v2.22.0+incompatible h1:z4yfnGrZ7netVz+0EDJ0Wi+5VZC
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
 github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.2 h1:a9IhgEQBCUEk6QCdml9CiJGhAws+YwffDHEMp1VMrpA=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
+github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4 h1:ra2OtmuW0AE5csawV4YXMNGNQQXvLRps3z2Z59OPO+I=
+github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4/go.mod h1:UBYPn8k0D56RtnR8RFQMjmh4KrZzWJ5o7Z9SYjossQ8=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/Shopify/sarama v1.37.2 h1:LoBbU0yJPte0cE5TZCGdlzZRmMgMtZU/XgnUKZg9Cv4=
@@ -119,12 +121,15 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bep/debounce v1.2.1 h1:v67fRdBA9UQu2NhLFXrSg0Brw7CexQekrBwDMM8bzeY=
+github.com/bep/debounce v1.2.1/go.mod h1:H8yggRPQKLUhUoqrJC1bO2xNya7vanpDl7xR3ISbCJ0=
 github.com/blend/go-sdk v1.20220112.5 h1:M1H3KB++HyPAek31WH2HNut1Xg1SI7LyT9giNE2fcPQ=
 github.com/blend/go-sdk v1.20220112.5/go.mod h1:STLiO8ZA8doHtRV7QfW2mXgH/8U+85GHY9ge3phM3dY=
+github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
+github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
-github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -138,6 +143,8 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/circl v1.1.0 h1:bZgT/A+cikZnKIwn7xL2OBj012Bmvho/o6RpRvv3GKY=
+github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -195,8 +202,9 @@ github.com/emicklei/go-restful-openapi/v2 v2.9.1/go.mod h1:VKNgZyYviM1hnyrjD9RDz
 github.com/emicklei/go-restful/v3 v3.7.3/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKfrDac4bSQ=
 github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
 github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -286,8 +294,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
+github.com/golang-jwt/jwt/v4 v4.4.3 h1:Hxl6lhQFj4AnOX6MLrsCb/+7tCj7DxP7VA+2rDIq5AU=
-github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -422,8 +430,8 @@ github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/influxdata/influxdb v1.10.0 h1:8xDpt8KO3lzrzf/ss+l8r42AGUZvoITu5824berK7SE=
+github.com/influxdata/influxdb v1.11.0 h1:0X+ZsbcOWc6AEi5MHee9BYqXCKmz8IZsljrRYjmV8Qg=
-github.com/influxdata/influxdb v1.10.0/go.mod h1:IVPuoA2pOOxau/NguX7ipW0Jp9Bn+dMWlo0+VOscevU=
+github.com/influxdata/influxdb v1.11.0/go.mod h1:V93tJcidY0Zh0LtSONZWnXXGDyt20dtVf+Ddp4EnhaA=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -459,8 +467,9 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
 github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
@@ -664,8 +673,9 @@ github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYp
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/wcharczuk/go-chart v2.0.1+incompatible h1:0pz39ZAycJFF7ju/1mepnk26RLVLBCWz1STcD3doU0A=
 github.com/wcharczuk/go-chart v2.0.1+incompatible/go.mod h1:PF5tmL4EIx/7Wf+hEkpCqYi5He4u90sw+0+6FhrryuE=
-github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
 github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/xanzy/ssh-agent v0.3.2 h1:eKj4SX2Fe7mui28ZgnFW5fmTz1EIr7ugo5s6wDxdHBM=
+github.com/xanzy/ssh-agent v0.3.2/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
@@ -683,32 +693,32 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.36.4 h1:aUEBEdCa6iamGzg6fuYxDA8ThxvOG240mAvWDU+XLio=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0 h1:yt2NKzK7Vyo6h0+X8BA4FpreZQTlVEIarnsBP/H5mzs=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.36.4/go.mod h1:l2MdsbKTocpPS5nQZscqTR9jd8u96VYZdcpF8Sye7mA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0/go.mod h1:+ARmXlUlc51J7sZeCBkBJNdHGySrdOzgzxp6VWRWM1U=
-go.opentelemetry.io/contrib/propagators/autoprop v0.36.4 h1:j3vDrBTpDmr8OowuTxj/Jw+5YBeOYkRYFvMd/G+bBjw=
+go.opentelemetry.io/contrib/propagators/autoprop v0.37.0 h1:7BO8yg+5TE8QWzA6apuj8nPjoIdQUw8OhsFSYU6DPeo=
-go.opentelemetry.io/contrib/propagators/autoprop v0.36.4/go.mod h1:MjAC3Fl7Ds8KghJpMq6G2pdGdrx09kn6En0vooHEpSg=
+go.opentelemetry.io/contrib/propagators/autoprop v0.37.0/go.mod h1:bV3y2INa2Fe69LVRzszdM/knfKRBtJmI8VbHQi9ySpM=
-go.opentelemetry.io/contrib/propagators/aws v1.11.1 h1:bPoZrezYKRb3HXrW6I7QmYLz5bStFrb4ZWmcRw8k+Gg=
+go.opentelemetry.io/contrib/propagators/aws v1.12.0 h1:n3lNyZs2ytVEfFhcn2QO5Z80lgrMXyP1Ncx0C7rUU8A=
-go.opentelemetry.io/contrib/propagators/aws v1.11.1/go.mod h1:5jZiQXbiLiVtJP2YRe/IbHURUnWMVsnj8MVinGPAKJs=
+go.opentelemetry.io/contrib/propagators/aws v1.12.0/go.mod h1:xZSOQIixr40Cq3NHn/YsvkDOzpVaR0j19WJRZnOKwbk=
-go.opentelemetry.io/contrib/propagators/b3 v1.11.1 h1:icQ6ttRV+r/2fnU46BIo/g/mPu6Rs5Ug8Rtohe3KqzI=
+go.opentelemetry.io/contrib/propagators/b3 v1.12.0 h1:OtfTF8bneN8qTeo/j92kcvc0iDDm4bm/c3RzaUJfiu0=
-go.opentelemetry.io/contrib/propagators/b3 v1.11.1/go.mod h1:ECIveyMXgnl4gorxFcA7RYjJY/Ql9n20ubhbfDc3QfA=
+go.opentelemetry.io/contrib/propagators/b3 v1.12.0/go.mod h1:0JDB4elfPUWGsCH/qhaMkDzP1l8nB0ANVx8zXuAYEwg=
-go.opentelemetry.io/contrib/propagators/jaeger v1.11.1 h1:Gw+P9NQzw4bjNGZXsoDhwwDWLnk4Y1waF8MQZAq/eYM=
+go.opentelemetry.io/contrib/propagators/jaeger v1.12.0 h1:fQBEhLiGQihBAAmiozZihHvO0t/+NFZMOLx80bmAi+s=
-go.opentelemetry.io/contrib/propagators/jaeger v1.11.1/go.mod h1:dP/N3ZFADH8azBcZfGXEFNBXpEmPTXYcNj9rkw1+2Oc=
+go.opentelemetry.io/contrib/propagators/jaeger v1.12.0/go.mod h1:hryAK4MKIBKRaUh8n0/vHWuu4fzhR0XB1Q8B4wz3qhw=
-go.opentelemetry.io/contrib/propagators/ot v1.11.1 h1:iezQwYW2sAaXwbXXA6Zg+PLjNnzc+M4hLKvOR6Q/CvI=
+go.opentelemetry.io/contrib/propagators/ot v1.12.0 h1:6yNXAAQW08uIwgQKQvGC/0/5KkUCZmOcwSjj8zYg1ZU=
-go.opentelemetry.io/contrib/propagators/ot v1.11.1/go.mod h1:oBced35DewKV7xvvIWC/oCaCFvthvTa6zjyvP2JhPAY=
+go.opentelemetry.io/contrib/propagators/ot v1.12.0/go.mod h1:t2n1RTxGm14/AEMSELd0jJo3NBjeEHnDtCRYXKTl0Ak=
-go.opentelemetry.io/otel v1.11.1 h1:4WLLAmcfkmDk2ukNXJyq3/kiz/3UzCaYq6PskJsaou4=
+go.opentelemetry.io/otel v1.11.2 h1:YBZcQlsVekzFsFbjygXMOXSs6pialIZxcjfO/mBDmR0=
-go.opentelemetry.io/otel v1.11.1/go.mod h1:1nNhXBbWSD0nsL38H6btgnFN2k4i0sNLHNNMZMSbUGE=
+go.opentelemetry.io/otel v1.11.2/go.mod h1:7p4EUV+AqgdlNV9gL97IgUZiVR3yrFXYo53f9BM3tRI=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.1 h1:X2GndnMCsUPh6CiY2a+frAbNsXaPLbB0soHRYhAZ5Ig=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.2 h1:htgM8vZIF8oPSCxa341e3IZ4yr/sKxgu8KZYllByiVY=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.1/go.mod h1:i8vjiSzbiUC7wOQplijSXMYUpNM93DtlS5CbUT+C6oQ=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.11.2/go.mod h1:rqbht/LlhVBgn5+k3M5QK96K5Xb0DvXpMJ5SFQpY6uw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.1 h1:MEQNafcNCB0uQIti/oHgU7CZpUMYQ7qigBwMVKycHvc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.2 h1:fqR1kli93643au1RKo0Uma3d2aPQKT+WBKfTSBaKbOc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.1/go.mod h1:19O5I2U5iys38SsmT2uDJja/300woyzE1KPIQxEUBUc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.11.2/go.mod h1:5Qn6qvgkMsLDX+sYK64rHb1FPhpn0UtxF+ouX1uhyJE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.1 h1:LYyG/f1W/jzAix16jbksJfMQFpOH/Ma6T639pVPMgfI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.2 h1:ERwKPn9Aer7Gxsc0+ZlutlH1bEEAUXAUhqm3Y45ABbk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.1/go.mod h1:QrRRQiY3kzAoYPNLP0W/Ikg0gR6V3LMc+ODSxr7yyvg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.11.2/go.mod h1:jWZUM2MWhWCJ9J9xVbRx7tzK1mXKpAlze4CeulycwVY=
-go.opentelemetry.io/otel/metric v0.33.0 h1:xQAyl7uGEYvrLAiV/09iTJlp1pZnQ9Wl793qbVvED1E=
+go.opentelemetry.io/otel/metric v0.34.0 h1:MCPoQxcg/26EuuJwpYN1mZTeCYAUGx8ABxfW07YkjP8=
-go.opentelemetry.io/otel/metric v0.33.0/go.mod h1:QlTYc+EnYNq/M2mNk1qDDMRLpqCOj2f/r5c7Fd5FYaI=
+go.opentelemetry.io/otel/metric v0.34.0/go.mod h1:ZFuI4yQGNCupurTXCwkeD/zHBt+C2bR7bw5JqUm/AP8=
-go.opentelemetry.io/otel/sdk v1.11.1 h1:F7KmQgoHljhUuJyA+9BiU+EkJfyX5nVVF4wyzWZpKxs=
+go.opentelemetry.io/otel/sdk v1.11.2 h1:GF4JoaEx7iihdMFu30sOyRx52HDHOkl9xQ8SMqNXUiU=
-go.opentelemetry.io/otel/sdk v1.11.1/go.mod h1:/l3FE4SupHJ12TduVjUkZtlfFqDCQJlOlithYrdktys=
+go.opentelemetry.io/otel/sdk v1.11.2/go.mod h1:wZ1WxImwpq+lVRo4vsmSOxdd+xwoUJ6rqyLc3SyX9aU=
-go.opentelemetry.io/otel/trace v1.11.1 h1:ofxdnzsNrGBYXbP7t7zpUK281+go5rF7dvdIZXF8gdQ=
+go.opentelemetry.io/otel/trace v1.11.2 h1:Xf7hWSF2Glv0DE3MH7fBHvtpSBsjcBUe5MYAmZM/+y0=
-go.opentelemetry.io/otel/trace v1.11.1/go.mod h1:f/Q9G7vzk5u91PhbmKbg1Qn0rzH1LJ4vbPHFGkTPtOk=
+go.opentelemetry.io/otel/trace v1.11.2/go.mod h1:4N+yC7QEz7TTsG9BSRLNAa63eg5E06ObSbKPmxQ/pKA=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
@@ -724,8 +734,8 @@ go.uber.org/multierr v1.8.0 h1:dg6GjLku4EH+249NNmoIciG9N/jURbDG+pFlTkhzIC8=
 go.uber.org/multierr v1.8.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
-go.uber.org/zap v1.23.0 h1:OjGQ5KQDEUawVHxNwQgPpiypGHOxo2mNZsOqTak4fFY=
+go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.23.0/go.mod h1:D+nX8jyLsMHMYrln8A0rJjFt/T/9/bGgIhAqxv5URuY=
+go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -738,8 +748,10 @@ golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa h1:zuSxTR4o9y82ebqCUJYNGJbGPo6sKVl54f/TVDObg1c=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -827,8 +839,8 @@ golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220725212005-46097bf591d3/go.mod h1:AaygXjzTFtRAg2ttMY5RMuhpJ3cNnI0XpyFJD1iQRSM=
-golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
+golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -929,19 +941,21 @@ golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
+golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0 h1:z85xZCsEl7bi/KwbNADeBYoOP0++7W1ipu+aGnpwzRM=
+golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -951,8 +965,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1018,8 +1032,9 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f h1:GGU+dLjvlC3qDwqYgL6UgRmHXhOOgns0bZu2Ty5mm6U=
+golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.2.0 h1:4pT439QV83L+G9FkcCriY6EkpcK6r6bK+A5FBUMI7qY=
 gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=

hack/backup-prometheus.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if [[ -n "${TRACE-}" ]]; then
+    set -o xtrace
+fi
+NAMESPACE=${1:-monitoring}
+RELEASE=${2:-prometheus}
+BACKUP_DIR=${3:-/tmp/prometheus}
+LABELS="-l app=kube-prometheus-stack-${RELEASE}"
+
+sts_name=$(kubectl -n "$NAMESPACE" get sts "$LABELS" -o custom-columns=:.metadata.name | grep ^"$RELEASE")
+echo "Statefulset name: $sts_name"
+
+mkdir -p "$BACKUP_DIR"/prometheus
+# Copy snapshot to local
+kubectl -n "$NAMESPACE" cp "$sts_name"-0:/prometheus/ "$BACKUP_DIR"/prometheus
+
+mkdir -p "$BACKUP_DIR"/etc/prometheus
+kubectl -n "$NAMESPACE" cp "$sts_name"-0:/etc/prometheus "$BACKUP_DIR"/etc/prometheus

hack/dump-analyzer

@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+###
+# This script is used to analyze the dump files generated by the Fission CI.
+###
+set -o errexit
+set -o nounset
+set -o pipefail
+if [[ -n "${TRACE-}" ]]; then
+    set -o xtrace
+fi
+REPO="fission/fission"
+
+function exit_error() {
+    echo "$1"
+    exit 1
+}
+
+function doit() {
+    echo "! $*"
+    "$@"
+}
+
+function check_context() {
+    if [ -z "$DUMP_CONTEXT" ]; then
+        exit_error "DUMP_CONTEXT not set"
+    fi
+}
+
+function prom_context() {
+    if [ -z "$PROM_CONTEXT" ]; then
+        exit_error "PROM_CONTEXT not set"
+    fi
+    echo "Prometheus context: $PROM_CONTEXT"
+}
+
+function list_context() {
+    for dump in $(find .dumps/$RUN_ID/extract -type d -depth 1); do
+        echo "==== $dump ===="
+        echo "-- Fission Version --"
+        cat $dump/fission-version/fission-version.txt | grep "server:\|client\:\|Version"
+        echo "-- K8s Version --"
+        cat $dump/kubernetes-version/kubernetes-version.txt | grep gitVersion
+    done
+}
+
+function list_kind() {
+    for dump in $(find .dumps/$RUN_ID -type d -depth 1 -name 'kind-logs-*'); do
+        echo "==== $dump ===="
+        cat $dump/kind-version.txt
+        echo -e "\n"
+    done
+}
+
+function extract() {
+    ARTIFACT_PATH=.dumps/$RUN_ID
+    if [ ! -d "$ARTIFACT_PATH" ]; then
+        doit mkdir -p "$ARTIFACT_PATH"
+    fi
+    echo $ARTIFACT_PATH
+    # Don't download if artifact already exits for run
+    if [ ! -d "$ARTIFACT_PATH"/fission-dump/ ]; then
+        doit gh run download "$RUN_ID" -R "$REPO" -D "$ARTIFACT_PATH"
+    fi
+    if [ -d "$ARTIFACT_PATH"/extract ]; then
+        doit rm -r "$ARTIFACT_PATH"/extract
+    fi
+    DUMPS=$(find "$ARTIFACT_PATH" -name 'fission-dump*.zip')
+    for dump in $DUMPS; do
+        doit unzip -q $dump -d "$ARTIFACT_PATH"/extract
+    done
+}
+
+function info() {
+    check_context
+    echo "Dump context: $DUMP_CONTEXT"
+    doit cat "$DUMP_CONTEXT"/fission-version/fission-version.txt
+    doit cat "$DUMP_CONTEXT"/kubernetes-version/kubernetes-version.txt
+}
+
+function race_conditions() {
+    check_context
+    # doit ack -A 10 "WARNING: DATA RACE" "$DUMP_CONTEXT/"
+    LOG_FILES=$(find $DUMP_CONTEXT -name '*.txt' -type f | grep log)
+    for logfile in $LOG_FILES; do
+        out=$(sed -n '/DATA RACE/,/==================$/p' "$logfile")
+        if [ "$out" != "" ]; then
+            shortname=$(basename $logfile)
+            echo "Trace from $shortname"
+            sed -n '/DATA RACE/,/==================$/p' "$logfile"
+        fi
+    done
+}
+
+function error_logs() {
+    check_context
+    # ack '"level":"error"' $DUMP_CONTEXT | grep -v "404" | cut -d':' -f 3- | go-slearch -pts,caller,msg,error,logger,errorVerbose | sort
+    ack -i 'error' $DUMP_CONTEXT | grep -v "404" | cut -d':' -f 3- | sort
+}
+
+function prometheus_run() {
+    # check if prometheus binary exists
+    if command -v prometheus &> /dev/null ; then
+        echo "prometheus binary found"
+    else
+        exit_error "prometheus binary not found"
+    fi
+    prom_context
+    TSDB_PATH=$PROM_CONTEXT/prometheus
+    ETC_PROM=$PROM_CONTEXT/etc/prometheus
+    prometheus \
+        --web.console.templates=$ETC_PROM/consoles \
+        --web.console.libraries=$ETC_PROM/console_libraries \
+        --storage.tsdb.retention.time=10d \
+        --config.file=$ETC_PROM/config_out/prometheus.env.yaml \
+        --storage.tsdb.path=${TSDB_PATH}/ \
+        --web.enable-lifecycle \
+        --web.listen-address=127.0.0.1:${PROM_PORT:-9090} \
+        --web.route-prefix=/ \
+        --storage.tsdb.wal-compression \
+        --web.config.file=$ETC_PROM/web_config/web-config.yaml
+}
+
+function usage {
+    echo "./$(basename "$0") [OPTIONS]"
+    echo "Utilities related to fission dump analysis"
+    echo "
+Options:
+    -h              Show usage
+    -x [run_id]     Download and extract dump locally
+    -l [run_id]    List dump files for a run
+    -k [run_id]    List kind exports in a run
+
+    Following options required DUMP_CONTEXT variable set.
+
+    -i              Display dump info
+    -r              Find all race conditions in dump
+    -e              Find all errors in logs
+
+    Following options require PROM_CONTEXT to be set.
+
+    -p             Run prometheus with the dump"
+    exit 3
+}
+
+# list of arguments expected in the input
+optstring=":hxirlekp"
+
+if [[ ${#} -eq 0 ]]; then
+    usage
+fi
+
+while getopts ${optstring} arg; do
+    case ${arg} in
+    h)
+        echo "showing usage!"
+        usage
+        ;;
+    x)
+        RUN_ID=$2
+        if [ -z "$RUN_ID" ]; then
+            exit_error "run id not mentioned"
+        fi
+        extract
+        ;;
+    l)
+        RUN_ID=$2
+        if [ -z "$RUN_ID" ]; then
+            exit_error "run id not mentioned"
+        fi
+        list_context
+        ;;
+    i)
+        info
+        ;;
+    r)
+        race_conditions
+        ;;
+    e)
+        error_logs
+        ;;
+    k)
+        RUN_ID=$2
+        if [ -z "$RUN_ID" ]; then
+            exit_error "run id not mentioned"
+        fi
+        list_kind
+        ;;
+    p)
+        ARG_PROM_CONTEXT=$2
+        if [ ! -z "$ARG_PROM_CONTEXT" ]; then
+            PROM_CONTEXT=$ARG_PROM_CONTEXT
+        fi
+        prometheus_run
+        ;;
+    :)
+        echo "$0: Must supply an argument to -$OPTARG." >&2
+        exit 1
+        ;;
+    ?)
+        echo "Invalid option: -${OPTARG}."
+        exit 2
+        ;;
+    esac
+done

