Update chart version and app version to v1.20.4 (#3006)

Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>

.codecov.yml

@@ -1,11 +1,9 @@
 ignore:
   - "charts"
-  - "demos"
-  - "Documentation"
-  - "examples"
-  - "test"
+  - "test/"
   - "tools"
-  - "pkg/apis/genclient"
+  - "pkg/generated" # generated code
+  - "pkg/apis/*/*/zz_generated*" # generated code
 coverage:
   status:
     project:

.github/workflows/codeql.yaml

@@ -25,18 +25,18 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
         with:
           languages: go
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7

.github/workflows/lint-dashboards.yaml

@@ -19,12 +19,12 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: 1.18.5
+          go-version-file: "go.mod"
 
       - name: Install dashboard linter
         run: |

.github/workflows/lint.yaml

@@ -18,19 +18,19 @@ on:
   workflow_dispatch:
 
 env:
-  GOLANGCI_LINT_VERSION: v1.49.0
+  GOLANGCI_LINT_VERSION: v1.57.0
   GOLANGCI_LINT_TIMEOUT: 5m
 
 jobs:
   lint:
     runs-on: ubuntu-latest
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
@@ -41,8 +41,9 @@ jobs:
           go mod download
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
+          skip-cache: true
           version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --timeout=${{ env.GOLANGCI_LINT_TIMEOUT }}
 
@@ -61,7 +62,7 @@ jobs:
         run: ./hack/runtests.sh
 
       - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           token: ${{secrets.CODECOV_TOKEN}}
           flags: unittests

.github/workflows/push_pr.yaml

@@ -22,8 +22,9 @@ on:
   workflow_dispatch:
 
 env:
-  HELM_VERSION: v3.10.1
-  KIND_VERSION: v0.17.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.23.0
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   # Job to run change detection
@@ -33,42 +34,43 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kindversion: ["v1.19.16", "v1.20.15", "v1.21.14"]
+        kindversion: ["v1.25.16", "v1.27.13", "v1.30.0"]
         os: [ubuntu-latest]
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: fission/examples
           path: examples
 
       - name: Helm installation
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Kind Cluster
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: kindest/node:${{ matrix.kindversion }}
+          node_image: kindest/node:${{ matrix.kindversion }}
           version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
           config: kind.yaml
 
       - name: Configuring and testing the Installation
         run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl get nodes
           sudo apt-get install -y apache2-utils
-          kubectl config use-context kind-kind
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl config view
 
       - name: Helm chart lint
@@ -77,21 +79,23 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v1.39.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Setup Prometheus Stack
         run: |
           helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
           helm repo update
           kubectl create ns monitoring
-          helm install monitoring prometheus-community/prometheus -n monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
 
       - name: Build and Install Fission CLI
         run: |
@@ -110,7 +114,6 @@ jobs:
       - name: Port-forward fission components
         run: |
           kubectl port-forward svc/router 8888:80 -nfission &
-          kubectl port-forward svc/controller 8889:80 -nfission &
 
       - name: Get fission version
         timeout-minutes: 10
@@ -131,22 +134,183 @@ jobs:
         timeout-minutes: 10
         if: ${{ always() }}
         run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
 
       - name: Archive fission dump
         timeout-minutes: 10
         if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
           retention-days: 5
 
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
       - name: Archive kind logs
         timeout-minutes: 10
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
           retention-days: 5
+
+  # Job to ensure backward compatibility if function and builder pods are created
+  # inside functionNamespace and builderNamespace
+  integration-test-old:
+    runs-on: ${{ matrix.os }}
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'run-old-ci') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        kindversion: ["v1.19.16"]
+        os: [ubuntu-latest]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: setup go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Checkout sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          repository: fission/examples
+          path: examples
+
+      - name: Helm installation
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Kind Cluster
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        with:
+          node_image: kindest/node:${{ matrix.kindversion }}
+          version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
+          config: kind.yaml
+
+      - name: Configuring and testing the Installation
+        run: |
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl get nodes
+          sudo apt-get install -y apache2-utils
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
+          kubectl config view
+
+      - name: Helm chart lint
+        run: |
+          helm lint charts/fission-all/
+
+      - name: Install Skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          sudo install skaffold /usr/local/bin/
+          skaffold version
+
+      - name: Install GoReleaser
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with:
+          install-only: true
+          version: "~> v1"
+
+      - name: Setup Prometheus Stack
+        run: |
+          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+          helm repo update
+          kubectl create ns monitoring
+          helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring \
+          --version 45.28.0 --set grafana.enabled=false --set alertmanager.enabled=false
+
+      - name: Build and Install Fission CLI
+        run: |
+          make debug-vars
+          make build-fission-cli
+          sudo make install-fission-cli
+          sudo chmod +x /usr/local/bin/fission
+
+      - name: Build and Install Fission
+        timeout-minutes: 10
+        run: |
+          kubectl create ns fission
+          make create-crds
+          SKAFFOLD_PROFILE=kind-ci-old make skaffold-deploy
+
+      - name: Port-forward fission components
+        run: |
+          kubectl port-forward svc/router 8888:80 -nfission &
+
+      - name: Get fission version
+        timeout-minutes: 10
+        run: |
+          fission version
+
+      - name: Integration tests
+        timeout-minutes: 90
+        run: |
+          export FUNCTION_NAMESPACE=fission-function
+          export BUILDER_NAMESPACE=fission-builder
+          ./test/kind_CI.sh
+
+      - name: Collect Fission Dump
+        timeout-minutes: 5
+        if: ${{ always() }}
+        run: |
+          command -v fission && fission support dump
+
+      - name: Kind export logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          kind export logs --name kind kind-logs
+
+      - name: Backup prometheus data
+        timeout-minutes: 10
+        if: ${{ always() }}
+        run: |
+          TRACE=1 ./hack/backup-prometheus.sh
+
+      - name: Archive fission dump
+        timeout-minutes: 10
+        if: ${{ failure() || cancelled() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: fission-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: fission-dump/*.zip
+          retention-days: 5
+
+      - name: Archive prometheus dump
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: prom-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: /tmp/prometheus/*
+          retention-days: 5
+
+      - name: Archive kind logs
+        timeout-minutes: 10
+        if: ${{ always() }}
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: kind-logs-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          path: kind-logs/*
+          retention-days: 5