hack/dump-analyzer.md

@@ -0,0 +1,147 @@
+# Dump analyzer
+
+## Usage
+
+```text
+./hack/dump-analyzer -h
+showing usage!
+./dump-analyzer [OPTIONS]
+Utilities related to fission dump analysis
+
+Options:
+    -h              Show usage
+    -x [run_id]     Download and extract dump locally
+    -l [run_id]    List dump files for a run
+    -k [run_id]    List kind exports in a run
+
+    Following options required DUMP_CONTEXT variable set.
+
+    -i              Display dump info
+    -r              Find all race conditions in dump
+    -e              Find all errors in logs
+
+    Following options require PROM_CONTEXT to be set.
+
+    -p             Run prometheus with the dump
+
+```
+
+## Downloading dump
+
+```sh
+$ ./hack/dump-analyzer -x 3179903728
+! mkdir -p .dumps/3179903728
+.dumps/3179903728
+! gh run download 3179903728 -R fission/fission -D .dumps/3179903728
+! unzip -q .dumps/3179903728/fission-dump-3179903728-v1.19.16/fission-dump_1664866624.zip -d .dumps/3179903728/extract
+! unzip -q .dumps/3179903728/fission-dump-3179903728-v1.21.12/fission-dump_1664866628.zip -d .dumps/3179903728/extract
+! unzip -q .dumps/3179903728/fission-dump-3179903728-v1.20.15/fission-dump_1664866662.zip -d .dumps/3179903728/extract
+```
+
+## Check all dumps
+
+```sh
+./hack/dump-analyzer -l 3179903728
+==== .dumps/3179903728/extract/4b24c3db-b5d8-43a7-858d-48746530d29e2534094304 ====
+-- Fission Version --
+client:
+    Version: v0.0.0
+server:
+    Version: v0.0.0
+-- K8s Version --
+gitVersion: v1.21.12
+==== .dumps/3179903728/extract/e7febf06-79ce-4eb7-bba0-3fc66aa4bf542096519315 ====
+-- Fission Version --
+client:
+    Version: v0.0.0
+server:
+    Version: v0.0.0
+-- K8s Version --
+gitVersion: v1.19.16
+==== .dumps/3179903728/extract/3b339dc2-e9dd-4f7a-a721-41e16d9d248f4152710428 ====
+-- Fission Version --
+client:
+    Version: v0.0.0
+server:
+    Version: v0.0.0
+-- K8s Version --
+gitVersion: v1.20.15
+```
+
+We can see that the dump is from 3 different versions of k8s.
+To explore specific dump set `DUMP_CONTEXT` environment variable.
+
+```sh
+$ export DUMP_CONTEXT=.dumps/3179903728/extract/4b24c3db-b5d8-43a7-858d-48746530d29e2534094304
+
+$ ./hack/dump-analyzer -i
+Dump context: .dumps/3179903728/extract/4b24c3db-b5d8-43a7-858d-48746530d29e2534094304
+! cat .dumps/3179903728/extract/4b24c3db-b5d8-43a7-858d-48746530d29e2534094304/fission-version/fission-version.txt
+client:
+  fission/core:
+    BuildDate: "2022-10-04T06:28:54Z"
+    GitCommit: 9e74b01
+    Version: v0.0.0
+server:
+  fission/core:
+    BuildDate: "2022-10-04T06:29:01Z"
+    GitCommit: 9e74b01
+    Version: v0.0.0
+! cat .dumps/3179903728/extract/4b24c3db-b5d8-43a7-858d-48746530d29e2534094304/kubernetes-version/kubernetes-version.txt
+buildDate: "2022-05-19T20:02:29Z"
+compiler: gc
+gitCommit: 696a9fdd2a58340e61e0d815c5769d266fca0802
+gitTreeState: clean
+gitVersion: v1.21.12
+goVersion: go1.16.15
+major: "1"
+minor: "21"
+platform: linux/amd64
+
+# See all errors in the dump
+$ ./hack/dump-analyzer -e
+
+# If you want to see error in specific dump you can also grep
+
+$ grep -rin "string" $DUMP_CONTEXT
+
+# OR
+
+$ ack "string" $DUMP_CONTEXT
+```
+
+## Kind logs
+
+```sh
+ ./hack/dump-analyzer -k 3179903728
+==== .dumps/3179903728/kind-logs-3179903728-v1.20.15 ====
+kind v0.14.0 go1.18.2 linux/amd64
+
+==== .dumps/3179903728/kind-logs-3179903728-v1.19.16 ====
+kind v0.14.0 go1.18.2 linux/amd64
+
+==== .dumps/3179903728/kind-logs-3179903728-v1.21.12 ====
+kind v0.14.0 go1.18.2 linux/amd64
+```
+
+## Prometheus with dump
+
+```sh
+$ export PROM_CONTEXT=.dumps/3539792658/prom-dump-3539792658-v1.21.14
+$ ./hack/dump-analyzer -p
+# Visit localhost:9090
+```
+
+To pass dump path directly without setting PROM_CONTEXT,
+
+```sh
+$ ./hack/dump-analyzer -p .dumps/3539792658/prom-dump-3539792658-v1.21.14
+# Visit localhost:9090
+```
+
+You can also run prometheus with multiple dumps,
+
+```sh
+PROM_PORT=9091 ./hack/dump-analyzer -p .dumps/3539792658/prom-dump-3539792658-v1.21.14
+# Visit localhost:9091
+```

pkg/apis/core/v1/const.go

@@ -67,8 +67,8 @@ const (
 )
 
 const (
-	RuntimePodSpecConfigmap = "runtime-podspec-patch"
+	RuntimePodSpecPath = "/etc/fission/runtime-podspec-patch.yaml"
-	BuilderPodSpecConfigmap = "builder-podspec-patch"
+	BuilderPodSpecPath = "/etc/fission/builder-podspec-patch.yaml"
 )
 
 const (
@@ -146,12 +146,6 @@ const (
 const (
 	FissionBuilderSA = "fission-builder"
 	FissionFetcherSA = "fission-fetcher"
-
-	SecretConfigMapGetterRB = "secret-configmap-getter-binding"
-
-	PackageGetterRB = "package-getter-binding"
-
-	ClusterRole = "ClusterRole"
 )
 
 const (
@@ -164,3 +158,12 @@ const (
 	PackagesResource        = "packages"
 	TimeTriggerResource     = "timetriggers"
 )
+
+const (
+	Pods        = "pods"
+	Deployments = "deployments"
+	ReplicaSets = "replicasets"
+	Services    = "services"
+	ConfigMaps  = "configmaps"
+	Secrets     = "secrets"
+)

pkg/builder/builder.go

@@ -18,6 +18,7 @@ package builder
 
 import (
 	"bufio"
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -34,6 +35,7 @@ import (
 	"go.uber.org/zap"
 
 	"github.com/fission/fission/pkg/info"
+	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
 
 const (
@@ -72,10 +74,12 @@ func MakeBuilder(logger *zap.Logger, sharedVolumePath string) *Builder {
 }
 
 func (builder *Builder) VersionHandler(w http.ResponseWriter, r *http.Request) {
+	logger := otelUtils.LoggerWithTraceID(r.Context(), builder.logger)
+
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	_, err := w.Write([]byte(info.BuildInfo().String()))
 	if err != nil {
-		builder.logger.Error(
+		logger.Error(
 			"error writing response",
 			zap.Error(err),
 		)
@@ -83,38 +87,40 @@ func (builder *Builder) VersionHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
+	logger := otelUtils.LoggerWithTraceID(r.Context(), builder.logger)
+
 	if r.Method != "POST" {
 		e := "method not allowed"
-		builder.logger.Error(e, zap.String("http_method", r.Method))
+		logger.Error(e, zap.String("http_method", r.Method))
-		builder.reply(w, "", fmt.Sprintf("%s: %s", e, r.Method), http.StatusMethodNotAllowed)
+		builder.reply(r.Context(), w, "", fmt.Sprintf("%s: %s", e, r.Method), http.StatusMethodNotAllowed)
 		return
 	}
 
 	startTime := time.Now()
 	defer func() {
 		elapsed := time.Since(startTime)
-		builder.logger.Info("build request complete", zap.Duration("elapsed_time", elapsed))
+		logger.Info("build request complete", zap.Duration("elapsed_time", elapsed))
 	}()
 
 	// parse request
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		e := "error reading request body"
-		builder.logger.Error(e, zap.Error(err))
+		logger.Error(e, zap.Error(err))
-		builder.reply(w, "", fmt.Sprintf("%s: %s", e, err.Error()), http.StatusInternalServerError)
+		builder.reply(r.Context(), w, "", fmt.Sprintf("%s: %s", e, err.Error()), http.StatusInternalServerError)
 		return
 	}
 	var req PackageBuildRequest
 	err = json.Unmarshal(body, &req)
 	if err != nil {
 		e := "error parsing json body"
-		builder.logger.Error(e, zap.Error(err))
+		logger.Error(e, zap.Error(err))
-		builder.reply(w, "", fmt.Sprintf("%s: %s", e, err.Error()), http.StatusBadRequest)
+		builder.reply(r.Context(), w, "", fmt.Sprintf("%s: %s", e, err.Error()), http.StatusBadRequest)
 		return
 	}
-	builder.logger.Info("builder received request", zap.Any("request", req))
+	logger.Info("builder received request", zap.Any("request", req))
 
-	builder.logger.Debug("starting build")
+	logger.Debug("starting build")
 	srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
 	deployPkgFilename := fmt.Sprintf("%s-%s", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))
 	deployPkgPath := filepath.Join(builder.sharedVolumePath, deployPkgFilename)
@@ -134,21 +140,22 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
 			buildArgs = append(buildArgs, args[i])
 		}
 	}
-	buildLogs, err := builder.build(buildCmd, buildArgs, srcPkgPath, deployPkgPath)
+	buildLogs, err := builder.build(r.Context(), buildCmd, buildArgs, srcPkgPath, deployPkgPath)
 	if err != nil {
 		e := "error building source package"
-		builder.logger.Error(e, zap.Error(err))
+		logger.Error(e, zap.Error(err))
 
 		// append error at the end of build logs
 		buildLogs += fmt.Sprintf("%s: %s\n", e, err.Error())
-		builder.reply(w, deployPkgFilename, buildLogs, http.StatusInternalServerError)
+		builder.reply(r.Context(), w, deployPkgFilename, buildLogs, http.StatusInternalServerError)
 		return
 	}
 
-	builder.reply(w, deployPkgFilename, buildLogs, http.StatusOK)
+	builder.reply(r.Context(), w, deployPkgFilename, buildLogs, http.StatusOK)
 }
 
-func (builder *Builder) reply(w http.ResponseWriter, pkgFilename string, buildLogs string, statusCode int) {
+func (builder *Builder) reply(ctx context.Context, w http.ResponseWriter, pkgFilename string, buildLogs string, statusCode int) {
+	logger := otelUtils.LoggerWithTraceID(ctx, builder.logger)
 	resp := PackageBuildResponse{
 		ArtifactFilename: pkgFilename,
 		BuildLogs:        buildLogs,
@@ -167,14 +174,16 @@ func (builder *Builder) reply(w http.ResponseWriter, pkgFilename string, buildLo
 	w.WriteHeader(statusCode)
 	_, err = w.Write(rBody)
 	if err != nil {
-		builder.logger.Error(
+		logger.Error(
 			"error writing response",
 			zap.Error(err),
 		)
 	}
 }
 
-func (builder *Builder) build(command string, args []string, srcPkgPath string, deployPkgPath string) (string, error) {
+func (builder *Builder) build(ctx context.Context, command string, args []string, srcPkgPath string, deployPkgPath string) (string, error) {
+	logger := otelUtils.LoggerWithTraceID(ctx, builder.logger)
+
 	cmd := exec.Command(command, args...)
 
 	fi, err := os.Stat(srcPkgPath)
@@ -204,7 +213,7 @@ func (builder *Builder) build(command string, args []string, srcPkgPath string,
 	}
 
 	// Init logs
-	builder.logger.Info("building source package", zap.String("command", command), zap.Strings("args", args), zap.Strings("env", cmd.Env))
+	logger.Info("building source package", zap.String("command", command), zap.Strings("args", args), zap.Strings("env", cmd.Env))
 
 	out := io.MultiReader(stdout, stderr)
 	scanner := bufio.NewScanner(out)

pkg/buildermgr/buildermgr.go

@@ -22,8 +22,6 @@ import (
 
 	"github.com/pkg/errors"
 	"go.uber.org/zap"
-	apiv1 "k8s.io/api/core/v1"
-	k8sInformers "k8s.io/client-go/informers"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/crd"
@@ -36,9 +34,14 @@ import (
 func Start(ctx context.Context, logger *zap.Logger, storageSvcUrl string) error {
 	bmLogger := logger.Named("builder_manager")
 
-	fissionClient, kubernetesClient, _, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission or kubernetes client")
+		return errors.Wrap(err, "failed to get fission client")
+	}
+	kubernetesClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return errors.Wrap(err, "failed to get kubernetes client")
 	}
 
 	err = crd.WaitForCRDs(ctx, logger, fissionClient)
@@ -51,24 +54,17 @@ func Start(ctx context.Context, logger *zap.Logger, storageSvcUrl string) error
 		return errors.Wrap(err, "error making fetcher config")
 	}
 
-	var podSpecPatch *apiv1.PodSpec
+	podSpecPatch, err := util.GetSpecFromConfigMap(fv1.BuilderPodSpecPath)
-	namespace, err := utils.GetCurrentNamespace()
 	if err != nil {
-		logger.Warn("Current namespace not found %v", zap.Error(err))
+		logger.Warn("error reading data for pod spec patch", zap.String("path", fv1.BuilderPodSpecPath), zap.Error(err))
-	} else {
-		podSpecPatch, err = util.GetSpecFromConfigMap(ctx, kubernetesClient, fv1.BuilderPodSpecConfigmap, namespace)
-		if err != nil {
-			logger.Warn("Either configmap is not found or error reading data %v", zap.Error(err))
-		}
 	}
 
 	envWatcher := makeEnvironmentWatcher(ctx, bmLogger, fissionClient, kubernetesClient, fetcherConfig, podSpecPatch)
 	envWatcher.Run(ctx)
 
-	k8sInformerFactory := k8sInformers.NewSharedInformerFactory(kubernetesClient, time.Minute*30)
-	podInformer := k8sInformerFactory.Core().V1().Pods().Informer()
 	pkgWatcher := makePackageWatcher(bmLogger, fissionClient,
-		kubernetesClient, storageSvcUrl, podInformer,
+		kubernetesClient, storageSvcUrl,
+		utils.GetK8sInformersForNamespaces(kubernetesClient, time.Minute*30, fv1.Pods),
 		utils.GetInformersForNamespaces(fissionClient, time.Minute*30, fv1.PackagesResource))
 	pkgWatcher.Run(ctx)
 	return nil

pkg/buildermgr/envwatcher.go

@@ -268,12 +268,6 @@ func (envw *environmentWatcher) createBuilder(ctx context.Context, env *fv1.Envi
 	}
 	// there should be only one deploy in deployList
 	if len(deployList) == 0 {
-		// create builder SA in this ns, if not already created
-		_, err := utils.SetupSA(ctx, envw.kubernetesClient, fv1.FissionBuilderSA, ns)
-		if err != nil {
-			return nil, errors.Wrapf(err, "error creating %q in ns: %s", fv1.FissionBuilderSA, ns)
-		}
-
 		deploy, err = envw.createBuilderDeployment(ctx, env, ns)
 		if err != nil {
 			return nil, errors.Wrap(err, fmt.Sprintf("error creating builder deployment for environment in namespace %s %s", env.ObjectMeta.Name, ns))

pkg/buildermgr/pkgwatcher.go

@@ -41,7 +41,7 @@ type (
 		fissionClient versioned.Interface
 		nsResolver    *utils.NamespaceResolver
 		k8sClient     kubernetes.Interface
-		podInformer   k8sCache.SharedIndexInformer
+		podInformer   map[string]k8sCache.SharedIndexInformer
 		pkgInformer   map[string]k8sCache.SharedIndexInformer
 		storageSvcUrl string
 		buildCache    *cache.Cache
@@ -49,7 +49,7 @@ type (
 )
 
 func makePackageWatcher(logger *zap.Logger, fissionClient versioned.Interface, k8sClientSet kubernetes.Interface,
-	storageSvcUrl string, podInformer k8sCache.SharedIndexInformer,
+	storageSvcUrl string, podInformer,
 	pkgInformer map[string]k8sCache.SharedIndexInformer) *packageWatcher {
 	pkgw := &packageWatcher{
 		logger:        logger.Named("package_watcher"),
@@ -64,6 +64,20 @@ func makePackageWatcher(logger *zap.Logger, fissionClient versioned.Interface, k
 	return pkgw
 }
 