.github/workflows/release.yaml

@@ -6,20 +6,21 @@ on:
       - v2.**
 
 env:
-  KIND_VERSION: v0.17.0
-  KIND_NODE_IMAGE_TAG: v1.19.16
+  KIND_VERSION: v0.23.0
+  KIND_NODE_IMAGE_TAG: v1.25.16
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   create-draft-release:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
       - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
@@ -29,30 +30,40 @@ jobs:
         run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
+          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
           version: ${{ env.KIND_VERSION }}
           config: kind.yaml
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
-      - name: Docker Login
-        uses: docker/login-action@v2
+      - name: Login to ghcr.io
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to docker.io
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
         with:
-          cosign-release: 'v1.12.0'
+          cosign-release: "v2.2.1"
+
       - name: Check cosign install!
         run: cosign version
 
@@ -69,9 +80,9 @@ jobs:
         shell: bash
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
-          version: latest
+          version: "~> v1"
           args: release
         env:
           COSIGN_PWD: ${{ secrets.COSIGN_PWD }}

.github/workflows/upgrade_test.yaml

@@ -22,8 +22,9 @@ on:
   workflow_dispatch:
 
 env:
-  HELM_VERSION: v3.10.1
-  KIND_VERSION: v0.17.0
+  HELM_VERSION: v3.13.0
+  KIND_VERSION: v0.23.0
+  KIND_CLUSTER_NAME: kind
 
 jobs:
   upgrade-test:
@@ -32,40 +33,42 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kindimage: ["kindest/node:v1.19.16"]
+        kindimage: ["kindest/node:v1.25.16"]
         os: [ubuntu-latest]
     steps:
       - name: Checkout action sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Setup go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Setup Helm
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Setup Kind Clutser
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
-          image: ${{ matrix.kindimage }}
+          node_image: ${{ matrix.kindimage }}
           version: ${{ env.KIND_VERSION }}
+          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           install-only: true
+          version: "~> v1"
 
       - name: Setup kubectl & fetch node information
         run: |
-          kubectl cluster-info --context kind-kind
+          kubectl cluster-info --context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl get nodes
           kubectl get storageclasses.storage.k8s.io
-          kubectl config use-context kind-kind
+          kubectl config use-context kind-${{ env.KIND_CLUSTER_NAME }}
           kubectl config set-context --current --namespace=default
           kubectl config view
 
@@ -99,11 +102,11 @@ jobs:
       - name: Kind export logs
         if: ${{ always() }}
         run: |
-          kind export logs --name kind kind-logs
+          kind export logs --name ${{ env.KIND_CLUSTER_NAME }} kind-logs
 
       - name: Archive fission dump
         if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
@@ -111,7 +114,7 @@ jobs:
 
       - name: Archive kind logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*

.gitignore

@@ -9,6 +9,7 @@ cmd/reporter/reporter
 
 # Logs
 test/logs/
+test/e2e/cli/fission-dump/
 
 # Pycharm IDE
 .idea
@@ -37,3 +38,6 @@ manifest/
 coverage.txt
 
 cosign.key
+
+# Dumps
+.dumps/

.golangci.yaml

@@ -32,4 +32,4 @@ linters-settings:
   goimports:
     # put imports beginning with prefix after 3rd-party packages;
     # it's a comma-separated list of prefixes
-    local-prefixes: github.com/fission/fission
+    local: github.com/fission/fission