+func (pkgw *packageWatcher) buildCacheKey(obj metav1.ObjectMeta) string {
+	return fmt.Sprintf("%s-%s-%s", obj.Namespace, obj.Name, obj.ResourceVersion)
+}
+
+func (pkgw *packageWatcher) buildWithCache(ctx context.Context, srcpkg *fv1.Package) {
+	// Ignore duplicate build requests
+	_, err := pkgw.buildCache.Set(pkgw.buildCacheKey(srcpkg.ObjectMeta), srcpkg)
+	if err != nil {
+		pkgw.logger.Info("package build cache set error", zap.Error(err))
+		return
+	}
+	go pkgw.build(ctx, srcpkg)
+}
+
 // build helps to update package status, checks environment builder pod status and
 // dispatches buildPackage to build source package into deployment package.
 // Following is the steps build function takes to complete the whole process.
@@ -75,13 +89,8 @@ func makePackageWatcher(logger *zap.Logger, fissionClient versioned.Interface, k
 // 6. Update package status to succeed state
 // *. Update package status to failed state,if any one of steps above failed/time out
 func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
-	// Ignore duplicate build requests
-	key := fmt.Sprintf("%v-%v", srcpkg.ObjectMeta.Name, srcpkg.ObjectMeta.ResourceVersion)
-	_, err := pkgw.buildCache.Set(key, srcpkg)
-	if err != nil {
-		return
-	}
 	defer func() {
+		key := pkgw.buildCacheKey(srcpkg.ObjectMeta)
 		err := pkgw.buildCache.Delete(key)
 		if err != nil {
 			pkgw.logger.Error("error deleting key from cache", zap.String("key", key), zap.Error(err))
@@ -115,6 +124,8 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 
 	// Create a new BackOff for health check on environment builder pod
 	healthCheckBackOff := utils.NewDefaultBackOff()
+	builderNs := pkgw.nsResolver.GetBuilderNS(env.ObjectMeta.Namespace)
+
 	//if err != nil {
 	//	pkgw.logger.Error("Unable to create BackOff for Health Check", zap.Error(err))
 	//}
@@ -122,7 +133,7 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 	for healthCheckBackOff.NextExists() {
 		// Informer store is not able to use label to find the pod,
 		// iterate all available environment builders.
-		items := pkgw.podInformer.GetStore().List()
+		items := pkgw.podInformer[builderNs].GetStore().List()
 		if err != nil {
 			pkgw.logger.Error("error retrieving pod information for environment", zap.Error(err), zap.String("environment", env.ObjectMeta.Name))
 			return
@@ -137,8 +148,6 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 		for _, item := range items {
 			pod := item.(*apiv1.Pod)
 
-			builderNs := pkgw.nsResolver.GetBuilderNS(env.ObjectMeta.Namespace)
-
 			// Filter non-matching pods
 			if pod.ObjectMeta.Labels[LABEL_ENV_NAME] != env.ObjectMeta.Name ||
 				pod.ObjectMeta.Labels[LABEL_ENV_NAMESPACE] != builderNs ||
@@ -160,23 +169,6 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 				break
 			}
 
-			// Add the package getter rolebinding to builder sa
-			// we continue here if role binding was not setup successfully. this is because without this, the fetcher won't be able to fetch the source pkg into the container and
-			// the build will fail eventually
-			err := utils.SetupRoleBinding(ctx, pkgw.logger, pkgw.k8sClient, fv1.PackageGetterRB, pkg.ObjectMeta.Namespace, utils.GetPackageGetterCR(), fv1.ClusterRole, fv1.FissionBuilderSA, builderNs)
-			if err != nil {
-				pkgw.logger.Error("error setting up role binding for package",
-					zap.Error(err),
-					zap.String("role_binding", fv1.PackageGetterRB),
-					zap.String("package_name", pkg.ObjectMeta.Name),
-					zap.String("package_namespace", pkg.ObjectMeta.Namespace))
-				continue
-			} else {
-				pkgw.logger.Info("setup rolebinding for sa package",
-					zap.String("sa", fmt.Sprintf("%s.%s", fv1.FissionBuilderSA, builderNs)),
-					zap.String("package", fmt.Sprintf("%s.%s", pkg.ObjectMeta.Name, pkg.ObjectMeta.Namespace)))
-			}
-
 			uploadResp, buildLogs, err := buildPackage(ctx, pkgw.logger, pkgw.fissionClient, builderNs, pkgw.storageSvcUrl, pkg)
 			if err != nil {
 				pkgw.logger.Error("error building package", zap.Error(err), zap.String("package_name", pkg.ObjectMeta.Name))
@@ -290,7 +282,7 @@ func (pkgw *packageWatcher) packageInformerHandler(ctx context.Context) k8sCache
 		}
 		// Only build pending state packages.
 		if pkg.Status.BuildStatus == fv1.BuildStatusPending {
-			go pkgw.build(ctx, pkg)
+			pkgw.buildWithCache(ctx, pkg)
 		}
 	}
 	return k8sCache.ResourceEventHandlerFuncs{
@@ -318,7 +310,9 @@ func (pkgw *packageWatcher) packageInformerHandler(ctx context.Context) k8sCache
 
 func (pkgw *packageWatcher) Run(ctx context.Context) {
 	go metrics.ServeMetrics(ctx, pkgw.logger)
-	go pkgw.podInformer.Run(ctx.Done())
+	for _, podInformer := range pkgw.podInformer {
+		go podInformer.Run(ctx.Done())
+	}
 	for _, pkgInformer := range pkgw.pkgInformer {
 		pkgInformer.AddEventHandler(pkgw.packageInformerHandler(ctx))
 		go pkgInformer.Run(ctx.Done())

pkg/canaryconfigmgr/canaryConfigMgr.go

@@ -555,12 +555,17 @@ func getEnvValue(envVar string) string {
 func StartCanaryServer(ctx context.Context, logger *zap.Logger, unitTestFlag bool) error {
 	cLogger := logger.Named("CanaryServer")
 
-	fc, kc, _, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		cLogger.Fatal("failed to connect to k8s API", zap.Error(err))
+		return errors.Wrap(err, "failed to get fission client")
+	}
+	kubernetesClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return errors.Wrap(err, "failed to get kubernetes client")
 	}
 
-	err = ConfigureFeatures(ctx, cLogger, unitTestFlag, fc, kc)
+	err = ConfigureFeatures(ctx, cLogger, unitTestFlag, fissionClient, kubernetesClient)
 	if err != nil {
 		cLogger.Error("error configuring features - proceeding without optional features", zap.Error(err))
 	}

pkg/controller/api.go

@@ -68,8 +68,8 @@ type (
 	}
 )
 
-func MakeAPI(logger *zap.Logger) (*API, error) {
+func MakeAPI(logger *zap.Logger, fissionClient versioned.Interface, kubernetesClient kubernetes.Interface) (*API, error) {
-	api, err := makeCRDBackedAPI(logger)
+	api, err := makeCRDBackedAPI(logger, fissionClient, kubernetesClient)
 
 	u := os.Getenv("STORAGE_SERVICE_URL")
 	if len(u) > 0 {

pkg/controller/api_test.go

@@ -503,7 +503,8 @@ func TestMain(m *testing.M) {
 		return
 	}
 
-	_, kubeClient, _, _, err := crd.GetKubernetesClient()
+	clientGen := crd.NewClientGenerator()
+	kubeClient, err := clientGen.GetKubernetesClient()
 	panicIf(err)
 
 	// testNS isolation for running multiple CI builds concurrently.

pkg/controller/controller.go

@@ -27,9 +27,18 @@ import (
 func Start(ctx context.Context, logger *zap.Logger, port int, unitTestFlag bool) {
 	cLogger := logger.Named("controller")
 
-	fc, _, apiExtClient, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		cLogger.Fatal("failed to connect to k8s API", zap.Error(err))
+		cLogger.Fatal("failed to get fission client", zap.Error(err))
+	}
+	apiExtClient, err := clientGen.GetApiExtensionsClient()
+	if err != nil {
+		cLogger.Fatal("failed to get api extension client client", zap.Error(err))
+	}
+	kubeClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		cLogger.Fatal("failed to get kubernetes client", zap.Error(err))
 	}
 
 	err = crd.EnsureFissionCRDs(ctx, cLogger, apiExtClient)
@@ -37,12 +46,12 @@ func Start(ctx context.Context, logger *zap.Logger, port int, unitTestFlag bool)
 		cLogger.Fatal("failed to find fission CRDs", zap.Error(err))
 	}
 
-	err = crd.WaitForCRDs(ctx, logger, fc)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		cLogger.Fatal("error waiting for CRDs", zap.Error(err))
 	}
 
-	api, err := MakeAPI(cLogger)
+	api, err := MakeAPI(cLogger, fissionClient, kubeClient)
 	if err != nil {
 		cLogger.Fatal("failed to start controller", zap.Error(err))
 	}

pkg/controller/crd.go

@@ -18,15 +18,12 @@ package controller
 
 import (
 	"go.uber.org/zap"
+	"k8s.io/client-go/kubernetes"
 
-	"github.com/fission/fission/pkg/crd"
+	"github.com/fission/fission/pkg/generated/clientset/versioned"
 )
 
-func makeCRDBackedAPI(logger *zap.Logger) (*API, error) {
+func makeCRDBackedAPI(logger *zap.Logger, fissionClient versioned.Interface, kubernetesClient kubernetes.Interface) (*API, error) {
-	fissionClient, kubernetesClient, _, _, err := crd.MakeFissionClient()
-	if err != nil {
-		return nil, err
-	}
 	return &API{
 		logger:           logger.Named("api"),
 		fissionClient:    fissionClient,

pkg/crd/client.go

@@ -19,7 +19,6 @@ package crd
 import (
 	"context"
 	"errors"
-	"os"
 	"time"
 
 	"go.uber.org/zap"
@@ -29,71 +28,88 @@ import (
 	"k8s.io/client-go/kubernetes"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
 	metricsclient "k8s.io/metrics/pkg/client/clientset/versioned"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
 
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
+	"github.com/fission/fission/pkg/utils"
 )
 
-// GetKubernetesClient gets a kubernetes client using the kubeconfig file at the
+type ClientGenerator struct {
-// environment var $KUBECONFIG, or an in-cluster config if that's
+	restConfig *rest.Config
-// undefined.
-func GetKubernetesClient() (*rest.Config, kubernetes.Interface, apiextensionsclient.Interface, metricsclient.Interface, error) {
-	var config *rest.Config
-	var err error
-
-	// get the config, either from kubeconfig or using our
-	// in-cluster service account
-	kubeConfig := os.Getenv("KUBECONFIG")
-	if len(kubeConfig) != 0 {
-		config, err = clientcmd.BuildConfigFromFlags("", kubeConfig)
-		if err != nil {
-			return nil, nil, nil, nil, err
-		}
-	} else {
-		config, err = rest.InClusterConfig()
-		if err != nil {
-			return nil, nil, nil, nil, err
-		}
-	}
-
-	// creates the clientset
-	clientset, err := kubernetes.NewForConfig(config)
-	if err != nil {
-		return nil, nil, nil, nil, err
-	}
-
-	apiExtClientset, err := apiextensionsclient.NewForConfig(config)
-	if err != nil {
-		return nil, nil, nil, nil, err
-	}
-
-	metricsClient, _ := metricsclient.NewForConfig(config)
-
-	return config, clientset, apiExtClientset, metricsClient, nil
 }
 
-func MakeFissionClient() (versioned.Interface, kubernetes.Interface, apiextensionsclient.Interface, metricsclient.Interface, error) {
+func (cg *ClientGenerator) getRestConfig() (*rest.Config, error) {
-	config, kubeClient, apiExtClient, metricsClient, err := GetKubernetesClient()
+	if cg.restConfig != nil {
-	if err != nil {
+		return cg.restConfig, nil
-		return nil, nil, nil, nil, err
 	}
 
-	// make a CRD REST client with the config
+	var err error
-	crdClient, err := versioned.NewForConfig(config)
+	cg.restConfig, err = config.GetConfig()
 	if err != nil {
-		return nil, nil, nil, nil, err
+		return nil, err
 	}
+	return cg.restConfig, nil
+}
 
-	return crdClient, kubeClient, apiExtClient, metricsClient, nil
+func (cg *ClientGenerator) GetFissionClient() (versioned.Interface, error) {
+	config, err := cg.getRestConfig()
+	if err != nil {
+		return nil, err
+	}
+	return versioned.NewForConfig(config)
+}
+
+func (cg *ClientGenerator) GetKubernetesClient() (kubernetes.Interface, error) {
+	config, err := cg.getRestConfig()
+	if err != nil {
+		return nil, err
+	}
+	return kubernetes.NewForConfig(config)
+}
+
+func (cg *ClientGenerator) GetApiExtensionsClient() (apiextensionsclient.Interface, error) {
+	config, err := cg.getRestConfig()
+	if err != nil {
+		return nil, err
+	}
+	return apiextensionsclient.NewForConfig(config)
+}
+
+func (cg *ClientGenerator) GetMetricsClient() (metricsclient.Interface, error) {
+	config, err := cg.getRestConfig()
+	if err != nil {
+		return nil, err
+	}
+	return metricsclient.NewForConfig(config)
+}
+
+func (cg *ClientGenerator) GetDynamicClient() (dynamic.Interface, error) {
+	config, err := cg.getRestConfig()
+	if err != nil {
+		return nil, err
+	}
+	return dynamic.NewForConfig(config)
+}
+
+func NewClientGenerator() *ClientGenerator {
+	return &ClientGenerator{}
+}
+
+func NewClientGeneratorWithRestConfig(restConfig *rest.Config) *ClientGenerator {
+	return &ClientGenerator{restConfig: restConfig}
 }
 
 // WaitForCRDs does a timeout to check if CRDs have been installed
 func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error {
 	logger.Info("Waiting for CRDs to be installed")
+	defaultNs := utils.DefaultNSResolver().DefaultNamespace
+	if defaultNs == "" {
+		defaultNs = metav1.NamespaceDefault
+	}
 	start := time.Now()
 	for {
-		fi := fissionClient.CoreV1().Functions(metav1.NamespaceDefault)
+		fi := fissionClient.CoreV1().Functions(defaultNs)
 		_, err := fi.List(ctx, metav1.ListOptions{})
 		if err != nil {
 			time.Sleep(100 * time.Millisecond)
@@ -106,29 +122,3 @@ func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versione
 		}
 	}
 }
-
-// GetDynamicClient creates and returns new dynamic client or returns an error
-func GetDynamicClient() (dynamic.Interface, error) {
-	var config *rest.Config
-	var err error
-
-	// get the config, either from kubeconfig or using our
-	// in-cluster service account
-	kubeConfig := os.Getenv("KUBECONFIG")
-	if len(kubeConfig) != 0 {
-		config, err = clientcmd.BuildConfigFromFlags("", kubeConfig)
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		config, err = rest.InClusterConfig()
-		if err != nil {
-			return nil, err
-		}
-	}
-	dynamicClient, err := dynamic.NewForConfig(config)
-	if err != nil {
-		return nil, err
-	}
-	return dynamicClient, nil
-}

pkg/executor/cms/cmscontroller.go

@@ -21,8 +21,8 @@ import (
 
 	"github.com/pkg/errors"
 	"go.uber.org/zap"
-	informerv1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/executor/executortype"
@@ -41,18 +41,18 @@ type (
 // MakeConfigSecretController makes a controller for configmaps and secrets which changes related functions
 func MakeConfigSecretController(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface,
 	kubernetesClient kubernetes.Interface, types map[fv1.ExecutorType]executortype.ExecutorType,
-	configmapInformer map[string]informerv1.ConfigMapInformer,
+	configmapInformer,
-	secretInformer map[string]informerv1.SecretInformer) *ConfigSecretController {
+	secretInformer map[string]cache.SharedIndexInformer) *ConfigSecretController {
 	logger.Debug("Creating ConfigMap & Secret Controller")
 	cmsController := &ConfigSecretController{
 		logger:        logger,
 		fissionClient: fissionClient,
 	}
 	for _, informer := range configmapInformer {
-		informer.Informer().AddEventHandler(ConfigMapEventHandlers(ctx, logger, fissionClient, kubernetesClient, types))
+		informer.AddEventHandler(ConfigMapEventHandlers(ctx, logger, fissionClient, kubernetesClient, types))
 	}
 	for _, informer := range secretInformer {
-		informer.Informer().AddEventHandler(SecretEventHandlers(ctx, logger, fissionClient, kubernetesClient, types))
+		informer.AddEventHandler(SecretEventHandlers(ctx, logger, fissionClient, kubernetesClient, types))
 	}
 
 	return cmsController

pkg/executor/executor.go

@@ -28,9 +28,6 @@ import (
 	"github.com/dchest/uniuri"
 	"github.com/pkg/errors"
 	"go.uber.org/zap"
-	apiv1 "k8s.io/api/core/v1"
-	k8sInformers "k8s.io/client-go/informers"
-	k8sInformersv1 "k8s.io/client-go/informers/core/v1"
 	k8sCache "k8s.io/client-go/tools/cache"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -41,12 +38,10 @@ import (
 	"github.com/fission/fission/pkg/executor/executortype/newdeploy"
 	"github.com/fission/fission/pkg/executor/executortype/poolmgr"
 	"github.com/fission/fission/pkg/executor/fscache"
-	"github.com/fission/fission/pkg/executor/reaper"
 	"github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
 	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/metrics"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
@@ -256,9 +251,18 @@ func (executor *Executor) getFunctionServiceFromCache(ctx context.Context, fn *f
 // StartExecutor Starts executor and the executor components such as Poolmgr,
 // deploymgr and potential future executor types
 func StartExecutor(ctx context.Context, logger *zap.Logger, port int) error {
-	fissionClient, kubernetesClient, _, metricsClient, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get kubernetes client")
+		return errors.Wrap(err, "error making the fission client")
+	}
+	kubernetesClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return errors.Wrap(err, "error making the kube client")
+	}
+	metricsClient, err := clientGen.GetMetricsClient()
+	if err != nil {
+		logger.Error("error making the metrics client", zap.Error(err))
 	}
 
 	err = crd.WaitForCRDs(ctx, logger, fissionClient)
@@ -273,73 +277,58 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, port int) error {
 
 	executorInstanceID := strings.ToLower(uniuri.NewLen(8))
 
-	var podSpecPatch *apiv1.PodSpec
+	podSpecPatch, err := util.GetSpecFromConfigMap(fv1.RuntimePodSpecPath)
-	namespace, err := utils.GetCurrentNamespace()
 	if err != nil {
-		logger.Warn("Current namespace not found %s", zap.Error(err))
+		logger.Warn("error reading data for pod spec patch", zap.String("path", fv1.RuntimePodSpecPath), zap.Error(err))
-	} else {
-		podSpecPatch, err = util.GetSpecFromConfigMap(ctx, kubernetesClient, fv1.RuntimePodSpecConfigmap, namespace)
-		if err != nil {
-			logger.Warn("Either configmap is not found or error reading data %v", zap.Error(err))
-		}
 	}
 
 	logger.Info("Starting executor", zap.String("instanceID", executorInstanceID))
 
-	funcInformer := make(map[string]finformerv1.FunctionInformer, 0)
+	finformerFactory := make(map[string]genInformer.SharedInformerFactory, 0)
-	envInformer := make(map[string]finformerv1.EnvironmentInformer, 0)
+	for _, ns := range utils.DefaultNSResolver().FissionResourceNS {
-	pkgInformer := make(map[string]finformerv1.PackageInformer, 0)
+		finformerFactory[ns] = genInformer.NewFilteredSharedInformerFactory(fissionClient, time.Minute*30, ns, nil)
-
-	for _, ns := range utils.GetNamespaces() {
-		factory := genInformer.NewFilteredSharedInformerFactory(fissionClient, time.Minute*30, ns, nil)
-		funcInformer[ns] = factory.Core().V1().Functions()
-		envInformer[ns] = factory.Core().V1().Environments()
-		pkgInformer[ns] = factory.Core().V1().Packages()
 	}
 
-	gpmInformerFactory, err := utils.GetInformerFactoryByExecutor(kubernetesClient, fv1.ExecutorTypePoolmgr, time.Minute*30)
+	executorLabel, err := utils.GetInformerLabelByExecutor(fv1.ExecutorTypePoolmgr)
 	if err != nil {
 		return err
 	}
-	gpmPodInformer := gpmInformerFactory.Core().V1().Pods()
+	gpmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)
-	gpmRsInformer := gpmInformerFactory.Apps().V1().ReplicaSets()
 	gpm, err := poolmgr.MakeGenericPoolManager(ctx,
 		logger,
 		fissionClient, kubernetesClient, metricsClient,
 		fetcherConfig, executorInstanceID,
-		funcInformer, pkgInformer, envInformer,
+		finformerFactory,
-		gpmPodInformer, gpmRsInformer, podSpecPatch)
+		gpmInformerFactory, podSpecPatch)
 	if err != nil {
 		return errors.Wrap(err, "pool manager creation failed")
 	}
 
-	ndmInformerFactory, err := utils.GetInformerFactoryByExecutor(kubernetesClient, fv1.ExecutorTypeNewdeploy, time.Minute*30)
+	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeNewdeploy)
 	if err != nil {
 		return err
 	}
-	ndmDeplInformer := ndmInformerFactory.Apps().V1().Deployments()
+	ndmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)
-	ndmSvcInformer := ndmInformerFactory.Core().V1().Services()
 	ndm, err := newdeploy.MakeNewDeploy(ctx,
 		logger,
 		fissionClient, kubernetesClient,
 		fetcherConfig, executorInstanceID,
-		funcInformer, envInformer,
+		finformerFactory,
-		ndmDeplInformer, ndmSvcInformer, podSpecPatch)
+		ndmInformerFactory, podSpecPatch)
 	if err != nil {
 		return errors.Wrap(err, "new deploy manager creation failed")
 	}
 
-	cnmInformerFactory, err := utils.GetInformerFactoryByExecutor(kubernetesClient, fv1.ExecutorTypeContainer, time.Minute*30)
+	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeContainer)
 	if err != nil {
 		return err
 	}
-	cnmDeplInformer := cnmInformerFactory.Apps().V1().Deployments()
+	cnmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)
-	cnmSvcInformer := cnmInformerFactory.Core().V1().Services()
 	cnm, err := container.MakeContainer(
 		ctx, logger,
 		fissionClient, kubernetesClient,
-		executorInstanceID, funcInformer,
+		executorInstanceID, finformerFactory,
-		cnmDeplInformer, cnmSvcInformer)
+		cnmInformerFactory)
 	if err != nil {
 		return errors.Wrap(err, "container manager creation failed")
 	}
@@ -366,42 +355,30 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, port int) error {
 	// TODO: use context to control the waiting time once kubernetes client supports it.
 	util.WaitTimeout(wg, 30*time.Second)
 
-	configMapInformer := make(map[string]k8sInformersv1.ConfigMapInformer, 0)
+	configMapInformer := utils.GetK8sInformersForNamespaces(kubernetesClient, time.Minute*30, fv1.ConfigMaps)
-	secretInformer := make(map[string]k8sInformersv1.SecretInformer, 0)
+	secretInformer := utils.GetK8sInformersForNamespaces(kubernetesClient, time.Minute*30, fv1.Secrets)
-
-	for _, ns := range utils.GetNamespaces() {
-		factory := k8sInformers.NewFilteredSharedInformerFactory(kubernetesClient, time.Minute*30, ns, nil)
-		configMapInformer[ns] = factory.Core().V1().ConfigMaps()
-		secretInformer[ns] = factory.Core().V1().Secrets()
-	}
-
 	cms := cms.MakeConfigSecretController(ctx, logger, fissionClient, kubernetesClient, executorTypes, configMapInformer, secretInformer)
 
 	fissionInformers := make([]k8sCache.SharedIndexInformer, 0)
-	for _, informer := range funcInformer {
-		fissionInformers = append(fissionInformers, informer.Informer())
-	}
-	for _, informer := range envInformer {
-		fissionInformers = append(fissionInformers, informer.Informer())
-	}
-	for _, informer := range pkgInformer {
-		fissionInformers = append(fissionInformers, informer.Informer())
-	}
 	for _, informer := range configMapInformer {
-		fissionInformers = append(fissionInformers, informer.Informer())
+		fissionInformers = append(fissionInformers, informer)
 	}
 	for _, informer := range secretInformer {
-		fissionInformers = append(fissionInformers, informer.Informer())
+		fissionInformers = append(fissionInformers, informer)
+	}
+	for _, factory := range finformerFactory {
+		factory.Start(ctx.Done())
+	}
+	for _, informerFactory := range gpmInformerFactory {
+		informerFactory.Start(ctx.Done())
+	}
+	for _, informerFactory := range ndmInformerFactory {
+		informerFactory.Start(ctx.Done())
+	}
+	for _, informerFactory := range cnmInformerFactory {
+		informerFactory.Start(ctx.Done())
 	}
 
-	fissionInformers = append(fissionInformers,
-		gpmPodInformer.Informer(),
-		gpmRsInformer.Informer(),
-		ndmDeplInformer.Informer(),
-		ndmSvcInformer.Informer(),
-		cnmDeplInformer.Informer(),
-		cnmSvcInformer.Informer(),
-	)
 	api, err := MakeExecutor(ctx, logger, cms, fissionClient, executorTypes,
 		fissionInformers...,
 	)
@@ -409,7 +386,8 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, port int) error {
 		return err
 	}
 
-	go reaper.CleanupRoleBindings(ctx, logger, kubernetesClient, fissionClient, time.Minute*30)
+	utils.CreateMissingPermissionForSA(ctx, kubernetesClient, logger)
+
 	go metrics.ServeMetrics(ctx, logger)
 	go api.Serve(ctx, port)
 

pkg/executor/executor_test.go

@@ -115,9 +115,18 @@ func TestExecutor(t *testing.T) {
 
 	// connect to k8s
 	// and get CRD client
-	fissionClient, kubeClient, apiExtClient, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		log.Panicf("failed to connect: %v", err)
+		log.Panicf("failed to connect: %s", err)
+	}
+	kubeClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		log.Panicf("failed to connect: %s", err)
+	}
+	apiExtClient, err := clientGen.GetApiExtensionsClient()
+	if err != nil {
+		log.Panicf("failed to connect: %s", err)
 	}
 
 	ctx := context.Background()

pkg/executor/executortype/container/containermgr.go

@@ -35,8 +35,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	k8sTypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
-	appsinformers "k8s.io/client-go/informers/apps/v1"
+	k8sInformers "k8s.io/client-go/informers"
-	coreinformers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
 	appslisters "k8s.io/client-go/listers/apps/v1"
 	corelisters "k8s.io/client-go/listers/core/v1"
@@ -50,7 +49,7 @@ import (
 	executorUtils "github.com/fission/fission/pkg/executor/util"
 	hpautils "github.com/fission/fission/pkg/executor/util/hpa"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/throttler"
 	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/maps"
@@ -81,11 +80,11 @@ type (
 
 		defaultIdlePodReapTime time.Duration
 
-		deplLister appslisters.DeploymentLister
+		deplLister map[string]appslisters.DeploymentLister
-		svcLister  corelisters.ServiceLister
+		svcLister  map[string]corelisters.ServiceLister
 
-		deplListerSynced k8sCache.InformerSynced
+		deplListerSynced map[string]k8sCache.InformerSynced
-		svcListerSynced  k8sCache.InformerSynced
+		svcListerSynced  map[string]k8sCache.InformerSynced
 
 		hpaops                     *hpautils.HpaOperations
 		objectReaperIntervalSecond time.Duration
@@ -99,9 +98,8 @@ func MakeContainer(
 	fissionClient versioned.Interface,
 	kubernetesClient kubernetes.Interface,
 	instanceID string,
-	funcInformer map[string]finformerv1.FunctionInformer,
+	finformerFactory map[string]genInformer.SharedInformerFactory,
-	deplInformer appsinformers.DeploymentInformer,
+	cnmInformerFactory map[string]k8sInformers.SharedInformerFactory,
-	svcInformer coreinformers.ServiceInformer,
 ) (executortype.ExecutorType, error) {
 	enableIstio := false
 	if len(os.Getenv("ENABLE_ISTIO")) > 0 {
@@ -129,23 +127,35 @@ func MakeContainer(
 		defaultIdlePodReapTime:     1 * time.Minute,
 		objectReaperIntervalSecond: time.Duration(executorUtils.GetObjectReaperInterval(logger, fv1.ExecutorTypeContainer, 5)) * time.Second,
 		hpaops:                     hpautils.NewHpaOperations(logger, kubernetesClient, instanceID),
+		deplLister:                 make(map[string]appslisters.DeploymentLister),
+		deplListerSynced:           make(map[string]k8sCache.InformerSynced),
+		svcLister:                  make(map[string]corelisters.ServiceLister),
+		svcListerSynced:            make(map[string]k8sCache.InformerSynced),
 	}
 
-	caaf.deplLister = deplInformer.Lister()
+	for ns, informerFactory := range cnmInformerFactory {
-	caaf.deplListerSynced = deplInformer.Informer().HasSynced
+		caaf.deplLister[ns] = informerFactory.Apps().V1().Deployments().Lister()
-
+		caaf.deplListerSynced[ns] = informerFactory.Apps().V1().Deployments().Informer().HasSynced
-	caaf.svcLister = svcInformer.Lister()
+		caaf.svcLister[ns] = informerFactory.Core().V1().Services().Lister()
-	caaf.svcListerSynced = svcInformer.Informer().HasSynced
+		caaf.svcListerSynced[ns] = informerFactory.Core().V1().Services().Informer().HasSynced
-
+	}
-	for _, informer := range funcInformer {
+	for _, factory := range finformerFactory {
-		informer.Informer().AddEventHandler(caaf.FuncInformerHandler(ctx))
+		factory.Core().V1().Functions().Informer().AddEventHandler(caaf.FuncInformerHandler(ctx))
 	}
 	return caaf, nil
 }
 
 // Run start the function along with an object reaper.
 func (caaf *Container) Run(ctx context.Context) {
-	if ok := k8sCache.WaitForCacheSync(ctx.Done(), caaf.deplListerSynced, caaf.svcListerSynced); !ok {
+	waitSynced := make([]k8sCache.InformerSynced, 0)
+	for _, deplListerSynced := range caaf.deplListerSynced {
+		waitSynced = append(waitSynced, deplListerSynced)
+	}
+	for _, svcListerSynced := range caaf.svcListerSynced {
+		waitSynced = append(waitSynced, svcListerSynced)
+	}
+
+	if ok := k8sCache.WaitForCacheSync(ctx.Done(), waitSynced...); !ok {
 		caaf.logger.Fatal("failed to wait for caches to sync")
 	}
 	go caaf.idleObjectReaper(ctx)
@@ -214,7 +224,7 @@ func (caaf *Container) IsValid(ctx context.Context, fsvc *fscache.FuncSvc) bool
 	}
 	for _, obj := range fsvc.KubernetesObjects {
 		if strings.ToLower(obj.Kind) == "service" {
-			_, err := caaf.svcLister.Services(obj.Namespace).Get(obj.Name)
+			_, err := caaf.svcLister[obj.Namespace].Services(obj.Namespace).Get(obj.Name)
 			if err != nil {
 				if !k8sErrs.IsNotFound(err) {
 					logger.Error("error validating function service", zap.String("function", fsvc.Function.Name), zap.Error(err))
@@ -222,7 +232,7 @@ func (caaf *Container) IsValid(ctx context.Context, fsvc *fscache.FuncSvc) bool
 				return false
 			}
 		} else if strings.ToLower(obj.Kind) == "deployment" {
-			currentDeploy, err := caaf.deplLister.Deployments(obj.Namespace).Get(obj.Name)
+			currentDeploy, err := caaf.deplLister[obj.Namespace].Deployments(obj.Namespace).Get(obj.Name)
 			if err != nil {
 				if !k8sErrs.IsNotFound(err) {
 					logger.Error("error validating function deployment", zap.String("function", fsvc.Function.Name), zap.Error(err))
@@ -242,7 +252,8 @@ func (caaf *Container) RefreshFuncPods(ctx context.Context, logger *zap.Logger,
 
 	funcLabels := caaf.getDeployLabels(f.ObjectMeta)
 
-	dep, err := caaf.kubernetesClient.AppsV1().Deployments(metav1.NamespaceAll).List(ctx, metav1.ListOptions{
+	nsResolver := utils.DefaultNSResolver()
+	dep, err := caaf.kubernetesClient.AppsV1().Deployments(nsResolver.GetFunctionNS(f.ObjectMeta.Namespace)).List(ctx, metav1.ListOptions{
 		LabelSelector: labels.Set(funcLabels).AsSelector().String(),
 	})
 	if err != nil {
@@ -273,7 +284,7 @@ func (caaf *Container) RefreshFuncPods(ctx context.Context, logger *zap.Logger,
 func (caaf *Container) AdoptExistingResources(ctx context.Context) {
 	wg := &sync.WaitGroup{}
 
-	for _, namepsace := range utils.GetNamespaces() {
+	for _, namepsace := range utils.DefaultNSResolver().FissionResourceNS {
 		fnList, err := caaf.fissionClient.CoreV1().Functions(namepsace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			caaf.logger.Error("error getting function list", zap.Error(err))

pkg/executor/executortype/newdeploy/newdeploy.go

@@ -34,7 +34,6 @@ import (
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/executor/util"
-	"github.com/fission/fission/pkg/utils"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
 
@@ -91,10 +90,6 @@ func (deploy *NewDeploy) createOrGetDeployment(ctx context.Context, fn *fv1.Func
 
 		return existingDepl, err
 	} else if k8s_err.IsNotFound(err) {
-		err := deploy.setupRBACObjs(ctx, deployNamespace, fn)
-		if err != nil {
-			return nil, err
-		}
 
 		depl, err := deploy.kubernetesClient.AppsV1().Deployments(deployNamespace).Create(ctx, deployment, metav1.CreateOptions{})
 		if err != nil {
@@ -118,47 +113,6 @@ func (deploy *NewDeploy) createOrGetDeployment(ctx context.Context, fn *fv1.Func
 	return nil, err
 }
 
-func (deploy *NewDeploy) setupRBACObjs(ctx context.Context, deployNamespace string, fn *fv1.Function) error {
-	// create fetcher SA in this ns, if not already created
-	err := deploy.fetcherConfig.SetupServiceAccount(ctx, deploy.kubernetesClient, deployNamespace, fn.ObjectMeta)
-	if err != nil {
-		deploy.logger.Error("error creating fission fetcher service account for function",
-			zap.Error(err),
-			zap.String("service_account_name", fv1.FissionFetcherSA),
-			zap.String("service_account_namespace", deployNamespace),
-			zap.String("function_name", fn.ObjectMeta.Name),
-			zap.String("function_namespace", fn.ObjectMeta.Namespace))
-		return err
-	}
-
-	// create a cluster role binding for the fetcher SA, if not already created, granting access to do a get on packages in any ns
-	err = utils.SetupRoleBinding(ctx, deploy.logger, deploy.kubernetesClient, fv1.PackageGetterRB, fn.Spec.Package.PackageRef.Namespace, utils.GetPackageGetterCR(), fv1.ClusterRole, fv1.FissionFetcherSA, deployNamespace)
-	if err != nil {
-		deploy.logger.Error("error creating role binding for function",
-			zap.Error(err),
-			zap.String("role_binding", fv1.PackageGetterRB),
-			zap.String("function_name", fn.ObjectMeta.Name),
-			zap.String("function_namespace", fn.ObjectMeta.Namespace))
-		return err
-	}
-
-	// create rolebinding in function namespace for fetcherSA.envNamespace to be able to get secrets and configmaps
-	err = utils.SetupRoleBinding(ctx, deploy.logger, deploy.kubernetesClient, fv1.SecretConfigMapGetterRB, fn.ObjectMeta.Namespace, utils.GetSecretConfigMapGetterCR(), fv1.ClusterRole, fv1.FissionFetcherSA, deployNamespace)
-	if err != nil {
-		deploy.logger.Error("error creating role binding for function",
-			zap.Error(err),
-			zap.String("role_binding", fv1.SecretConfigMapGetterRB),
-			zap.String("function_name", fn.ObjectMeta.Name),
-			zap.String("function_namespace", fn.ObjectMeta.Namespace))
-		return err
-	}
-
-	deploy.logger.Info("set up all RBAC objects for function",
-		zap.String("function_name", fn.ObjectMeta.Name),
-		zap.String("function_namespace", fn.ObjectMeta.Namespace))
-	return nil
-}
-
 func (deploy *NewDeploy) updateDeployment(ctx context.Context, deployment *appsv1.Deployment, ns string) error {
 	_, err := deploy.kubernetesClient.AppsV1().Deployments(ns).Update(ctx, deployment, metav1.UpdateOptions{})
 	return err

pkg/executor/executortype/newdeploy/newdeploymgr.go

@@ -36,8 +36,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	k8sTypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
-	appsinformers "k8s.io/client-go/informers/apps/v1"
+	k8sInformers "k8s.io/client-go/informers"
-	coreinformers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
 	appslisters "k8s.io/client-go/listers/apps/v1"
 	corelisters "k8s.io/client-go/listers/core/v1"
@@ -52,7 +51,7 @@ import (
 	hpautils "github.com/fission/fission/pkg/executor/util/hpa"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/throttler"
 	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/maps"
@@ -83,11 +82,11 @@ type (
 
 		defaultIdlePodReapTime time.Duration
 
-		deplLister appslisters.DeploymentLister
+		deplLister map[string]appslisters.DeploymentLister
-		svcLister  corelisters.ServiceLister
+		svcLister  map[string]corelisters.ServiceLister
 