.goreleaser.yml

@@ -36,9 +36,6 @@ builds:
     goarch:
       - amd64
       - arm64
-      - arm
-    goarm:
-      - 7
     binary: builder
     dir: ./cmd/builder
   - <<: *build-linux
@@ -60,12 +57,6 @@ builds:
     ignore:
       - goos: windows
         goarch: arm64
-      - goos: darwin
-        goarch: arm
-        goarm: 7
-      - goos: windows
-        goarch: arm
-        goarm: 7
   - <<: *build-linux
     id: pre-upgrade-checks
     binary: pre-upgrade-checks
@@ -84,8 +75,12 @@ dockers:
     image_templates:
       - "fission/builder:latest-amd64"
       - "fission/builder:{{ .Tag }}-amd64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-amd64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/amd64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -96,28 +91,64 @@ dockers:
     image_templates:
       - "fission/fetcher:latest-amd64"
       - "fission/fetcher:{{ .Tag }}-amd64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-amd64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - fission-bundle
     image_templates:
       - "fission/fission-bundle:latest-amd64"
       - "fission/fission-bundle:{{ .Tag }}-amd64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-amd64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - pre-upgrade-checks
     image_templates:
       - "fission/pre-upgrade-checks:latest-amd64"
       - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-amd64
     ids:
       - reporter
     image_templates:
       - "fission/reporter:latest-amd64"
       - "fission/reporter:{{ .Tag }}-amd64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
+      - "ghcr.io/fission/reporter:latest-amd64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+    dockerfile: cmd/reporter/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - &docker-arm64
     use: buildx
     goos: linux
@@ -127,8 +158,12 @@ dockers:
     image_templates:
       - "fission/builder:latest-arm64"
       - "fission/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/builder:latest-arm64"
+      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+    dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
       - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
@@ -139,123 +174,145 @@ dockers:
     image_templates:
       - "fission/fetcher:latest-arm64"
       - "fission/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
+      - "ghcr.io/fission/fetcher:latest-arm64"
+      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+    dockerfile: cmd/fetcher/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - fission-bundle
     image_templates:
       - "fission/fission-bundle:latest-arm64"
       - "fission/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
+      - "ghcr.io/fission/fission-bundle:latest-arm64"
+      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+    dockerfile: cmd/fission-bundle/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - pre-upgrade-checks
     image_templates:
       - "fission/pre-upgrade-checks:latest-arm64"
       - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
+      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
+      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+    dockerfile: cmd/preupgradechecks/Dockerfile
+    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Tag}}"
   - <<: *docker-arm64
     ids:
       - reporter
     image_templates:
       - "fission/reporter:latest-arm64"
       - "fission/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile.reporter
-  - &docker-armv7
-    use: buildx
-    goos: linux
-    goarch: arm
-    goarm: 7
-    ids:
-      - builder
-    image_templates:
-      - "fission/builder:latest-armv7"
-      - "fission/builder:{{ .Tag }}-armv7"
-    dockerfile: cmd/builder/Dockerfile.fission-builder
+      - "ghcr.io/fission/reporter:latest-arm64"
+      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+    dockerfile: cmd/reporter/Dockerfile
     build_flag_templates:
-      - "--platform=linux/arm/v7"
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--platform=linux/arm64"
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - fetcher
-    image_templates:
-      - "fission/fetcher:latest-armv7"
-      - "fission/fetcher:{{ .Tag }}-armv7"
-    dockerfile: cmd/fetcher/Dockerfile.fission-fetcher
-  - <<: *docker-armv7
-    ids:
-      - fission-bundle
-    image_templates:
-      - "fission/fission-bundle:latest-armv7"
-      - "fission/fission-bundle:{{ .Tag }}-armv7"
-    dockerfile: cmd/fission-bundle/Dockerfile.fission-bundle
-  - <<: *docker-armv7
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "fission/pre-upgrade-checks:latest-armv7"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-    dockerfile: cmd/preupgradechecks/Dockerfile.fission-preupgradechecks
-  - <<: *docker-armv7
-    ids:
-      - reporter
-    image_templates:
-      - "fission/reporter:latest-armv7"
-      - "fission/reporter:{{ .Tag }}-armv7"
-    dockerfile: cmd/reporter/Dockerfile.reporter
 docker_manifests:
+  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/builder:{{ .Tag }}-amd64
+      - ghcr.io/fission/builder:{{ .Tag }}-arm64
   - name_template: fission/builder:{{ .Tag }}
     image_templates:
       - fission/builder:{{ .Tag }}-amd64
       - fission/builder:{{ .Tag }}-arm64
-      - fission/builder:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
+      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
   - name_template: fission/fetcher:{{ .Tag }}
     image_templates:
       - fission/fetcher:{{ .Tag }}-amd64
       - fission/fetcher:{{ .Tag }}-arm64
-      - fission/fetcher:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
+      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
   - name_template: fission/fission-bundle:{{ .Tag }}
     image_templates:
       - fission/fission-bundle:{{ .Tag }}-amd64
       - fission/fission-bundle:{{ .Tag }}-arm64
-      - fission/fission-bundle:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
+      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
   - name_template: fission/pre-upgrade-checks:{{ .Tag }}
     image_templates:
       - fission/pre-upgrade-checks:{{ .Tag }}-amd64
       - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-      - fission/pre-upgrade-checks:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+    image_templates:
+      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
+      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
   - name_template: fission/reporter:{{ .Tag }}
     image_templates:
       - fission/reporter:{{ .Tag }}-amd64
       - fission/reporter:{{ .Tag }}-arm64
-      - fission/reporter:{{ .Tag }}-armv7
+  - name_template: ghcr.io/fission/builder:latest
+    image_templates:
+      - ghcr.io/fission/builder:latest-amd64
+      - ghcr.io/fission/builder:latest-arm64
   - name_template: fission/builder:latest
     image_templates:
       - fission/builder:latest-amd64
       - fission/builder:latest-arm64
-      - fission/builder:latest-armv7
+  - name_template: ghcr.io/fission/fetcher:latest
+    image_templates:
+      - ghcr.io/fission/fetcher:latest-amd64
+      - ghcr.io/fission/fetcher:latest-arm64
   - name_template: fission/fetcher:latest
     image_templates:
       - fission/fetcher:latest-amd64
       - fission/fetcher:latest-arm64
-      - fission/fetcher:latest-armv7
+  - name_template: ghcr.io/fission/fission-bundle:latest
+    image_templates:
+      - ghcr.io/fission/fission-bundle:latest-amd64
+      - ghcr.io/fission/fission-bundle:latest-arm64
   - name_template: fission/fission-bundle:latest
     image_templates:
       - fission/fission-bundle:latest-amd64
       - fission/fission-bundle:latest-arm64
-      - fission/fission-bundle:latest-armv7
+  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
+    image_templates:
+      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
+      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
   - name_template: fission/pre-upgrade-checks:latest
     image_templates:
       - fission/pre-upgrade-checks:latest-amd64
       - fission/pre-upgrade-checks:latest-arm64
-      - fission/pre-upgrade-checks:latest-armv7
+  - name_template: ghcr.io/fission/reporter:latest
+    image_templates:
+      - ghcr.io/fission/reporter:latest-amd64
+      - ghcr.io/fission/reporter:latest-arm64
   - name_template: fission/reporter:latest
     image_templates:
       - fission/reporter:latest-amd64
       - fission/reporter:latest-arm64
-      - fission/reporter:latest-armv7
 changelog:
   skip: false
 archives:
@@ -281,6 +338,7 @@ signs:
     - '--output-certificate=${certificate}'
     - '--output-signature=${signature}'
     - '${artifact}'
+    - '--yes' # needed for cosign 2.0.0+
 
 # signs our docker image
 # https://goreleaser.com/customization/docker_sign
@@ -292,4 +350,5 @@ docker_signs:
   args:
     - 'sign'
     - '--key=cosign.key'
-    - '${artifact}'
+    - '${artifact}'
+    - '--yes' # needed for cosign 2.0.0+

.mergify.yml

@@ -8,10 +8,10 @@ pull_request_rules:
       - check-success=CodeQL-Build
       - check-success=CodeQL
       - check-success=lint 
-      - check-success=upgrade-test (kindest/node:v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.19.11, ubuntu-latest)
-      - check-success=integration-test (v1.20.7, ubuntu-latest)
-      - check-success=integration-test (v1.21.1, ubuntu-latest)
+      - check-success=upgrade-test (kindest/node:v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.23.17, ubuntu-latest)
+      - check-success=integration-test (v1.25.11, ubuntu-latest)
+      - check-success=integration-test (v1.27.3, ubuntu-latest)
     actions:
       merge:
         method: squash

Makefile

@@ -23,6 +23,7 @@ COMMITSHA ?= $(shell git rev-parse HEAD)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 GOAMD64 ?= $(shell go env GOAMD64)
+GOPATH ?= $(shell go env GOPATH)
 
 FISSION-CLI-SUFFIX :=
 ifeq ($(GOOS), windows)
@@ -51,7 +52,7 @@ test-run: code-checks
 
 ### Binaries
 build-fission-cli:
-	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target --id fission-cli
+	@GOOS=$(GOOS) GOARCH=$(GOARCH) GOAMD64=$(GOAMD64) GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target --id fission-cli
 
 install-fission-cli:
 	# TODO: Fix this hack, replace v1 with GOAMD64
@@ -59,21 +60,21 @@ install-fission-cli:
 
 ### Codegen
 codegen: controller-gen-install
-	@controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
 	@./hack/update-codegen.sh
+	$(GOPATH)/bin/controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
 
 ### CRDs
 controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.10.0
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.15.0
 
 generate-crds: controller-gen-install
-	controller-gen crd \
+	$(GOPATH)/bin/controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1
 
 ### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
 generate-webhooks: controller-gen-install
-	controller-gen webhook \
+	$(GOPATH)/bin/controller-gen webhook \
 	 paths=./pkg/apis/core/v1 \
 	 output:dir=charts/fission-all/templates/webhook-server
 
@@ -99,11 +100,11 @@ generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"
 
 install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@v0.0.8
+	go install github.com/elastic/crd-ref-docs@v0.0.12
 
 generate-crd-ref-docs: install-crd-ref-docs
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	$(GOPATH)/bin/crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
@@ -111,12 +112,12 @@ generate-crd-ref-docs: install-crd-ref-docs
 all-generators: codegen generate-crds generate-swagger-doc generate-cli-docs generate-crd-ref-docs
 
 skaffold-prebuild:
-	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --rm-dist --single-target
-	@cp -v cmd/builder/Dockerfile.fission-builder dist/builder_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fetcher/Dockerfile.fission-fetcher dist/fetcher_linux_amd64_v1/Dockerfile
-	@cp -v cmd/fission-bundle/Dockerfile.fission-bundle dist/fission-bundle_linux_amd64_v1/Dockerfile
-	@cp -v cmd/reporter/Dockerfile.reporter dist/reporter_linux_amd64_v1/Dockerfile
-	@cp -v cmd/preupgradechecks/Dockerfile.fission-preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@GOOS=linux GOARCH=amd64 GORELEASER_CURRENT_TAG=$(VERSION) goreleaser build --snapshot --clean --single-target
+	@cp -v cmd/builder/Dockerfile dist/builder_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fetcher/Dockerfile dist/fetcher_linux_amd64_v1/Dockerfile
+	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
+	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
+	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
 
 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)
@@ -127,3 +128,10 @@ release:
 	@./hack/release.sh $(VERSION)
 	@./hack/release-tag.sh $(VERSION)
 	@./hack/changelog.sh
+
+## Envtest
+install-envtest:
+	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+
+setup-envtest:
+	setup-envtest -p path use 1.23.x

README.md

@@ -40,8 +40,9 @@
 
 --------------
 
-Fission is a fast serverless framework for Kubernetes with a focus on
-developer productivity and high performance.
+Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. With Fission, developers can easily create and deploy serverless functions that can be triggered by a variety of events, such as HTTP requests, messages from a message queue, or scheduled tasks.
+
+Fission provides a simple, easy-to-use interface for developers to create serverless functions in their language of choice, without having to worry about the underlying infrastructure. The framework also offers automatic scaling, so functions can scale up or down based on demand, without any additional configuration.
 
 Fission operates on _just the code_: Docker and Kubernetes are
 abstracted away under normal operation, though you can use both to

charts/fission-all/Chart.yaml

@@ -1,8 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.18.0-rc1
-appVersion: v1.18.0-rc1
+version: v1.20.4
+appVersion: v1.20.4
 description: Fission is a fast serverless framework for Kubernetes.
+kubeVersion: ">=1.25.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -21,4 +22,8 @@ maintainers:
   - name: Sanket Sudake
     email: sanket@infracloud.io
 engine: gotpl
-type: application
+type: application
+annotations:
+  artifacthub.io/signKey: |
+    fingerprint: 2EAE29FDF8A387050C82CD5ABBDD4FD6A1FFCBF6
+    url: https://raw.githubusercontent.com/fission/fission-charts/main/public_key/pgp_keys.asc

charts/fission-all/README.md

@@ -4,7 +4,7 @@
 
 ## Prerequisites
 
-- Kubernetes 1.19+
+- Kubernetes 1.23+
 - Helm 3+
 
 ## Get Repo Info
@@ -93,6 +93,25 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen
 
 A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions.
 
+### Upgrade from 1.18.x to 1.20.x
+
+We have removed controller service from fission-all chart.
+
+### Upgrade from 1.17.x to 1.18.x
+
+With 1.18.x, we have major change in the way we are deploying Fission.
+We have added parameters `defaultNamespace`, `additionalFissionNamespaces`, `functionNamespace` and `builderNamespace` to manage the namespaces.
+We watch and manage specific namespaces for Fission resources configured via `defaultNamespace` and `additionalFissionNamespaces` parameters.
+You dont need to worry about `builderNamespace` and `functionNamespace` parameters, unless you want to consider legacy Fission resources.
+
+Please refer to [core changes](https://fission.io/docs/releases/v1.18.0/#fission-core-changes) for more details.
+
+### Upgrade from 1.16.x to 1.17.x
+
+By default, Fission runs with the default security context. This means that it will be run as root. We have added settings in Helm chart for securityContext across all services in Fission. You can enable recommended securityContext settings during Fission installation.
+
+Please refer to [security context settings](https://fission.io/docs/releases/v1.17.0/#security-context-setting-for-fission-installation) for more details.
+
 ### Upgrade from 1.15.x to 1.16.x
 
 If you have been using `prometheus.enabled=true` in your fission-all chart, you will need to deploy the prometheus using prometheus community supported chart.

charts/fission-all/templates/NOTES.txt

@@ -11,14 +11,20 @@ Windows:
 
 2. You're ready to use Fission!
 
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+  You can create fission resources in the namespaces "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
+{{- else }}
+  You can create fission resources in the namespace "{{ .Values.defaultNamespace }}"
+{{- end }}
+
   # Create an environment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image fission/node-env --namespace {{ .Values.defaultNamespace }}
 
   # Get a hello world
   $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
 
   # Register this function with Fission
-  $ fission function create --name hello --env nodejs --code hello.js
+  $ fission function create --name hello --env nodejs --code hello.js --namespace {{ .Values.defaultNamespace }}
 
 {{- if .Values.authentication.enabled }}
 
@@ -29,6 +35,6 @@ Windows:
 {{- end }}
 
   # Run this function
-  $ fission function test --name hello
+  $ fission function test --name hello --namespace {{ .Values.defaultNamespace }}
   Hello, world!
 

charts/fission-all/templates/_fission-component-roles.tpl

@@ -15,28 +15,6 @@ rules:
   - patch
   - delete
 {{- end }}
-{{- define "controller-rules" }}
-rules:
-- apiGroups:
-  - fission.io
-  resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- end }}
 {{- define "executor-rules" }}
 rules:
 - apiGroups:

charts/fission-all/templates/_fission-kubernetes-roles.tpl

@@ -0,0 +1,384 @@
+{{- define "buildermgr-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - list
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "canaryconfig-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "executor-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+{{- if .Values.executor.serviceAccountCheck.enabled }}  
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - localsubjectaccessreviews
+  verbs:
+  - create   
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+{{- end }}      
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "fluentbit-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kubewatcher-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "kafka-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  - replicationcontrollers
+  - events
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "keda-kuberules" }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - replicationcontrollers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - keda.sh
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- if .Values.mqt_keda.enabled }}
+- apiGroups:
+  - keda.k8s.io
+  resources:
+  - scaledjobs
+  - scaledobjects
+  - scaledjobs/finalizers
+  - scaledjobs/status
+  - triggerauthentications
+  - triggerauthentications/status
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+{{- end }}
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
+{{- define "preupgrade-kuberules" }}
+# TODO: Kept for future in case preupgrade needs any permissions in the future
+rules: []
+{{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
+{{- define "router-kuberules" }}
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- define "timer-kuberules" }}
+rules: []
+{{- end }}