-		deplListerSynced k8sCache.InformerSynced
+		deplListerSynced map[string]k8sCache.InformerSynced
-		svcListerSynced  k8sCache.InformerSynced
+		svcListerSynced  map[string]k8sCache.InformerSynced
 
 		hpaops *hpautils.HpaOperations
 
@@ -104,10 +103,8 @@ func MakeNewDeploy(
 	kubernetesClient kubernetes.Interface,
 	fetcherConfig *fetcherConfig.Config,
 	instanceID string,
-	funcInformer map[string]finformerv1.FunctionInformer,
+	finformerFactory map[string]genInformer.SharedInformerFactory,
-	envInformer map[string]finformerv1.EnvironmentInformer,
+	ndmInformerFactory map[string]k8sInformers.SharedInformerFactory,
-	deplInformer appsinformers.DeploymentInformer,
-	svcInformer coreinformers.ServiceInformer,
 	podSpecPatch *apiv1.PodSpec,
 ) (executortype.ExecutorType, error) {
 	enableIstio := false
@@ -137,27 +134,39 @@ func MakeNewDeploy(
 		objectReaperIntervalSecond: time.Duration(executorUtils.GetObjectReaperInterval(logger, fv1.ExecutorTypeNewdeploy, 5)) * time.Second,
 		hpaops:                     hpautils.NewHpaOperations(logger, kubernetesClient, instanceID),
 
-		podSpecPatch: podSpecPatch,
+		podSpecPatch:     podSpecPatch,
+		deplLister:       make(map[string]appslisters.DeploymentLister),
+		deplListerSynced: make(map[string]k8sCache.InformerSynced),
+		svcLister:        make(map[string]corelisters.ServiceLister),
+		svcListerSynced:  make(map[string]k8sCache.InformerSynced),
 	}
 
-	nd.deplLister = deplInformer.Lister()
+	for ns, informerFactory := range ndmInformerFactory {
-	nd.deplListerSynced = deplInformer.Informer().HasSynced
+		nd.deplLister[ns] = informerFactory.Apps().V1().Deployments().Lister()
-
+		nd.deplListerSynced[ns] = informerFactory.Apps().V1().Deployments().Informer().HasSynced
-	nd.svcLister = svcInformer.Lister()
+		nd.svcLister[ns] = informerFactory.Core().V1().Services().Lister()
-	nd.svcListerSynced = svcInformer.Informer().HasSynced
+		nd.svcListerSynced[ns] = informerFactory.Core().V1().Services().Informer().HasSynced
-
-	for _, fnInformer := range funcInformer {
-		fnInformer.Informer().AddEventHandler(nd.FunctionEventHandlers(ctx))
 	}
-	for _, envInformer := range envInformer {
+	for _, factory := range finformerFactory {
-		envInformer.Informer().AddEventHandler(nd.EnvEventHandlers(ctx))
+		factory.Core().V1().Functions().Informer().AddEventHandler(nd.FunctionEventHandlers(ctx))
+	}
+	for _, factory := range finformerFactory {
+		factory.Core().V1().Environments().Informer().AddEventHandler(nd.EnvEventHandlers(ctx))
 	}
 	return nd, nil
 }
 
 // Run start the function and environment controller along with an object reaper.
 func (deploy *NewDeploy) Run(ctx context.Context) {
-	if ok := k8sCache.WaitForCacheSync(ctx.Done(), deploy.deplListerSynced, deploy.svcListerSynced); !ok {
+	waitSynced := make([]k8sCache.InformerSynced, 0)
+	for _, deplListerSynced := range deploy.deplListerSynced {
+		waitSynced = append(waitSynced, deplListerSynced)
+	}
+	for _, svcListerSynced := range deploy.svcListerSynced {
+		waitSynced = append(waitSynced, svcListerSynced)
+	}
+
+	if ok := k8sCache.WaitForCacheSync(ctx.Done(), waitSynced...); !ok {
 		deploy.logger.Fatal("failed to wait for caches to sync")
 	}
 	go deploy.idleObjectReaper(ctx)
@@ -222,7 +231,7 @@ func (deploy *NewDeploy) IsValid(ctx context.Context, fsvc *fscache.FuncSvc) boo
 	}
 	for _, obj := range fsvc.KubernetesObjects {
 		if strings.ToLower(obj.Kind) == "service" {
-			_, err := deploy.svcLister.Services(obj.Namespace).Get(obj.Name)
+			_, err := deploy.svcLister[obj.Namespace].Services(obj.Namespace).Get(obj.Name)
 			if err != nil {
 				if !k8sErrs.IsNotFound(err) {
 					logger.Error("error validating function service", zap.String("function", fsvc.Function.Name), zap.Error(err))
@@ -231,7 +240,7 @@ func (deploy *NewDeploy) IsValid(ctx context.Context, fsvc *fscache.FuncSvc) boo
 			}
 
 		} else if strings.ToLower(obj.Kind) == "deployment" {
-			currentDeploy, err := deploy.deplLister.Deployments(obj.Namespace).Get(obj.Name)
+			currentDeploy, err := deploy.deplLister[obj.Namespace].Deployments(obj.Namespace).Get(obj.Name)
 			if err != nil {
 				if !k8sErrs.IsNotFound(err) {
 					logger.Error("error validating function deployment", zap.String("function", fsvc.Function.Name), zap.Error(err))
@@ -260,7 +269,7 @@ func (deploy *NewDeploy) RefreshFuncPods(ctx context.Context, logger *zap.Logger
 		UID:       env.ObjectMeta.UID,
 	})
 
-	dep, err := deploy.kubernetesClient.AppsV1().Deployments(metav1.NamespaceAll).List(ctx, metav1.ListOptions{
+	dep, err := deploy.kubernetesClient.AppsV1().Deployments(deploy.nsResolver.GetFunctionNS(f.ObjectMeta.Namespace)).List(ctx, metav1.ListOptions{
 		LabelSelector: labels.Set(funcLabels).AsSelector().String(),
 	})
 
@@ -292,7 +301,7 @@ func (deploy *NewDeploy) RefreshFuncPods(ctx context.Context, logger *zap.Logger
 func (deploy *NewDeploy) AdoptExistingResources(ctx context.Context) {
 	wg := &sync.WaitGroup{}
 
-	for _, namepsace := range utils.GetNamespaces() {
+	for _, namepsace := range utils.DefaultNSResolver().FissionResourceNS {
 		fnList, err := deploy.fissionClient.CoreV1().Functions(namepsace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			deploy.logger.Error("error getting function list", zap.Error(err))
@@ -769,7 +778,7 @@ func (deploy *NewDeploy) idleObjectReaper(ctx context.Context) {
 
 func (deploy *NewDeploy) doIdleObjectReaper(ctx context.Context) {
 	envList := make(map[k8sTypes.UID]struct{})
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		envs, err := deploy.fissionClient.CoreV1().Environments(namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			deploy.logger.Fatal("failed to get environment list", zap.Error(err), zap.String("namespace", namespace))

pkg/executor/executortype/newdeploy/newdeploymgr_test.go

@@ -18,11 +18,9 @@ import (
 	k8sCache "k8s.io/client-go/tools/cache"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
-	"github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	fClient "github.com/fission/fission/pkg/generated/clientset/versioned/fake"
 	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
 	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 )
@@ -36,53 +34,30 @@ const (
 	configmapName     string = "newdeploy-test-configmap"
 )
 
-func runInformers(ctx context.Context, informers []k8sCache.SharedIndexInformer) {
-	// Run all informers
-	for _, informer := range informers {
-		go informer.Run(ctx.Done())
-	}
-}
-
 func TestRefreshFuncPods(t *testing.T) {
 	os.Setenv("DEBUG_ENV", "true")
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
-	informerFactory := genInformer.NewSharedInformerFactory(fissionClient, time.Minute*30)
+	factory := make(map[string]genInformer.SharedInformerFactory, 0)
-	funcInformer := map[string]finformerv1.FunctionInformer{
+	factory[metav1.NamespaceAll] = genInformer.NewSharedInformerFactory(fissionClient, time.Minute*30)
-		metav1.NamespaceAll: informerFactory.Core().V1().Functions(),
-	}
-	envInformer := map[string]finformerv1.EnvironmentInformer{
-		metav1.NamespaceAll: informerFactory.Core().V1().Environments(),
-	}
-	newDeployInformerFactory, err := utils.GetInformerFactoryByExecutor(kubernetesClient, fv1.ExecutorTypeNewdeploy, time.Minute*30)
-	if err != nil {
-		t.Fatalf("Error creating informer factory: %s", err)
-	}
 
-	deployInformer := newDeployInformerFactory.Apps().V1().Deployments()
+	executorLabel, err := utils.GetInformerLabelByExecutor(fv1.ExecutorTypeNewdeploy)
-	svcInformer := newDeployInformerFactory.Core().V1().Services()
+	if err != nil {
+		t.Fatalf("Error creating labels for informer: %s", err)
+	}
+	ndmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	err = BuildConfigMap(ctx, kubernetesClient, functionNamespace, fv1.RuntimePodSpecConfigmap, map[string]string{})
-	if err != nil {
-		t.Fatalf("Error building configmap: %s", err)
-	}
-
-	podSpecPatch, err := util.GetSpecFromConfigMap(ctx, kubernetesClient, fv1.RuntimePodSpecConfigmap, functionNamespace)
-	if err != nil {
-		t.Fatalf("Error creating pod spec: %s", err)
-	}
-
 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/userfunc")
 	if err != nil {
 		t.Fatalf("Error creating fetcher config: %s", err)
 	}
 
 	executor, err := MakeNewDeploy(ctx, logger, fissionClient, kubernetesClient, fetcherConfig, "test",
-		funcInformer, envInformer, deployInformer, svcInformer, podSpecPatch)
+		factory, ndmInformerFactory, nil)
 	if err != nil {
 		t.Fatalf("new deploy manager creation failed: %s", err)
 	}
@@ -92,21 +67,31 @@ func TestRefreshFuncPods(t *testing.T) {
 	nsResolver := utils.NamespaceResolver{
 		FunctionNamespace: functionNamespace,
 		BuiderNamespace:   builderNamespace,
+		DefaultNamespace:  defaultNamespace,
 	}
 	ndm.nsResolver = &nsResolver
 
 	go ndm.Run(ctx)
 	t.Log("New deploy manager started")
 
-	runInformers(ctx, []k8sCache.SharedIndexInformer{
+	for _, f := range factory {
-		envInformer[metav1.NamespaceAll].Informer(),
+		f.Start(ctx.Done())
-		funcInformer[metav1.NamespaceAll].Informer(),
+	}
-		deployInformer.Informer(),
+	for _, informerFactory := range ndmInformerFactory {
-		svcInformer.Informer(),
+		informerFactory.Start(ctx.Done())
-	})
+	}
+
 	t.Log("Informers required for new deploy manager started")
 
-	if ok := k8sCache.WaitForCacheSync(ctx.Done(), ndm.deplListerSynced, ndm.svcListerSynced); !ok {
+	waitSynced := make([]k8sCache.InformerSynced, 0)
+	for _, deplListerSynced := range ndm.deplListerSynced {
+		waitSynced = append(waitSynced, deplListerSynced)
+	}
+	for _, svcListerSynced := range ndm.svcListerSynced {
+		waitSynced = append(waitSynced, svcListerSynced)
+	}
+
+	if ok := k8sCache.WaitForCacheSync(ctx.Done(), waitSynced...); !ok {
 		t.Fatal("Timed out waiting for caches to sync")
 	}
 

pkg/executor/executortype/poolmgr/funchandlers.go

@@ -59,27 +59,6 @@ func FunctionEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesCl
 				return
 			}
 
-			// create or update role-binding
-			envNs := fissionfnNamespace
-			if fn.Spec.Environment.Namespace != metav1.NamespaceDefault {
-				envNs = fn.Spec.Environment.Namespace
-			}
-
-			// TODO : Just bring to your attention during review :
-			// setup rolebinding is tried, if it fails, we don't return. we just log an error and move on, because :
-			// 1. not all functions have secrets and/or configmaps, so things will work without this rolebinding in that case.
-			// 2. on the contrary, when the route is tried, the env fetcher logs will show a 403 forbidden message and same will be relayed to executor.
-			err := utils.SetupRoleBinding(ctx, logger, kubernetesClient, fv1.SecretConfigMapGetterRB, fn.ObjectMeta.Namespace, utils.GetSecretConfigMapGetterCR(), fv1.ClusterRole, fv1.FissionFetcherSA, envNs)
-			if err != nil {
-				logger.Error("error creating rolebinding", zap.Error(err), zap.String("role_binding", fv1.SecretConfigMapGetterRB))
-			} else {
-				logger.Debug("successfully set up rolebinding for fetcher service account for function",
-					zap.String("service_account", fv1.FissionFetcherSA),
-					zap.String("service_account_namepsace", envNs),
-					zap.String("function_name", fn.ObjectMeta.Name),
-					zap.String("function_namespace", fn.ObjectMeta.Namespace))
-			}
-
 			if istioEnabled {
 				// create a same name service for function
 				// since istio only allows the traffic to service
@@ -89,6 +68,7 @@ func FunctionEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesCl
 				}
 
 				svcName := utils.GetFunctionIstioServiceName(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace)
+				envNs := utils.DefaultNSResolver().GetFunctionNS(fn.Spec.Environment.Namespace)
 
 				// service for accepting user traffic
 				svc := apiv1.Service{
@@ -120,7 +100,7 @@ func FunctionEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesCl
 				}
 
 				// create function istio service if it does not exist
-				_, err = kubernetesClient.CoreV1().Services(envNs).Create(ctx, &svc, metav1.CreateOptions{})
+				_, err := kubernetesClient.CoreV1().Services(envNs).Create(ctx, &svc, metav1.CreateOptions{})
 				if err != nil && !kerrors.IsAlreadyExists(err) {
 					logger.Error("error creating istio service for function",
 						zap.Error(err),
@@ -139,12 +119,9 @@ func FunctionEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesCl
 				return
 			}
 
-			envNs := fissionfnNamespace
-			if fn.Spec.Environment.Namespace != metav1.NamespaceDefault {
-				envNs = fn.Spec.Environment.Namespace
-			}
-
 			if istioEnabled {
+				envNs := utils.DefaultNSResolver().GetFunctionNS(fn.Spec.Environment.Namespace)
+
 				svcName := utils.GetFunctionIstioServiceName(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace)
 				// delete function istio service
 				err := kubernetesClient.CoreV1().Services(envNs).Delete(ctx, svcName, metav1.DeleteOptions{})
@@ -157,45 +134,6 @@ func FunctionEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesCl
 				}
 			}
 		},
-
-		UpdateFunc: func(oldObj, newObj interface{}) {
-			oldFunc := oldObj.(*fv1.Function)
-			newFunc := newObj.(*fv1.Function)
-
-			if oldFunc.ObjectMeta.ResourceVersion == newFunc.ObjectMeta.ResourceVersion {
-				return
-			}
-
-			envChanged := (oldFunc.Spec.Environment.Namespace != newFunc.Spec.Environment.Namespace)
-
-			executorTypeChangedToPM := (oldFunc.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType != fv1.ExecutorTypePoolmgr &&
-				newFunc.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypePoolmgr)
-
-			// if a func's env reference gets updated and the newly referenced env is in a different ns,
-			// we need to create a rolebinding in func's ns so that the fetcher-sa in env ns has access
-			// to fetch secrets and config maps from the func's ns.
-			// similarly if executorType changed to Pool Manager, we now need a rolebinding in the func ns for fetcher sa
-			// present in env ns because for newdeploy, the fetcher sa is in function namespace
-			if envChanged || executorTypeChangedToPM {
-				envNs := fissionfnNamespace
-				if newFunc.Spec.Environment.Namespace != metav1.NamespaceDefault {
-					envNs = newFunc.Spec.Environment.Namespace
-				}
-				err := utils.SetupRoleBinding(ctx, logger, kubernetesClient, fv1.SecretConfigMapGetterRB,
-					newFunc.ObjectMeta.Namespace, utils.GetSecretConfigMapGetterCR(), fv1.ClusterRole,
-					fv1.FissionFetcherSA, envNs)
-
-				if err != nil {
-					logger.Error("error creating rolebinding", zap.Error(err), zap.String("role_binding", fv1.SecretConfigMapGetterRB))
-				} else {
-					logger.Debug("successfully set up rolebinding for fetcher service account for function",
-						zap.String("service_account", fv1.FissionFetcherSA),
-						zap.String("service_account_namepsace", envNs),
-						zap.String("function_name", newFunc.ObjectMeta.Name),
-						zap.String("function_namespace", newFunc.ObjectMeta.Namespace))
-				}
-			}
-		},
 	}
 
 }

pkg/executor/executortype/poolmgr/gp.go

@@ -138,14 +138,8 @@ func MakeGenericPool(
 }
 
 func (gp *GenericPool) setup(ctx context.Context) error {
-	// create fetcher SA in this ns, if not already created
-	err := gp.fetcherConfig.SetupServiceAccount(ctx, gp.kubernetesClient, gp.namespace, nil)
-	if err != nil {
-		return errors.Wrapf(err, "error creating fetcher service account in namespace %q", gp.namespace)
-	}
-
 	// create the pool
-	err = gp.createPoolDeployment(ctx, gp.env)
+	err := gp.createPoolDeployment(ctx, gp.env)
 	if err != nil {
 		return err
 	}

pkg/executor/executortype/poolmgr/gpm.go

@@ -33,12 +33,9 @@ import (
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime"
 	k8sTypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
-	"k8s.io/apimachinery/pkg/watch"
+	k8sInformers "k8s.io/client-go/informers"
-	appsinformers "k8s.io/client-go/informers/apps/v1"
-	coreinformers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
 	corelisters "k8s.io/client-go/listers/core/v1"
 	k8sCache "k8s.io/client-go/tools/cache"
@@ -53,7 +50,7 @@ import (
 	executorUtils "github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/utils"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
@@ -88,10 +85,10 @@ type (
 		fetcherConfig *fetcherConfig.Config
 