charts/fission-all/templates/_fission-kuberntes-role-generator.tpl

@@ -0,0 +1,64 @@
+{{- define "kubernetes-role-generator" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-2"
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+{{- if eq "buildermgr" .component }}
+{{- include "buildermgr-kuberules" . }}
+{{- end }}
+{{- if eq "canaryconfig" .component }}
+{{- include "canaryconfig-kuberules" . }}
+{{- end }}
+{{- if eq "fluentbit" .component }}
+{{- include "fluentbit-kuberules" . }}
+{{- end }}
+{{- if eq "executor" .component }}
+{{- include "executor-kuberules" . }}
+{{- end }}
+{{- if eq "kubewatcher" .component }}
+{{- include "kubewatcher-kuberules" . }}
+{{- end }}
+{{- if eq "kafka" .component }}
+{{- include "kafka-kuberules" . }}
+{{- end }}
+{{- if eq "keda" .component }}
+{{- include "keda-kuberules" . }}
+{{- end }}
+{{- if eq "preupgrade" .component }}
+{{- include "preupgrade-kuberules" . }}
+{{- end }}
+{{- if eq "router" .component }}
+{{- include "router-kuberules" . }}
+{{- end }}
+{{- if eq "timer" .component }}
+{{- include "timer-kuberules" . }}
+{{- end }}
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+{{- if eq "preupgrade" .component }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+{{- end }}
+  name: "{{ .Release.Name }}-{{ .component }}"
+  namespace: {{ .namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: "fission-{{ .component }}"
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-{{ .component }}"
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/fission-all/templates/_fission-role-generator.tpl

@@ -14,9 +14,6 @@ metadata:
 {{- if eq "buildermgr" .component }}
 {{- include "buildermgr-rules" . }}
 {{- end }}
-{{- if eq "controller" .component }}
-{{- include "controller-rules" . }}
-{{- end }}
 {{- if eq "executor" .component }}
 {{- include "executor-rules" . }}
 {{- end }}

charts/fission-all/templates/_function-access-role.tpl

@@ -13,18 +13,12 @@ rules:
   - secrets
   verbs:
   - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
 - apiGroups:
   - fission.io
   resources:
   - packages
   verbs:
-  - "get"
+  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -37,7 +31,7 @@ rules:
   resources:
   - packages
   verbs:
-  - "get"
+  - get
 - apiGroups:
   - ""
   resources:
@@ -45,6 +39,30 @@ rules:
   - secrets
   verbs:
   - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .namespace }}
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get  
 {{- end -}}
 
 {{- define "fissionFunction.rolebindings" }}
@@ -61,7 +79,11 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-fetcher
-    namespace: {{template "fission-function-ns" . }}
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -75,5 +97,27 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fission-builder
-    namespace: {{ template "fission-builder-ns" . }}
+    {{- if and (.Values.builderNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.builderNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+  namespace: {{ .namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-fission-fetcher-websocket
+subjects:
+  - kind: ServiceAccount
+    name: fission-fetcher
+    {{- if and (.Values.functionNamespace) (eq .namespace "default") }}
+    namespace: {{ .Values.functionNamespace }}
+    {{- else }}
+    namespace: {{ .namespace }}
+    {{- end }}    
 {{- end -}}

charts/fission-all/templates/_helpers.tpl

@@ -55,6 +55,22 @@ This template generates the image name for the deployment depending on the value
 {{- end }}
 {{- end -}}
 
+{{- define "reporterImage" -}}
+{{- if .Values.repository -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- else -}}
+  {{- if eq .Values.imageTag "" -}}
+    {{ .Values.postInstallReportImage }}
+  {{- else -}}
+    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
 {{- define "opentelemtry.envs" }}
 - name: OTEL_EXPORTER_OTLP_ENDPOINT
   value: "{{ .Values.openTelemetry.otlpCollectorEndpoint }}"
@@ -73,14 +89,27 @@ This template generates the image name for the deployment depending on the value
 {{- end }}
 
 {{- define "fission-resource-namespace.envs" }}
+- name: FISSION_BUILDER_NAMESPACE
+  value: "{{ .Values.builderNamespace }}"
+- name: FISSION_FUNCTION_NAMESPACE
+  value: "{{ .Values.functionNamespace }}"
+- name: FISSION_DEFAULT_NAMESPACE
+  value: "{{ .Values.defaultNamespace }}"
 - name: FISSION_RESOURCE_NAMESPACES
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
   value: "{{ .Values.defaultNamespace }},{{ join "," .Values.additionalFissionNamespaces }}"
 {{- else }}
   value: {{ .Values.defaultNamespace }}  
 {{- end }}
 {{- end }}
 
+{{- define "kube_client.envs" }}
+- name: KUBE_CLIENT_QPS
+  value: "{{ .Values.kubernetesClientQPS }}"
+- name: KUBE_CLIENT_BURST
+  value: "{{ .Values.kubernetesClientBurst }}"
+{{- end}}
+
 {{/*
 Define the svc's name
 */}}
@@ -100,6 +129,6 @@ Define the svc's name
 {{- if .Values.builderNamespace -}}
 {{- printf "%s" .Values.builderNamespace -}}
 {{- else -}}
-{{- printf "%s" .Values.builderNamespace -}}
+{{- printf "%s" .Values.defaultNamespace -}}
 {{- end -}}
 {{- end -}}

charts/fission-all/templates/analytics/nonhelm-install-job.yaml

@@ -26,15 +26,15 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "yaml-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
           env:
             - name: GA_TRACKING_ID
               value: "{{ .Values.gaTrackingID }}"
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-install-job.yaml

@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-install-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-install", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,4 +43,8 @@ spec:
         {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/analytics/post-upgrade-job.yaml

@@ -30,11 +30,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: post-upgrade-job
-        {{- if .Values.imageTag }}
-          image: {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-        {{- else }}
-          image: {{ .Values.postInstallReportImage }}
-        {{- end }}
+          image: {{ include "reporterImage" . | quote }}
           imagePullPolicy: {{ .Values.pullPolicy }}
           command: [ "/reporter" ]
           args: ["event", "-c", "fission-use", "-a", "helm-post-upgrade", "-l", "{{ .Chart.Name }}-{{ .Chart.Version }}"]
@@ -47,4 +43,8 @@ spec:
           {{- if .Values.terminationMessagePolicy }}
           terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
           {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/buildermgr/clusterrole.yaml

@@ -1,53 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - services
-  - serviceaccounts
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - list
-  - create
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/buildermgr/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-buildermgr
-subjects:
-  - kind: ServiceAccount
-    name: fission-buildermgr
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-buildermgr
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/buildermgr/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: builder-podspec-patch
 data: 
-  spec: |
+  builder-podspec-patch.yaml: |
     {{- toYaml .Values.builderPodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/buildermgr/deployment.yaml

@@ -39,12 +39,6 @@ spec:
           value: "{{ .Values.pullPolicy }}"
         - name: BUILDER_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"      
         - name: ENABLE_ISTIO
           value: "{{ .Values.enableIstio }}"
         - name: FETCHER_MINCPU
@@ -61,8 +55,16 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
+        {{- if .Values.builderPodSpec.enabled }}
+        volumeMounts:
+        - name: builder-podspec-patch-volume
+          mountPath: /etc/fission/builder-podspec-patch.yaml
+          subPath: builder-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
           - containerPort: 8080
             name: metrics
@@ -75,11 +77,17 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-buildermgr
+      {{- if .Values.builderPodSpec.enabled }}
+      volumes:
+      - name: builder-podspec-patch-volume
+        configMap:
+          name: builder-podspec-patch
+      {{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/buildermgr/role-fission-cr.yaml

@@ -1,7 +1,13 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/buildermgr/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "buildermgr") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "buildermgr") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "buildermgr") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "buildermgr") $) }}
+{{- end }}

charts/fission-all/templates/canary-config/clusterrole.yaml

@@ -1,43 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end }}

charts/fission-all/templates/canary-config/clusterrolebinding.yaml

@@ -1,14 +0,0 @@
-{{- if .Values.canaryDeployment.enabled }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-canaryconfig
-subjects:
-  - kind: ServiceAccount
-    name: fission-canaryconfig
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-canaryconfig
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}

charts/fission-all/templates/canary-config/deployment.yaml

@@ -37,7 +37,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:

charts/fission-all/templates/canary-config/role-fission-cr.yaml

@@ -1,7 +1,7 @@
 {{- if .Values.canaryDeployment.enabled }}
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
 {{- end }}

charts/fission-all/templates/canary-config/role-kubernetes.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.canaryDeployment.enabled }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "canaryconfig") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "canaryconfig") $) }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/controller/clusterrole.yaml

@@ -1,43 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-controller
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-{{- end -}}

charts/fission-all/templates/controller/clusterrolebinding.yaml

@@ -1,14 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-controller
-subjects:
-  - kind: ServiceAccount
-    name: fission-controller
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-controller
-  apiGroup: rbac.authorization.k8s.io
-{{- end -}}

charts/fission-all/templates/controller/deployment.yaml

@@ -1,102 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    svc: controller
-    application: fission-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      svc: controller
-      application: fission-api
-  template:
-    metadata:
-      labels:
-        svc: controller
-        application: fission-api
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/path: "/metrics"
-        prometheus.io/port: "8080"
-    spec:
-      {{- if .Values.controller.securityContext.enabled }}
-      securityContext: {{- omit .Values.controller.securityContext "enabled" | toYaml | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: controller
-        image: {{ include "fission-bundleImage" . | quote }}
-        imagePullPolicy: {{ .Values.pullPolicy }}
-        command: ["/fission-bundle"]
-        args: ["--controllerPort", "8888"]
-        env:
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"  
-        - name: DEBUG_ENV
-          value: {{ .Values.debugEnv | quote }}
-        - name: PPROF_ENABLED
-          value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        {{- include "opentelemtry.envs" . | indent 8 }}
-        resources:
-          {{- toYaml .Values.controller.resources | nindent 10 }}
-        {{- if .Values.terminationMessagePath }}
-        terminationMessagePath: {{ .Values.terminationMessagePath }}
-        {{- end }}
-        {{- if .Values.terminationMessagePolicy }}
-        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
-        {{- end }}
-        readinessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          failureThreshold: 30
-        livenessProbe:
-          httpGet:
-            path: "/healthz"
-            port: 8888
-          initialDelaySeconds: 35
-          periodSeconds: 5
-        volumeMounts:
-        - name: config-volume
-          mountPath: /etc/config/config.yaml
-          subPath: config.yaml
-        ports:
-          - containerPort: 8080
-            name: metrics
-          - containerPort: 8888
-            name: http
-        {{- if .Values.pprof.enabled }}
-          - containerPort: 6060
-            name: pprof
-        {{- end }}
-  
-      serviceAccountName: fission-controller
-      volumes:
-      - name: config-volume
-        configMap:
-          name: feature-config
-{{- if .Values.priorityClassName }}
-      priorityClassName: {{ .Values.priorityClassName }}
-{{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-{{- if .Values.extraCoreComponentPodConfig }}
-{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
-{{- end }}
-{{- end -}}

charts/fission-all/templates/controller/role-fission-cr.yaml

@@ -1,9 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-{{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "controller") .) }}
-
-{{- if not .Values.singleDefaultNamespace }}
-{{- range $namespace := $.Values.additionalFissionNamespaces }}
-{{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "controller") $) }}
-{{- end }}
-{{- end }}
-{{- end -}}

charts/fission-all/templates/controller/serviceaccount.yaml

@@ -1,7 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fission-controller
-  namespace: {{ .Release.Namespace }}
-{{- end -}}

charts/fission-all/templates/controller/servicemonitor.yaml

@@ -1,24 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-{{- if .Values.serviceMonitor.enabled }}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: controller-monitor
-  {{- if .Values.serviceMonitor.namespace }}
-  namespace: {{ .Values.serviceMonitor.namespace }}
-  {{- end }}
-  {{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  namespaceSelector:
-    matchNames:
-      - {{ .Release.Namespace }}
-  selector:
-    matchLabels:
-      svc: controller
-  endpoints:
-  - targetPort: 8080
-{{- end -}}
-{{- end -}}

charts/fission-all/templates/controller/svc.yaml

@@ -1,20 +0,0 @@
-{{- if or (.Values.controller.enabled) (.Values.influxdb.enabled) }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: controller
-  labels:
-    svc: controller
-    application: fission-api
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-spec:
-  type: {{ .Values.serviceType }}
-  ports:
-  - port: 80
-    targetPort: 8888
-{{- if eq .Values.serviceType "NodePort" }}
-    nodePort: {{ .Values.controllerPort }}
-{{- end }}
-  selector:
-    svc: controller
-{{- end -}}

charts/fission-all/templates/executor/clusterrole.yaml

@@ -1,81 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-executor
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/executor/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-executor
-subjects:
-  - kind: ServiceAccount
-    name: fission-executor
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-executor
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/executor/configmap.yaml