 		// podLister can list/get pods from the shared informer's store
-		podLister corelisters.PodLister
+		podLister map[string]corelisters.PodLister
 
 		// podListerSynced returns true if the pod store has been synced at least once.
-		podListerSynced k8sCache.InformerSynced
+		podListerSynced map[string]k8sCache.InformerSynced
 
 		defaultIdlePodReapTime time.Duration
 
@@ -120,11 +117,8 @@ func MakeGenericPoolManager(ctx context.Context,
 	metricsClient metricsclient.Interface,
 	fetcherConfig *fetcherConfig.Config,
 	instanceID string,
-	funcInformer map[string]finformerv1.FunctionInformer,
+	finformerFactory map[string]genInformer.SharedInformerFactory,
-	pkgInformer map[string]finformerv1.PackageInformer,
+	gpmInformerFactory map[string]k8sInformers.SharedInformerFactory,
-	envInformer map[string]finformerv1.EnvironmentInformer,
-	podInformer coreinformers.PodInformer,
-	rsInformer appsinformers.ReplicaSetInformer,
 	podSpecPatch *apiv1.PodSpec,
 ) (executortype.ExecutorType, error) {
 
@@ -140,7 +134,7 @@ func MakeGenericPoolManager(ctx context.Context,
 	}
 
 	poolPodC := NewPoolPodController(ctx, gpmLogger, kubernetesClient,
-		enableIstio, funcInformer, pkgInformer, envInformer, rsInformer, podInformer)
+		enableIstio, finformerFactory, gpmInformerFactory)
 
 	gpm := &GenericPoolManager{
 		logger:                     gpmLogger,
@@ -159,9 +153,13 @@ func MakeGenericPoolManager(ctx context.Context,
 		poolPodC:                   poolPodC,
 		podSpecPatch:               podSpecPatch,
 		objectReaperIntervalSecond: time.Duration(executorUtils.GetObjectReaperInterval(logger, fv1.ExecutorTypePoolmgr, 5)) * time.Second,
+		podLister:                  make(map[string]corelisters.PodLister),
+		podListerSynced:            make(map[string]k8sCache.InformerSynced),
+	}
+	for ns, informerFactory := range gpmInformerFactory {
+		gpm.podLister[ns] = informerFactory.Core().V1().Pods().Lister()
+		gpm.podListerSynced[ns] = informerFactory.Core().V1().Pods().Informer().HasSynced
 	}
-	gpm.podLister = podInformer.Lister()
-	gpm.podListerSynced = podInformer.Informer().HasSynced
 
 	gpm.logger.Debug("inside MakeGenericPoolManager")
 
@@ -169,7 +167,11 @@ func MakeGenericPoolManager(ctx context.Context,
 }
 
 func (gpm *GenericPoolManager) Run(ctx context.Context) {
-	if ok := k8sCache.WaitForCacheSync(ctx.Done(), gpm.podListerSynced); !ok {
+	waitSynced := make([]k8sCache.InformerSynced, 0)
+	for _, podListerSynced := range gpm.podListerSynced {
+		waitSynced = append(waitSynced, podListerSynced)
+	}
+	if ok := k8sCache.WaitForCacheSync(ctx.Done(), waitSynced...); !ok {
 		gpm.logger.Fatal("failed to wait for caches to sync")
 	}
 	go gpm.service()
@@ -246,7 +248,7 @@ func (gpm *GenericPoolManager) IsValid(ctx context.Context, fsvc *fscache.FuncSv
 	otelUtils.SpanTrackEvent(ctx, "IsValid", fscache.GetAttributesForFuncSvc(fsvc)...)
 	for _, obj := range fsvc.KubernetesObjects {
 		if strings.ToLower(obj.Kind) == "pod" {
-			pod, err := gpm.podLister.Pods(obj.Namespace).Get(obj.Name)
+			pod, err := gpm.podLister[obj.Namespace].Pods(obj.Namespace).Get(obj.Name)
 			if err == nil && utils.IsReadyPod(pod) {
 				// Normally, the address format is http://[pod-ip]:[port], however, if the
 				// Istio is enabled the address format changes to http://[svc-name]:[port].
@@ -317,7 +319,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 	envMap := make(map[string]fv1.Environment)
 	wg := &sync.WaitGroup{}
 
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		envs, err := gpm.fissionClient.CoreV1().Environments(namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			gpm.logger.Error("error getting environment list", zap.Error(err))
@@ -351,7 +353,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 		fv1.EXECUTOR_TYPE: string(fv1.ExecutorTypePoolmgr),
 	}
 
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		podList, err := gpm.kubernetesClient.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{
 			LabelSelector: labels.Set(l).AsSelector().String(),
 		})
@@ -588,7 +590,7 @@ func (gpm *GenericPoolManager) idleObjectReaper(ctx context.Context) {
 
 func (gpm *GenericPoolManager) doIdleObjectReaper(ctx context.Context) {
 	envList := make(map[k8sTypes.UID]struct{})
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		envs, err := gpm.fissionClient.CoreV1().Environments(namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			gpm.logger.Error("failed to get environment list", zap.Error(err), zap.String("namespace", namespace))
@@ -601,7 +603,7 @@ func (gpm *GenericPoolManager) doIdleObjectReaper(ctx context.Context) {
 	}
 
 	fnList := make(map[k8sTypes.UID]fv1.Function)
-	for _, namespace := range utils.GetNamespaces() {
+	for _, namespace := range utils.DefaultNSResolver().FissionResourceNS {
 		fns, err := gpm.fissionClient.CoreV1().Functions(namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			gpm.logger.Error("failed to get environment list", zap.Error(err), zap.String("namespace", namespace))
@@ -676,93 +678,69 @@ func (gpm *GenericPoolManager) doIdleObjectReaper(ctx context.Context) {
 
 // WebsocketStartEventChecker checks if the pod has emitted a websocket connection start event
 func (gpm *GenericPoolManager) WebsocketStartEventChecker(ctx context.Context, kubeClient kubernetes.Interface) {
-
-	informer := k8sCache.NewSharedInformer(
-		&k8sCache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				options.FieldSelector = "involvedObject.kind=Pod,type=Normal,reason=WsConnectionStarted"
-				return kubeClient.CoreV1().Events(apiv1.NamespaceAll).List(ctx, options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				options.FieldSelector = "involvedObject.kind=Pod,type=Normal,reason=WsConnectionStarted"
-				return kubeClient.CoreV1().Events(apiv1.NamespaceAll).Watch(ctx, options)
-			},
-		},
-		&apiv1.Event{},
-		0,
-	)
-
 	stopper := make(chan struct{})
 	defer close(stopper)
-	informer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-		AddFunc: func(obj interface{}) {
-			mObj := obj.(metav1.Object)
-			gpm.logger.Info("Websocket event detected for pod",
-				zap.String("Pod name", mObj.GetName()))
 
-			podName := strings.SplitAfter(mObj.GetName(), ".")
+	var wg wait.Group
-			if fsvc, ok := gpm.fsCache.PodToFsvc.Load(strings.TrimSuffix(podName[0], ".")); ok {
+	for _, informer := range utils.GetInformerEventChecker(ctx, kubeClient, "WsConnectionStarted") {
-				fsvc, ok := fsvc.(*fscache.FuncSvc)
+		informer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-				if !ok {
+			AddFunc: func(obj interface{}) {
-					gpm.logger.Error("could not convert item from PodToFsvc")
+				mObj := obj.(metav1.Object)
-					return
+				gpm.logger.Info("Websocket event detected for pod",
+					zap.String("Pod name", mObj.GetName()))
+
+				podName := strings.SplitAfter(mObj.GetName(), ".")
+				if fsvc, ok := gpm.fsCache.PodToFsvc.Load(strings.TrimSuffix(podName[0], ".")); ok {
+					fsvc, ok := fsvc.(*fscache.FuncSvc)
+					if !ok {
+						gpm.logger.Error("could not convert item from PodToFsvc")
+						return
+					}
+					gpm.fsCache.WebsocketFsvc.Store(fsvc.Name, true)
 				}
-				gpm.fsCache.WebsocketFsvc.Store(fsvc.Name, true)
+			},
-			}
+		})
-		},
+		wg.StartWithChannel(stopper, informer.Run)
-	})
+	}
-	informer.Run(stopper)
+	wg.Wait()
-
 }
 
 // NoActiveConnectionEventChecker checks if the pod has emitted an inactive event
 func (gpm *GenericPoolManager) NoActiveConnectionEventChecker(ctx context.Context, kubeClient kubernetes.Interface) {
-
-	informer := k8sCache.NewSharedInformer(
-		&k8sCache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				options.FieldSelector = "involvedObject.kind=Pod,type=Normal,reason=NoActiveConnections"
-				return kubeClient.CoreV1().Events(apiv1.NamespaceAll).List(ctx, options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				options.FieldSelector = "involvedObject.kind=Pod,type=Normal,reason=NoActiveConnections"
-				return kubeClient.CoreV1().Events(apiv1.NamespaceAll).Watch(ctx, options)
-			},
-		},
-		&apiv1.Event{},
-		0,
-	)
-
 	stopper := make(chan struct{})
 	defer close(stopper)
-	informer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-		AddFunc: func(obj interface{}) {
-			mObj := obj.(metav1.Object)
-			gpm.logger.Info("Inactive event detected for pod",
-				zap.String("Pod name", mObj.GetName()))
 
-			podName := strings.SplitAfter(mObj.GetName(), ".")
+	var wg wait.Group
-			if fsvc, ok := gpm.fsCache.PodToFsvc.Load(strings.TrimSuffix(podName[0], ".")); ok {
+	for _, informer := range utils.GetInformerEventChecker(ctx, kubeClient, "WsConnectionStarted") {
-				fsvc, ok := fsvc.(*fscache.FuncSvc)
+		informer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-				if !ok {
+			AddFunc: func(obj interface{}) {
-					gpm.logger.Error("could not convert value from PodToFsvc")
+				mObj := obj.(metav1.Object)
-					return
+				gpm.logger.Info("Inactive event detected for pod",
+					zap.String("Pod name", mObj.GetName()))
+
+				podName := strings.SplitAfter(mObj.GetName(), ".")
+				if fsvc, ok := gpm.fsCache.PodToFsvc.Load(strings.TrimSuffix(podName[0], ".")); ok {
+					fsvc, ok := fsvc.(*fscache.FuncSvc)
+					if !ok {
+						gpm.logger.Error("could not convert value from PodToFsvc")
+						return
+					}
+					gpm.fsCache.DeleteFunctionSvc(ctx, fsvc)
+					for i := range fsvc.KubernetesObjects {
+						gpm.logger.Info("release idle function resources due to  inactivity",
+							zap.String("function", fsvc.Function.Name),
+							zap.String("address", fsvc.Address),
+							zap.String("executor", string(fsvc.Executor)),
+							zap.String("pod", fsvc.Name),
+						)
+						reaper.CleanupKubeObject(ctx, gpm.logger, gpm.kubernetesClient, &fsvc.KubernetesObjects[i])
+						time.Sleep(50 * time.Millisecond)
+					}
 				}
-				gpm.fsCache.DeleteFunctionSvc(ctx, fsvc)
-				for i := range fsvc.KubernetesObjects {
-					gpm.logger.Info("release idle function resources due to  inactivity",
-						zap.String("function", fsvc.Function.Name),
-						zap.String("address", fsvc.Address),
-						zap.String("executor", string(fsvc.Executor)),
-						zap.String("pod", fsvc.Name),
-					)
-					reaper.CleanupKubeObject(ctx, gpm.logger, gpm.kubernetesClient, &fsvc.KubernetesObjects[i])
-					time.Sleep(50 * time.Millisecond)
-				}
-			}
-
-		},
-	})
-	informer.Run(stopper)
 
+			},
+		})
+		wg.StartWithChannel(stopper, informer.Run)
+	}
+	wg.Wait()
 }

pkg/executor/executortype/poolmgr/packagehandlers.go

@@ -15,89 +15,3 @@ limitations under the License.
 */
 
 package poolmgr
-
-import (
-	"context"
-
-	"go.uber.org/zap"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes"
-	k8sCache "k8s.io/client-go/tools/cache"
-
-	fv1 "github.com/fission/fission/pkg/apis/core/v1"
-	"github.com/fission/fission/pkg/utils"
-)
-
-// PackageEventHandlers provides handlers for package events.
-// Based on package create/update event, we create role binding
-// for the package which is used by fetcher component.
-func PackageEventHandlers(ctx context.Context, logger *zap.Logger, kubernetesClient kubernetes.Interface, fissionfnNamespace string) k8sCache.ResourceEventHandlerFuncs {
-	return k8sCache.ResourceEventHandlerFuncs{
-		AddFunc: func(obj interface{}) {
-			pkg := obj.(*fv1.Package)
-			logger.Debug("list watch for package reported a new package addition",
-				zap.String("package_name", pkg.ObjectMeta.Name),
-				zap.String("package_namespace", pkg.ObjectMeta.Namespace))
-
-			// create or update role-binding for fetcher sa in env ns to be able to get the pkg contents from pkg namespace
-			envNs := fissionfnNamespace
-			if pkg.Spec.Environment.Namespace != metav1.NamespaceDefault {
-				envNs = pkg.Spec.Environment.Namespace
-			}
-			// here, we return if we hit an error during rolebinding setup. this is because this rolebinding is mandatory for
-			// every function's package to be loaded into its env. without that, there's no point to move forward.
-			err := utils.SetupRoleBinding(ctx, logger, kubernetesClient, fv1.PackageGetterRB, pkg.ObjectMeta.Namespace, utils.GetPackageGetterCR(), fv1.ClusterRole, fv1.FissionFetcherSA, envNs)
-			if err != nil {
-				logger.Error("error creating rolebinding for package",
-					zap.Error(err),
-					zap.String("role_binding", fv1.PackageGetterRB),
-					zap.String("package_name", pkg.ObjectMeta.Name),
-					zap.String("package_namespace", pkg.ObjectMeta.Namespace))
-				return
-			}
-
-			logger.Debug("successfully set up rolebinding for fetcher service account",
-				zap.String("service_account", fv1.FissionFetcherSA),
-				zap.String("service_account_namespace", envNs),
-				zap.String("package_name", pkg.ObjectMeta.Name),
-				zap.String("package_namespace", pkg.ObjectMeta.Namespace))
-		},
-
-		UpdateFunc: func(oldObj, newObj interface{}) {
-			oldPkg := oldObj.(*fv1.Package)
-			newPkg := newObj.(*fv1.Package)
-
-			if oldPkg.ObjectMeta.ResourceVersion == newPkg.ObjectMeta.ResourceVersion {
-				return
-			}
-
-			// if a pkg's env reference gets updated and the newly referenced env is in a different ns,
-			// we need to update the role-binding in pkg ns to grant permissions to the fetcher-sa in env ns
-			// to do a get on pkg
-			if oldPkg.Spec.Environment.Namespace != newPkg.Spec.Environment.Namespace {
-				envNs := fissionfnNamespace
-				if newPkg.Spec.Environment.Namespace != metav1.NamespaceDefault {
-					envNs = newPkg.Spec.Environment.Namespace
-				}
-
-				err := utils.SetupRoleBinding(ctx, logger, kubernetesClient, fv1.PackageGetterRB,
-					newPkg.ObjectMeta.Namespace, utils.GetPackageGetterCR(), fv1.ClusterRole,
-					fv1.FissionFetcherSA, envNs)
-				if err != nil {
-					logger.Error("error updating rolebinding for package",
-						zap.Error(err),
-						zap.String("role_binding", fv1.PackageGetterRB),
-						zap.String("package_name", newPkg.ObjectMeta.Name),
-						zap.String("package_namespace", newPkg.ObjectMeta.Namespace))
-					return
-				}
-
-				logger.Debug("successfully updated rolebinding for fetcher service account",
-					zap.String("service_account", fv1.FissionFetcherSA),
-					zap.String("service_account_namespace", envNs),
-					zap.String("package_name", newPkg.ObjectMeta.Name),
-					zap.String("package_namespace", newPkg.ObjectMeta.Namespace))
-			}
-		},
-	}
-}

pkg/executor/executortype/poolmgr/poolpodcontroller.go

@@ -29,8 +29,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
-	appsinformers "k8s.io/client-go/informers/apps/v1"
+	k8sInformers "k8s.io/client-go/informers"
-	coreinformers "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/kubernetes"
 	corelisters "k8s.io/client-go/listers/core/v1"
 	k8sCache "k8s.io/client-go/tools/cache"
@@ -38,7 +37,7 @@ import (
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/executor/fscache"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	flisterv1 "github.com/fission/fission/pkg/generated/listers/core/v1"
 	"github.com/fission/fission/pkg/utils"
 )
@@ -54,10 +53,10 @@ type (
 		envListerSynced map[string]k8sCache.InformerSynced
 
 		// podLister can list/get pods from the shared informer's store
-		podLister corelisters.PodLister
+		podLister map[string]corelisters.PodLister
 
 		// podListerSynced returns true if the pod store has been synced at least once.
-		podListerSynced k8sCache.InformerSynced
+		podListerSynced map[string]k8sCache.InformerSynced
 
 		envCreateUpdateQueue workqueue.RateLimitingInterface
 		envDeleteQueue       workqueue.RateLimitingInterface
@@ -71,11 +70,8 @@ type (
 func NewPoolPodController(ctx context.Context, logger *zap.Logger,
 	kubernetesClient kubernetes.Interface,
 	enableIstio bool,
-	funcInformer map[string]finformerv1.FunctionInformer,
+	finformerFactory map[string]genInformer.SharedInformerFactory,
-	pkgInformer map[string]finformerv1.PackageInformer,
+	gpmInformerFactory map[string]k8sInformers.SharedInformerFactory) *PoolPodController {
-	envInformer map[string]finformerv1.EnvironmentInformer,
-	rsInformer appsinformers.ReplicaSetInformer,
-	podInformer coreinformers.PodInformer) *PoolPodController {
 	logger = logger.Named("pool_pod_controller")
 	p := &PoolPodController{
 		logger:               logger,
@@ -84,33 +80,36 @@ func NewPoolPodController(ctx context.Context, logger *zap.Logger,
 		enableIstio:          enableIstio,
 		envLister:            make(map[string]flisterv1.EnvironmentLister, 0),
 		envListerSynced:      make(map[string]k8sCache.InformerSynced, 0),
+		podLister:            make(map[string]corelisters.PodLister),
+		podListerSynced:      make(map[string]k8sCache.InformerSynced),
 		envCreateUpdateQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "EnvAddUpdateQueue"),
 		envDeleteQueue:       workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "EnvDeleteQueue"),
 		spCleanupPodQueue:    workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "SpecializedPodCleanupQueue"),
 	}
-	for _, informer := range funcInformer {
+	if p.enableIstio {
-		informer.Informer().AddEventHandler(FunctionEventHandlers(ctx, p.logger, p.kubernetesClient, p.nsResolver.ResolveNamespace(p.nsResolver.FunctionNamespace), p.enableIstio))
+		for _, factory := range finformerFactory {
+			factory.Core().V1().Functions().Informer().AddEventHandler(FunctionEventHandlers(ctx, p.logger, p.kubernetesClient, p.nsResolver.ResolveNamespace(p.nsResolver.FunctionNamespace), p.enableIstio))
+		}
 	}
-	for _, informer := range pkgInformer {
+	for ns, informer := range finformerFactory {
-		informer.Informer().AddEventHandler(PackageEventHandlers(ctx, p.logger, p.kubernetesClient, p.nsResolver.ResolveNamespace(p.nsResolver.FunctionNamespace)))
+		informer.Core().V1().Environments().Informer().AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-	}
-	for ns, informer := range envInformer {
-		informer.Informer().AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
 			AddFunc:    p.enqueueEnvAdd,
 			UpdateFunc: p.enqueueEnvUpdate,
 			DeleteFunc: p.enqueueEnvDelete,
 		})
-		p.envLister[ns] = informer.Lister()
+		p.envLister[ns] = informer.Core().V1().Environments().Lister()
-		p.envListerSynced[ns] = informer.Informer().HasSynced
+		p.envListerSynced[ns] = informer.Core().V1().Environments().Informer().HasSynced
+	}
+	for ns, informerFactory := range gpmInformerFactory {
+		informerFactory.Apps().V1().ReplicaSets().Informer().AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+			AddFunc:    p.handleRSAdd,
+			UpdateFunc: p.handleRSUpdate,
+			DeleteFunc: p.handleRSDelete,
+		})
+		p.podListerSynced[ns] = informerFactory.Core().V1().Pods().Informer().HasSynced
+		p.podLister[ns] = informerFactory.Core().V1().Pods().Lister()
 	}
-	rsInformer.Informer().AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
-		AddFunc:    p.handleRSAdd,
-		UpdateFunc: p.handleRSUpdate,
-		DeleteFunc: p.handleRSDelete,
-	})
 
-	p.podLister = podInformer.Lister()
-	p.podListerSynced = podInformer.Informer().HasSynced
 	p.logger.Info("pool pod controller handlers registered")
 	return p
 }
@@ -138,7 +137,7 @@ func (p *PoolPodController) processRS(rs *apps.ReplicaSet) {
 		return
 	}
 	rsLabelMap["managed"] = "false"
-	specializedPods, err := p.podLister.Pods(rs.Namespace).List(labels.SelectorFromSet(rsLabelMap))
+	specializedPods, err := p.podLister[rs.Namespace].Pods(rs.Namespace).List(labels.SelectorFromSet(rsLabelMap))
 	if err != nil {
 		logger.Error("Failed to list specialized pods", zap.Error(err))
 	}
@@ -233,7 +232,9 @@ func (p *PoolPodController) Run(ctx context.Context, stopCh <-chan struct{}) {
 	p.logger.Info("Waiting for informer caches to sync")
 
 	waitSynced := make([]k8sCache.InformerSynced, 0)
-	waitSynced = append(waitSynced, p.podListerSynced)
+	for _, synced := range p.podListerSynced {
+		waitSynced = append(waitSynced, synced)
+	}
 	for _, synced := range p.envListerSynced {
 		waitSynced = append(waitSynced, synced)
 	}
@@ -373,7 +374,8 @@ func (p *PoolPodController) envDeleteQueueProcessFunc(ctx context.Context) bool
 	p.logger.Debug("env delete request processing")
 	p.gpm.cleanupPool(ctx, env)
 	specializePodLables := getSpecializedPodLabels(env)
-	specializedPods, err := p.podLister.Pods(p.nsResolver.ResolveNamespace(p.nsResolver.FunctionNamespace)).List(labels.SelectorFromSet(specializePodLables))
+	ns := p.nsResolver.ResolveNamespace(p.nsResolver.FunctionNamespace)
+	specializedPods, err := p.podLister[ns].Pods(ns).List(labels.SelectorFromSet(specializePodLables))
 	if err != nil {
 		p.logger.Error("failed to list specialized pods", zap.Error(err))
 		p.envDeleteQueue.Forget(obj)
@@ -413,7 +415,7 @@ func (p *PoolPodController) spCleanupPodQueueProcessFunc(ctx context.Context) bo
 		p.spCleanupPodQueue.Forget(key)
 		return false
 	}
-	pod, err := p.podLister.Pods(namespace).Get(name)
+	pod, err := p.podLister[namespace].Pods(namespace).Get(name)
 	if apierrors.IsNotFound(err) {
 		p.logger.Info("pod not found", zap.String("key", key))
 		p.spCleanupPodQueue.Forget(key)

pkg/executor/executortype/poolmgr/poolpodcontroller_test.go

@@ -32,48 +32,27 @@ import (
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	fClient "github.com/fission/fission/pkg/generated/clientset/versioned/fake"
 	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
-	finformerv1 "github.com/fission/fission/pkg/generated/informers/externalversions/core/v1"
 	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
 )
 
-func runInformers(ctx context.Context, informers []k8sCache.SharedIndexInformer) {
-	// Run all informers
-	for _, informer := range informers {
-		go informer.Run(ctx.Done())
-	}
-}
-
 func TestPoolPodControllerPodCleanup(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
-	informerFactory := genInformer.NewSharedInformerFactory(fissionClient, time.Minute*30)
+	factory := make(map[string]genInformer.SharedInformerFactory, 0)
-	funcInformer := map[string]finformerv1.FunctionInformer{
+	factory[metav1.NamespaceDefault] = genInformer.NewFilteredSharedInformerFactory(fissionClient, time.Minute*30, metav1.NamespaceDefault, nil)
-		metav1.NamespaceAll: informerFactory.Core().V1().Functions(),
-	}
-	pkgInformer := map[string]finformerv1.PackageInformer{
-		metav1.NamespaceAll: informerFactory.Core().V1().Packages(),
-	}
-	envInformer := map[string]finformerv1.EnvironmentInformer{
-		metav1.NamespaceAll: informerFactory.Core().V1().Environments(),
-	}
 
-	gpmInformerFactory, err := utils.GetInformerFactoryByExecutor(kubernetesClient, fv1.ExecutorTypePoolmgr, time.Minute*30)
+	executorLabel, err := utils.GetInformerLabelByExecutor(fv1.ExecutorTypePoolmgr)
 	if err != nil {
-		t.Fatalf("Error creating informer factory: %v", err)
+		t.Fatalf("Error creating labels for informer: %v", err)
 	}
-	gpmPodInformer := gpmInformerFactory.Core().V1().Pods()
+	gpmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)
-	gpmRsInformer := gpmInformerFactory.Apps().V1().ReplicaSets()
 
 	ppc := NewPoolPodController(ctx, logger, kubernetesClient, false,
-		funcInformer,
+		factory, gpmInformerFactory)
-		pkgInformer,
-		envInformer,
-		gpmRsInformer,
-		gpmPodInformer)
 
 	executorInstanceID := strings.ToLower(uniuri.NewLen(8))
 	metricsClient := metricsclient.NewSimpleClientset()
@@ -85,8 +64,7 @@ func TestPoolPodControllerPodCleanup(t *testing.T) {
 		logger,
 		fissionClient, kubernetesClient, metricsClient,
 		fetcherConfig, executorInstanceID,
-		funcInformer, pkgInformer, envInformer,
+		factory, gpmInformerFactory, nil)
-		gpmPodInformer, gpmRsInformer, nil)
 	if err != nil {
 		t.Fatalf("Error creating generic pool manager: %v", err)
 	}
@@ -95,20 +73,18 @@ func TestPoolPodControllerPodCleanup(t *testing.T) {
 
 	go ppc.Run(ctx, ctx.Done())
 
-	podInformer := gpmPodInformer.Informer()
+	for _, f := range factory {
+		f.Start(ctx.Done())
+	}
 
-	runInformers(ctx, []k8sCache.SharedIndexInformer{
+	for _, informerFactory := range gpmInformerFactory {
-		funcInformer[metav1.NamespaceAll].Informer(),
+		informerFactory.Start(ctx.Done())
-		pkgInformer[metav1.NamespaceAll].Informer(),
+	}
-		envInformer[metav1.NamespaceAll].Informer(),
-		podInformer,
-		gpmRsInformer.Informer(),
-	})
 
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "test-pod",
-			Namespace: "test-different-namespace",
+			Namespace: metav1.NamespaceDefault,
 		},
 		Status: corev1.PodStatus{
 			Phase: corev1.PodRunning,
@@ -124,7 +100,7 @@ func TestPoolPodControllerPodCleanup(t *testing.T) {
 	found := false
 	for found == false && time.Since(start) < time.Second*5 {
 		t.Log("Waiting for pod to be added to pool")
-		pod, err := ppc.podLister.Pods(pod.Namespace).Get(pod.Name)
+		pod, err := ppc.podLister[pod.Namespace].Pods(pod.Namespace).Get(pod.Name)
 		if err == nil {
 			found = true
 			t.Logf("Found pod %#v", pod.ObjectMeta)

pkg/executor/metrics/metrics.go

@@ -17,8 +17,8 @@ limitations under the License.
 package metrics
 
 import (
+	"github.com/fission/fission/pkg/utils/metrics"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promauto"
 )
 
 var (
@@ -26,14 +26,14 @@ var (
 	// function_uid: the function's version id
 	// function_address: the address of the pod from which the function was called
 	functionLabels = []string{"function_name", "function_namespace"}
-	ColdStarts     = promauto.NewCounterVec(
+	ColdStarts     = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Name: "fission_function_cold_starts_total",
 			Help: "How many cold starts are made by function_name, function_namespace.",
 		},
 		functionLabels,
 	)
-	FuncRunningSummary = promauto.NewSummaryVec(
+	FuncRunningSummary = prometheus.NewSummaryVec(
 		prometheus.SummaryOpts{
 			Name:       "fission_function_running_seconds",
 			Help:       "The running time (last access - create) in seconds of the function.",
@@ -41,7 +41,7 @@ var (
 		},
 		functionLabels,
 	)
-	FuncError = promauto.NewCounterVec(
+	FuncError = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Name: "fission_function_cold_start_errors_total",
 			Help: "Count of fission cold start errors",
@@ -49,3 +49,10 @@ var (
 		functionLabels,
 	)
 )
+
+func init() {
+	registry := metrics.Registry
+	registry.MustRegister(ColdStarts)
+	registry.MustRegister(FuncRunningSummary)
+	registry.MustRegister(FuncError)
+}

pkg/executor/reaper/reaper.go

@@ -19,7 +19,6 @@ package reaper
 import (
 	"context"
 	"strings"
-	"time"
 
 	"go.uber.org/zap"
 	apiv1 "k8s.io/api/core/v1"
@@ -27,7 +26,6 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
-	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
 )
 
@@ -71,26 +69,34 @@ func CleanupKubeObject(ctx context.Context, logger *zap.Logger, kubeClient kuber
 
 // CleanupDeployments deletes deployment(s) for a given instanceID
 func CleanupDeployments(ctx context.Context, logger *zap.Logger, client kubernetes.Interface, instanceID string, listOps metav1.ListOptions) error {
-	deploymentList, err := client.AppsV1().Deployments(metav1.NamespaceAll).List(ctx, listOps)
+	cleanupDeployments := func(namespace string) error {
-	if err != nil {
+		deploymentList, err := client.AppsV1().Deployments(namespace).List(ctx, listOps)
-		return err
+		if err != nil {
-	}
+			return err
-	for _, dep := range deploymentList.Items {
-		id, ok := dep.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-		if !ok {
-			// Backward compatibility with older label name
-			id, ok = dep.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
 		}
-		if ok && id != instanceID {
+		for _, dep := range deploymentList.Items {
-			logger.Info("cleaning up deployment", zap.String("deployment", dep.ObjectMeta.Name))
+			id, ok := dep.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-			err := client.AppsV1().Deployments(dep.ObjectMeta.Namespace).Delete(ctx, dep.ObjectMeta.Name, delOpt)
+			if !ok {
-			if err != nil {
+				// Backward compatibility with older label name
-				logger.Error("error cleaning up deployment",
+				id, ok = dep.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
-					zap.Error(err),
-					zap.String("deployment_name", dep.ObjectMeta.Name),
-					zap.String("deployment_namespace", dep.ObjectMeta.Namespace))
 			}
-			// ignore err
+			if ok && id != instanceID {
+				logger.Info("cleaning up deployment", zap.String("deployment", dep.ObjectMeta.Name))
+				err := client.AppsV1().Deployments(dep.ObjectMeta.Namespace).Delete(ctx, dep.ObjectMeta.Name, delOpt)
+				if err != nil {
+					logger.Error("error cleaning up deployment",
+						zap.Error(err),
+						zap.String("deployment_name", dep.ObjectMeta.Name),
+						zap.String("deployment_namespace", dep.ObjectMeta.Namespace))
+				}
+				// ignore err
+			}
+		}
+		return nil
+	}
+	for _, namespace := range GetReaperNamespace() {
+		if err := cleanupDeployments(namespace); err != nil {
+			return err
 		}
 	}
 
@@ -99,26 +105,35 @@ func CleanupDeployments(ctx context.Context, logger *zap.Logger, client kubernet
 
 // CleanupPods deletes pod(s) for a given instanceID
 func CleanupPods(ctx context.Context, logger *zap.Logger, client kubernetes.Interface, instanceID string, listOps metav1.ListOptions) error {
-	podList, err := client.CoreV1().Pods(metav1.NamespaceAll).List(ctx, listOps)
+	cleanupPods := func(namespace string) error {
-	if err != nil {
+		podList, err := client.CoreV1().Pods(namespace).List(ctx, listOps)
-		return err
+		if err != nil {
-	}
+			return err
-	for _, pod := range podList.Items {
-		id, ok := pod.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-		if !ok {
-			// Backward compatibility with older label name
-			id, ok = pod.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
 		}
-		if ok && id != instanceID {
+		for _, pod := range podList.Items {
-			logger.Info("cleaning up pod", zap.String("pod", pod.ObjectMeta.Name))
+			id, ok := pod.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-			err := client.CoreV1().Pods(pod.ObjectMeta.Namespace).Delete(ctx, pod.ObjectMeta.Name, metav1.DeleteOptions{})
+			if !ok {
-			if err != nil {
+				// Backward compatibility with older label name
-				logger.Error("error cleaning up pod",
+				id, ok = pod.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
-					zap.Error(err),
-					zap.String("pod_name", pod.ObjectMeta.Name),
-					zap.String("pod_namespace", pod.ObjectMeta.Namespace))
 			}
-			// ignore err
+			if ok && id != instanceID {
+				logger.Info("cleaning up pod", zap.String("pod", pod.ObjectMeta.Name))
+				err := client.CoreV1().Pods(pod.ObjectMeta.Namespace).Delete(ctx, pod.ObjectMeta.Name, metav1.DeleteOptions{})
+				if err != nil {
+					logger.Error("error cleaning up pod",
+						zap.Error(err),
+						zap.String("pod_name", pod.ObjectMeta.Name),
+						zap.String("pod_namespace", pod.ObjectMeta.Namespace))
+				}
+				// ignore err
+			}
+		}
+		return nil
+	}
+
+	for _, namespace := range GetReaperNamespace() {
+		if err := cleanupPods(namespace); err != nil {
+			return err
 		}
 	}
 
@@ -127,26 +142,35 @@ func CleanupPods(ctx context.Context, logger *zap.Logger, client kubernetes.Inte
 
 // CleanupServices deletes service(s) for a given instanceID
 func CleanupServices(ctx context.Context, logger *zap.Logger, client kubernetes.Interface, instanceID string, listOps metav1.ListOptions) error {
-	svcList, err := client.CoreV1().Services(metav1.NamespaceAll).List(ctx, listOps)
+	cleanupServices := func(namespace string) error {
-	if err != nil {
+		svcList, err := client.CoreV1().Services(namespace).List(ctx, listOps)
-		return err
+		if err != nil {
-	}
+			return err
-	for _, svc := range svcList.Items {
-		id, ok := svc.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-		if !ok {
-			// Backward compatibility with older label name
-			id, ok = svc.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
 		}
-		if ok && id != instanceID {
+		for _, svc := range svcList.Items {
-			logger.Info("cleaning up service", zap.String("service", svc.ObjectMeta.Name))
+			id, ok := svc.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
-			err := client.CoreV1().Services(svc.ObjectMeta.Namespace).Delete(ctx, svc.ObjectMeta.Name, metav1.DeleteOptions{})
+			if !ok {
-			if err != nil {
+				// Backward compatibility with older label name
-				logger.Error("error cleaning up service",
+				id, ok = svc.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
-					zap.Error(err),
-					zap.String("service_name", svc.ObjectMeta.Name),
-					zap.String("service_namespace", svc.ObjectMeta.Namespace))
 			}
-			// ignore err
+			if ok && id != instanceID {
+				logger.Info("cleaning up service", zap.String("service", svc.ObjectMeta.Name))
+				err := client.CoreV1().Services(svc.ObjectMeta.Namespace).Delete(ctx, svc.ObjectMeta.Name, metav1.DeleteOptions{})
+				if err != nil {
+					logger.Error("error cleaning up service",
+						zap.Error(err),
+						zap.String("service_name", svc.ObjectMeta.Name),
+						zap.String("service_namespace", svc.ObjectMeta.Namespace))
+				}
+				// ignore err
+			}
+		}
+		return nil
+	}
+
+	for _, namespace := range GetReaperNamespace() {
+		if err := cleanupServices(namespace); err != nil {
+			return err
 		}
 	}
 
@@ -155,174 +179,45 @@ func CleanupServices(ctx context.Context, logger *zap.Logger, client kubernetes.
 