@@ -4,6 +4,6 @@ kind: ConfigMap
 metadata:
   name: runtime-podspec-patch
 data: 
-  spec: |
+  runtime-podspec-patch.yaml: |
     {{- toYaml .Values.runtimePodSpec.podSpec | nindent 4 }}
 {{- end -}}

charts/fission-all/templates/executor/deployment.yaml

@@ -37,12 +37,6 @@ spec:
         {{- end }}
         - name: FETCHER_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
-        - name: FISSION_BUILDER_NAMESPACE
-          value: "{{ .Values.builderNamespace }}"
-        - name: FISSION_FUNCTION_NAMESPACE
-          value: "{{ .Values.functionNamespace }}"
-        - name: FISSION_DEFAULT_NAMESPACE
-          value: "{{ .Values.defaultNamespace }}"  
         - name: RUNTIME_IMAGE_PULL_POLICY
           value: "{{ .Values.pullPolicy }}"
         - name: ADOPT_EXISTING_RESOURCES
@@ -77,7 +71,14 @@ spec:
         - name: CONTAINER_OBJECT_REAPER_INTERVAL
           value: {{ .Values.executor.container.objectReaperInterval | quote }}
         {{- end}}
+        {{- if .Values.executor.serviceAccountCheck.enabled }}
+        - name: SERVICEACCOUNT_CHECK_ENABLED
+          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
+        - name: SERVICEACCOUNT_CHECK_INTERVAL
+          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        {{- end}}  
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         - name: HELM_RELEASE_NAME
           value: {{ .Release.Name | quote }}
         {{- include "opentelemtry.envs" . | indent 8 }}
@@ -96,6 +97,13 @@ spec:
             port: 8888
           initialDelaySeconds: 35
           periodSeconds: 5
+        {{- if .Values.runtimePodSpec.enabled }}
+        volumeMounts:
+        - name: runtime-podspec-patch-volume
+          mountPath: /etc/fission/runtime-podspec-patch.yaml
+          subPath: runtime-podspec-patch.yaml
+          readOnly: true
+        {{- end }}
         ports:
         - containerPort: 8080
           name: metrics
@@ -116,13 +124,19 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-executor
+      {{- if .Values.runtimePodSpec.enabled }}
+      volumes:
+      - name: runtime-podspec-patch-volume
+        configMap:
+          name: runtime-podspec-patch
+      {{- end }}
 {{- if .Values.executor.priorityClassName }}
       priorityClassName: {{ .Values.executor.priorityClassName }}
 {{- else if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
     {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}

charts/fission-all/templates/executor/role-fission-cr.yaml

@@ -1,7 +1,13 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
 {{- end }}
 {{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "fission-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/executor/role-kubernetes.yaml

@@ -0,0 +1,13 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "executor") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "executor") $) }}
+{{- end }}
+{{- end }}
+{{- if .Values.builderNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.builderNamespace "component" "executor") $) }}
+{{- end }}
+{{- if .Values.functionNamespace -}}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" .Values.functionNamespace "component" "executor") $) }}
+{{- end }}

charts/fission-all/templates/fluentbit/clusterrole.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch

charts/fission-all/templates/fluentbit/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-fluentbit
-subjects:
-  - kind: ServiceAccount
-    name: fission-fluentbit
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-fluentbit
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/fluentbit/fluentbit.yaml

@@ -118,6 +118,7 @@ spec:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: spec.nodeName
+            {{- include "fission-resource-namespace.envs" . | indent 12 }}
           command: ["/fission-bundle"]
           args: ["--logger"]
           volumeMounts:
@@ -127,10 +128,8 @@ spec:
             - name: docker-log
               mountPath: /var/lib/docker/containers
               readOnly: true
-{{- if .Values.logger.enableSecurityContext }}
           securityContext:
-            privileged: true
-{{- end }}
+            {{- toYaml .Values.logger.securityContext | nindent 12 }}
         - name: fluentbit
 {{- if .Values.repository }}
           image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -185,6 +184,10 @@ spec:
         - name: fluentbit-config
           configMap:
             name: {{ .Release.Name }}-fission-fluentbit
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
   updateStrategy:
     type: RollingUpdate
 {{- end }}

charts/fission-all/templates/fluentbit/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "fluentbit") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "fluentbit") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/influxdb/deployment.yaml

@@ -49,6 +49,10 @@ spec:
             secretKeyRef:
               name: influxdb
               key: password
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}

charts/fission-all/templates/kubewatcher/clusterrole.yaml

@@ -1,56 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/kubewatcher/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kubewatcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-kubewatcher
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kubewatcher
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/kubewatcher/deployment.yaml

@@ -29,7 +29,8 @@ spec:
           value: {{ .Values.debugEnv | quote }}
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.kubewatcher.resources | nindent 10 }}

charts/fission-all/templates/kubewatcher/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
 {{- end }}

charts/fission-all/templates/kubewatcher/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kubewatcher") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kubewatcher") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/misc-functions/clusterrole.yaml

@@ -1,33 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-secret-configmap-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - secrets
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-package-getter
-rules:
-  - apiGroups:
-      - "*"
-    resources:
-      - packages
-    verbs:
-      - "*"
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - rolebindings
-    verbs:
-      - "*"

charts/fission-all/templates/misc-functions/role.yaml

@@ -4,26 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.roles" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: {{ template "fission-function-ns" . }}
-  name: {{ .Release.Name }}-event-fetcher
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - "events"
-  verbs:
-  - "get"
-  - "list"
-  - "watch"
-  - "create"
-  - "update"
-  - "patch"
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.roles" (merge (dict "namespace" $namespace) $) }}
 {{- end }}

charts/fission-all/templates/misc-functions/rolebinding.yaml

@@ -4,22 +4,8 @@ Need to use merge function to pass in the current scope so that ".Release" value
 can be used
  */}}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" .Values.defaultNamespace) .) }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ template "fission-function-ns" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-event-fetcher
-subjects:
-  - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ template "fission-function-ns" . }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fissionFunction.rolebindings" (merge (dict "namespace" $namespace) $) }}
 {{- end }}

charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml

@@ -1,62 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-kafka
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/mqt-fission-kafka/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-kafka
-subjects:
-  - kind: ServiceAccount
-    name: fission-kafka
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-kafka
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-fission-kafka/deployment.yaml

@@ -25,11 +25,7 @@ spec:
     spec:
       containers:
       - name: mqtrigger
-      {{- if eq .Values.imageTag "" }}
-        image: "{{ .Values.image }}"
-      {{- else }}
-        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
-      {{- end }}
+        image: {{ include "fission-bundleImage" . | quote }}
         imagePullPolicy: {{ .Values.pullPolicy }}
         command: ["/fission-bundle"]
         args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]

charts/fission-all/templates/mqt-fission-kafka/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
 {{- end }}

charts/fission-all/templates/mqt-fission-kafka/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "kafka") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "kafka") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/mqt-keda/clusterrole.yaml