 // CleanupHpa deletes horizontal pod autoscaler(s) for a given instanceID
 func CleanupHpa(ctx context.Context, logger *zap.Logger, client kubernetes.Interface, instanceID string, listOps metav1.ListOptions) error {
-	hpaList, err := client.AutoscalingV2beta2().HorizontalPodAutoscalers(metav1.NamespaceAll).List(ctx, listOps)
+	cleanupHpa := func(namespace string) error {
-	if err != nil {
+		hpaList, err := client.AutoscalingV2beta2().HorizontalPodAutoscalers(namespace).List(ctx, listOps)
-		return err
+		if err != nil {
+			return err
+		}
+
+		for _, hpa := range hpaList.Items {
+			id, ok := hpa.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
+			if !ok {
+				// Backward compatibility with older label name
+				id, ok = hpa.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
+			}
+			if ok && id != instanceID {
+				logger.Info("cleaning up HPA", zap.String("hpa", hpa.ObjectMeta.Name))
+				err := client.AutoscalingV2beta2().HorizontalPodAutoscalers(hpa.ObjectMeta.Namespace).Delete(ctx, hpa.ObjectMeta.Name, metav1.DeleteOptions{})
+				if err != nil {
+					logger.Error("error cleaning up HPA",
+						zap.Error(err),
+						zap.String("hpa_name", hpa.ObjectMeta.Name),
+						zap.String("hpa_namespace", hpa.ObjectMeta.Namespace))
+				}
+				// ignore err
+			}
+		}
+		return nil
 	}
 
-	for _, hpa := range hpaList.Items {
+	for _, namespace := range GetReaperNamespace() {
-		id, ok := hpa.ObjectMeta.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL]
+		if err := cleanupHpa(namespace); err != nil {
-		if !ok {
+			return err
-			// Backward compatibility with older label name
-			id, ok = hpa.ObjectMeta.Labels[fv1.EXECUTOR_INSTANCEID_LABEL]
-		}
-		if ok && id != instanceID {
-			logger.Info("cleaning up HPA", zap.String("hpa", hpa.ObjectMeta.Name))
-			err := client.AutoscalingV2beta2().HorizontalPodAutoscalers(hpa.ObjectMeta.Namespace).Delete(ctx, hpa.ObjectMeta.Name, metav1.DeleteOptions{})
-			if err != nil {
-				logger.Error("error cleaning up HPA",
-					zap.Error(err),
-					zap.String("hpa_name", hpa.ObjectMeta.Name),
-					zap.String("hpa_namespace", hpa.ObjectMeta.Namespace))
-			}
-			// ignore err
 		}
 	}
 
 	return nil
 }
 
-// CleanupRoleBindings periodically lists rolebindings across all namespaces and removes Service Accounts from them or
+func GetReaperNamespace() map[string]string {
-// deletes the rolebindings completely if there are no Service Accounts in a rolebinding object.
+	ns := utils.DefaultNSResolver()
-func CleanupRoleBindings(ctx context.Context, logger *zap.Logger, client kubernetes.Interface, fissionClient versioned.Interface, cleanupRoleBindingInterval time.Duration) {
+	//to support backward compatibility we need to cleanup deployment and rolebinding created in function, buidler and default namespace as well
-	nsResolver := utils.DefaultNSResolver()
+	fissionResourceNs := ns.FissionNSWithOptions(utils.WithBuilderNs(), utils.WithFunctionNs(), utils.WithDefaultNs())
-	for {
+	return fissionResourceNs
-		// some sleep before the next reaper iteration
-		time.Sleep(cleanupRoleBindingInterval)
-
-		logger.Debug("starting cleanupRoleBindings cycle")
-
-		// get all rolebindings ( just to be efficient, one call to kubernetes )
-		rbList, err := client.RbacV1().RoleBindings(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})
-		if err != nil {
-			// something wrong, but next iteration hopefully succeeds
-			logger.Error("error listing role bindings in all namespaces", zap.Error(err))
-			continue
-		}
-
-		// go through each role-binding object and do the cleanup necessary
-		for _, roleBinding := range rbList.Items {
-			// ignore role-bindings in kube-system namespace
-			if roleBinding.Namespace == "kube-system" {
-				continue
-			}
-
-			// ignore role-bindings not created by fission
-			if roleBinding.Name != fv1.PackageGetterRB && roleBinding.Name != fv1.SecretConfigMapGetterRB {
-				continue
-			}
-
-			// in order to find out if there are any functions that need this role-binding in role-binding namespace,
-			// we can list the functions once per role-binding.
-			funcList, err := fissionClient.CoreV1().Functions(roleBinding.Namespace).List(ctx, metav1.ListOptions{})
-			if err != nil {
-				logger.Error("error fetching function list in namespace", zap.Error(err), zap.String("namespace", roleBinding.Namespace))
-				continue
-			}
-
-			// final map of service accounts that can be removed from this roleBinding object
-			// using a map here instead of a list so the code in RemoveSAFromRoleBindingWithRetries is efficient.
-			saToRemove := make(map[string]bool)
-
-			// the following flags are needed to decide if any of the service accounts can be removed from role-bindings depending on the functions that need them.
-			// ndmFunc denotes if there's at least one function that has executor type New deploy Manager
-			// funcEnvReference denotes if there's at least one function that has reference to an environment in the SA Namespace for the SA in question
-			var ndmFunc, funcEnvReference bool
-
-			// iterate through each subject in the role-binding and check if there are any references to them
-			for _, subj := range roleBinding.Subjects {
-				ndmFunc = false
-				funcEnvReference = false
-
-				// this is the reverse of what we're doing in setting up of role-bindings. if objects are created in default ns,
-				// the SA namespace will have the value of "fission-function"/"fission-builder" depending on the SA.
-				// so now we need to look for the objects in default namespace.
-				saNs := subj.Namespace
-				isInReservedNS := false
-				if subj.Namespace == nsResolver.FunctionNamespace ||
-					subj.Namespace == nsResolver.BuiderNamespace {
-					saNs = metav1.NamespaceDefault
-					isInReservedNS = true
-				}
-
-				// go through each function and find out if there's either at least one function with env reference in the same namespace as the Service Account in this iteration
-				// or at least one function using ndm executor in the role-binding namespace and set the corresponding flags
-				for _, fn := range funcList.Items {
-					if fn.Spec.Environment.Namespace == saNs ||
-						//  For the case that the environment is created in the reserved namespace.
-						(isInReservedNS && (fn.Spec.Environment.Namespace == nsResolver.FunctionNamespace ||
-							fn.Spec.Environment.Namespace == nsResolver.BuiderNamespace)) {
-						funcEnvReference = true
-						break
-					}
-
-					if fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypeNewdeploy {
-						ndmFunc = true
-						break
-					}
-				}
-
-				// if its a package-getter-rb, we have 2 kinds of SAs and each of them is handled differently
-				// else if its a secret-configmap-rb, we have only one SA which is fission-fetcher
-				if roleBinding.Name == fv1.PackageGetterRB {
-					// check if there is an env obj in saNs
-					envList, err := fissionClient.CoreV1().Environments(saNs).List(ctx, metav1.ListOptions{})
-					if err != nil {
-						logger.Error("error fetching environment list in service account namespace", zap.Error(err), zap.String("namespace", saNs))
-						continue
-					}
-
-					// if the SA in this iteration is fission-builder, then we need to only check
-					// if either there's at least one env object in the SA's namespace, or,
-					// if there's at least one function in the role-binding namespace with env reference
-					// to the SA's namespace.
-					// if neither, then we can remove this SA from this role-binding
-					if subj.Name == fv1.FissionBuilderSA {
-						if len(envList.Items) == 0 && !funcEnvReference {
-							saToRemove[utils.MakeSAMapKey(subj.Name, subj.Namespace)] = true
-						}
-					}
-
-					// if the SA in this iteration is fission-fetcher, then in addition to above checks,
-					// we also need to check if there's at least one function with executor type New deploy
-					// in the rolebinding's namespace.
-					// if none of them are true, then remove this SA from this role-binding
-					if subj.Name == fv1.FissionFetcherSA {
-						if len(envList.Items) == 0 && !ndmFunc && !funcEnvReference {
-							// remove SA from rolebinding
-							saToRemove[utils.MakeSAMapKey(subj.Name, subj.Namespace)] = true
-						}
-					}
-				} else if roleBinding.Name == fv1.SecretConfigMapGetterRB {
-					// if there's not even one function in the role-binding's namespace and there's not even
-					// one function with env reference to the SA's namespace, then remove that SA
-					// from this role-binding
-					if !ndmFunc && !funcEnvReference {
-						saToRemove[utils.MakeSAMapKey(subj.Name, subj.Namespace)] = true
-					}
-				}
-			}
-
-			// finally, make a call to RemoveSAFromRoleBindingWithRetries for all the service accounts that need to be removed
-			// for the role-binding in this iteration
-			if len(saToRemove) != 0 {
-				logger.Debug("removing service accounts from role binding",
-					zap.Any("service_accounts", saToRemove),
-					zap.String("role_binding_name", roleBinding.Name),
-					zap.String("role_binding_namespace", roleBinding.Namespace))
-
-				// call this once in the end for each role-binding
-				err = utils.RemoveSAFromRoleBindingWithRetries(ctx, logger, client, roleBinding.Name, roleBinding.Namespace, saToRemove)
-				if err != nil {
-					// if there's an error, we just log it and proceed with the next role-binding, hoping that this role-binding
-					// will be processed in next iteration.
-					logger.Debug("error removing service account from role binding",
-						zap.Error(err),
-						zap.Any("service_accounts", saToRemove),
-						zap.String("role_binding_name", roleBinding.Name),
-						zap.String("role_binding_namespace", roleBinding.Namespace))
-				}
-			}
-		}
-	}
 }

pkg/executor/util/util.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -119,18 +120,14 @@ func ConvertConfigSecrets(ctx context.Context, fn *fv1.Function, kc kubernetes.I
 	return envFromSources, nil
 }
 
-func GetSpecFromConfigMap(ctx context.Context, kubeClient kubernetes.Interface, cm string, cmns string) (*apiv1.PodSpec, error) {
+func GetSpecFromConfigMap(filePath string) (*apiv1.PodSpec, error) {
-
+	content, err := os.ReadFile(filePath)
-	podSpecPatch, err := kubeClient.CoreV1().ConfigMaps(cmns).Get(ctx, cm, metav1.GetOptions{})
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error reading YAML file %s: %w", filePath, err)
 	}
-
+	additionalSpec := &apiv1.PodSpec{}
-	var additionalSpec apiv1.PodSpec
+	err = yaml.UnmarshalStrict(content, &additionalSpec)
-
+	return additionalSpec, err
-	err = yaml.Unmarshal([]byte(podSpecPatch.Data["spec"]), &additionalSpec)
-
-	return &additionalSpec, err
 }
 
 func GetObjectReaperInterval(logger *zap.Logger, executorType fv1.ExecutorType, defaultReaperInterval uint) uint {

pkg/executor/util/util_test.go

@@ -17,57 +17,45 @@ limitations under the License.
 package util
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"reflect"
 	"testing"
 
-	apiv1 "k8s.io/api/core/v1"
+	"github.com/google/go-cmp/cmp"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/fake"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	apiv1 "k8s.io/api/core/v1"
 )
 
 func TestGetSpecFromConfigMap(t *testing.T) {
-
+	runtimePodSpecPath := "runtime-podspec-patch.yaml"
-	kubeClient := fake.NewSimpleClientset()
+	tempDir := t.TempDir()
-
-	var permissionNum int64 = 10001
-	var runAsNonRoot bool = true
-
-	configMapData := make(map[string]string, 0)
 	specPatch := `
 securityContext:
   fsGroup: 10001
   runAsGroup: 10001
   runAsNonRoot: true
   runAsUser: 10001`
-
+	err := os.WriteFile(tempDir+"/"+runtimePodSpecPath, []byte(specPatch), 0644)
-	configMapData["spec"] = specPatch
-
-	testConfigMap := apiv1.ConfigMap{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "ConfigMap",
-			APIVersion: "v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-config-map",
-			Namespace: "fission",
-		},
-		Data: configMapData,
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	configmap, err := kubeClient.CoreV1().ConfigMaps("fission").Create(ctx, &testConfigMap, metav1.CreateOptions{})
 	if err != nil {
-		t.Errorf("Error creating configmap %v", err)
+		t.Errorf("Error writing to file %s", err)
+	}
+	specPatch2 := `
+securityContext2:
+securityContext:
+  fsGroup: "invalida_input"
+  runAsGroup: 10001
+  runAsNonRoot: true
+  runAsUser: 10001`
+	err = os.WriteFile(tempDir+"/"+runtimePodSpecPath+"2", []byte(specPatch2), 0644)
+	if err != nil {
+		t.Errorf("Error writing to file %s", err)
 	}
 
-	t.Logf("Configmap: %v", configmap.Data)
+	var permissionNum int64 = 10001
+	var runAsNonRoot bool = true
 
 	testSpecPatch := apiv1.PodSpec{
 		SecurityContext: &apiv1.PodSecurityContext{
@@ -79,42 +67,41 @@ securityContext:
 	}
 	tests := []struct {
 		name    string
-		cm      string
+		path    string
-		cmns    string
 		want    *apiv1.PodSpec
 		wantErr bool
 	}{
 		{
-			name:    "Configmap exists",
+			name:    "File exists with valid data",
-			cm:      "test-config-map",
+			path:    tempDir + "/" + runtimePodSpecPath,
-			cmns:    "fission",
 			want:    &testSpecPatch,
 			wantErr: false,
 		},
 		{
-			name:    "Configmap does not exists",
+			name:    "File with invalid data",
-			cm:      "wrongname",
+			path:    tempDir + "/" + runtimePodSpecPath + "2",
-			cmns:    "fission",
 			want:    nil,
 			wantErr: true,
 		},
 		{
-			name:    "Wrong namespace",
+			name:    "File does not exist",
-			cm:      "test-config-map",
+			path:    tempDir + "/" + "notexist",
-			cmns:    "fissio",
 			want:    nil,
 			wantErr: true,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := GetSpecFromConfigMap(ctx, kubeClient, tt.cm, tt.cmns)
+			got, err := GetSpecFromConfigMap(tt.path)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("GetSpecFromConfigMap() error = %v, wantErr %v", err, tt.wantErr)
 				return
 			}
+			if err != nil {
+				return
+			}
 			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("GetSpecFromConfigMap() got = %v, want %v", got, tt.want)
+				t.Errorf("GetSpecFromConfigMap() diff = %s", cmp.Diff(tt.want, got))
 			}
 		})
 	}

pkg/fetcher/config/config.go

@@ -1,10 +1,8 @@
 package container
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
-	"log"
 	"os"
 	"path/filepath"
 
@@ -14,7 +12,6 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/kubernetes"
 
 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/fetcher"
@@ -91,16 +88,6 @@ func MakeFetcherConfig(sharedMountPath string) (*Config, error) {
 	}, nil
 }
 
-func (cfg *Config) SetupServiceAccount(ctx context.Context, kubernetesClient kubernetes.Interface, namespace string, context interface{}) error {
-	_, err := utils.SetupSA(ctx, kubernetesClient, fv1.FissionFetcherSA, namespace)
-	if err != nil {
-		log.Printf("Error : %v creating %s in ns : %s for: %#v", err, fv1.FissionFetcherSA, namespace, context)
-		return err
-	}
-
-	return nil
-}
-
 func (cfg *Config) SharedMountPath() string {
 	return cfg.sharedMountPath
 }

pkg/fetcher/fetcher.go

@@ -90,9 +90,14 @@ func MakeFetcher(logger *zap.Logger, sharedVolumePath string, sharedSecretPath s
 		fLogger.Fatal("error creating shared config directory", zap.Error(err), zap.String("directory", sharedConfigPath))
 	}
 
-	fissionClient, kubeClient, _, _, err := crd.MakeFissionClient()
+	clientGen := crd.NewClientGenerator()
+	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making the fission / kube client")
+		return nil, errors.Wrap(err, "error making the fission client")
+	}
+	kubeClient, err := clientGen.GetKubernetesClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "error making the kube client")
 	}
 
 	name, err := os.ReadFile(fv1.PodInfoMount + "/name")
@@ -762,22 +767,21 @@ func (fetcher *Fetcher) WsStartHandler(w http.ResponseWriter, r *http.Request) {
 		logger.Error("Error creating recorder", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	pods, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).List(ctx, metav1.ListOptions{
+
-		FieldSelector: "metadata.name=" + fetcher.Info.Name,
+	pod, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).Get(ctx, fetcher.Info.Name, metav1.GetOptions{})
-	})
 	if err != nil {
 		logger.Error("Failed to get the pod", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	for _, pod := range pods.Items {
+
-		ref, err := reference.GetReference(scheme.Scheme, &pod)
+	ref, err := reference.GetReference(scheme.Scheme, pod)
-		if err != nil {
+	if err != nil {
-			logger.Error("Could not get reference for pod", zap.Error(err))
+		logger.Error("Could not get reference for pod", zap.Error(err))
-			http.Error(w, err.Error(), http.StatusInternalServerError)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-		rec.Event(ref, corev1.EventTypeNormal, "WsConnectionStarted", "Websocket connection has been formed on this pod")
-		logger.Info("Sent websocket initiation event")
 	}
+	rec.Event(ref, corev1.EventTypeNormal, "WsConnectionStarted", "Websocket connection has been formed on this pod")
+	logger.Info("Sent websocket initiation event")
+
 	w.WriteHeader(http.StatusOK)
 }
 
@@ -796,24 +800,22 @@ func (fetcher *Fetcher) WsEndHandler(w http.ResponseWriter, r *http.Request) {
 		logger.Error("Error creating recorder", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	pods, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).List(ctx, metav1.ListOptions{
+	pod, err := fetcher.kubeClient.CoreV1().Pods(fetcher.Info.Namespace).Get(ctx, fetcher.Info.Name, metav1.GetOptions{})
-		FieldSelector: "metadata.name=" + fetcher.Info.Name,
-	})
 	if err != nil {
 		logger.Error("Failed to get the pod", zap.Error(err))
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
-	for _, pod := range pods.Items {
+
-		// There will only be one time since we've used field selector
+	// There will only be one time since we've used field selector
-		ref, err := reference.GetReference(scheme.Scheme, &pod)
+	ref, err := reference.GetReference(scheme.Scheme, pod)
-		if err != nil {
+	if err != nil {
-			logger.Error("Could not get reference for pod", zap.Error(err))
+		logger.Error("Could not get reference for pod", zap.Error(err))
-			http.Error(w, err.Error(), http.StatusInternalServerError)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-		// We could use Eventf and supply the amount of time the connection was inactive although, in case of multiple connections, it doesn't make sense
-		rec.Event(ref, corev1.EventTypeNormal, "NoActiveConnections", "Connection has been inactive")
-		logger.Info("Sent no active connections event")
 	}
+	// We could use Eventf and supply the amount of time the connection was inactive although, in case of multiple connections, it doesn't make sense
+	rec.Event(ref, corev1.EventTypeNormal, "NoActiveConnections", "Connection has been inactive")
+	logger.Info("Sent no active connections event")
+
 	w.WriteHeader(http.StatusOK)
 }