@@ -1,105 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-keda
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - keda.sh
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- if .Values.mqt_keda.enabled }}
-- apiGroups:
-  - keda.k8s.io
-  resources:
-  - scaledjobs
-  - scaledobjects
-  - scaledjobs/finalizers
-  - scaledjobs/status
-  - triggerauthentications
-  - triggerauthentications/status
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-{{- end }}
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  verbs:
-  - get
-  - list

charts/fission-all/templates/mqt-keda/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-keda
-subjects:
-  - kind: ServiceAccount
-    name: fission-keda
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-keda
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/mqt-keda/deployment.yaml

@@ -47,6 +47,7 @@ spec:
         - name: REDIS_IMAGE
           value: "{{ .Values.mqt_keda.connector_images.redis.image }}:{{ .Values.mqt_keda.connector_images.redis.tag }}"
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.mqt_keda.resources | nindent 10 }}

charts/fission-all/templates/mqt-keda/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
 {{- end }}

charts/fission-all/templates/mqt-keda/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "keda") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "keda") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/pre-upgrade-checks/pre-upgrade-job.yaml

@@ -37,6 +37,7 @@ spec:
         command: [ "/pre-upgrade-checks" ]
         env:
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- if .Values.terminationMessagePath }}
         terminationMessagePath: {{ .Values.terminationMessagePath }}
         {{- end }}
@@ -44,4 +45,8 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-preupgrade
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/fission-all/templates/pre-upgrade-checks/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "preupgrade") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "preupgrade") $) }}
 {{- end }}

charts/fission-all/templates/router/clusterrole.yaml

@@ -1,60 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-router
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind

charts/fission-all/templates/router/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-router
-subjects:
-  - kind: ServiceAccount
-    name: fission-router
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-router
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/router/deployment.yaml

@@ -12,7 +12,7 @@ metadata:
     application: fission-router
 spec:
 {{- if not .Values.router.deployAsDaemonSet }}
-  replicas: 1
+  replicas: {{ .Values.router.replicas | default 1 }}
 {{- end }}
   selector:
     matchLabels:
@@ -83,7 +83,8 @@ spec:
           value: {{ .Values.pprof.enabled | quote }}
         - name: DISPLAY_ACCESS_LOG
           value: {{ .Values.router.displayAccessLog | default false | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.router.resources | nindent 10 }}

charts/fission-all/templates/router/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
 {{- end }}

charts/fission-all/templates/router/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Release.Namespace "component" "router") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "router") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/router/secret.yaml

@@ -6,9 +6,9 @@ metadata:
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
   annotations:
-    "helm.sh/hook": pre-install
+    "helm.sh/hook": pre-install,pre-upgrade
 data:
   username: {{ .Values.authentication.authUsername | b64enc | quote }}
   password: {{ randAlphaNum 20 | b64enc | quote }}
-  jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
+  jwtSigningKey: {{ default (randAlphaNum 20) .Values.authentication.jwtSigningKey | b64enc | quote }}
 {{- end }}

charts/fission-all/templates/storagesvc/deployment.yaml

@@ -61,6 +61,7 @@ spec:
           value: {{ .Values.persistence.s3.region }}
         {{- end }}
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.storagesvc.resources | nindent 10 }}

charts/fission-all/templates/storagesvc/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "storagesvc") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "storagesvc") $) }}
 {{- end }}

charts/fission-all/templates/timer/clusterrole.yaml

@@ -1,48 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-timer
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  - pods
-  - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - events
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-  - patch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch

charts/fission-all/templates/timer/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-timer
-subjects:
-  - kind: ServiceAccount
-    name: fission-timer
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Release.Name }}-timer
-  apiGroup: rbac.authorization.k8s.io

charts/fission-all/templates/timer/deployment.yaml

@@ -30,6 +30,7 @@ spec:
         - name: PPROF_ENABLED
           value: {{ .Values.pprof.enabled | quote }}
         {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
         {{- include "opentelemtry.envs" . | indent 8 }}
         resources:
           {{- toYaml .Values.timer.resources | nindent 10 }}

charts/fission-all/templates/timer/role-fission-cr.yaml

@@ -1,6 +1,6 @@
 {{- include "fission-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
 
-{{- if not .Values.singleDefaultNamespace }}
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
 {{ include "fission-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
 {{- end }}

charts/fission-all/templates/timer/role-kubernetes.yaml

@@ -0,0 +1,7 @@
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "timer") .) }}
+
+{{- if gt (len .Values.additionalFissionNamespaces) 0 }}
+{{- range $namespace := $.Values.additionalFissionNamespaces }}
+{{ include "kubernetes-role-generator" (merge (dict "namespace" $namespace "component" "timer") $) }}
+{{- end }}
+{{- end }}

charts/fission-all/templates/webhook-server/webhooks.yaml

@@ -16,7 +16,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   creationTimestamp: null
-  name: mutating-webhook-configuration
+  name: fission-mutating-webhooks
   {{- if $certManagerEnabled }}
   annotations:
     cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
@@ -49,7 +49,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   creationTimestamp: null
-  name: validating-webhook-configuration
+  name: fission-validating-webhooks
   {{- if $certManagerEnabled }}
   annotations:
     cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"

charts/fission-all/values.yaml

@@ -1,7 +1,7 @@
 ## Fission chart configuration
 ##
 
-## serviceType to consider while creating Fission Controller service.
+## serviceType to consider while creating Fission webhook service.
 ## For minikube/kind, set this to NodePort, elsewhere use LoadBalancer or ClusterIP.
 ##
 serviceType: ClusterIP
@@ -14,7 +14,7 @@ routerServiceType: LoadBalancer
 ## repository represents base repository for images used in the chart.
 ## Keep it empty for using existing local image
 ##
-repository: index.docker.io
+repository: ghcr.io
 
 ## image represents the base image fission-bundle used by multiple Fission components.
 ## We alter arguments to the image to run a particular component.
@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.18.0-rc1
+imageTag: v1.20.4
 
 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -53,19 +53,13 @@ terminationMessagePath: /dev/termination-log
 ##
 terminationMessagePolicy: File
 
-## controllerPort represents the port at which the Fission controller service should be exposed.
-##
-controllerPort: 31313
-
 ## routerPort represents the port at which the Fission Router service should be exposed.
 ##
 routerPort: 31314
 
 ## defaultNamespace represents the namespace in which Fission custom resources will be created by the Fission user.
 ## This is different from the release namespace.
-## Please consider setting `singleDefaultNamespace` and `additionalFissionNamespaces` if you want
-## more than one namespace to be used for Fission custom resources.
-## Fission will watch the defaultNamespace only if `singleDefaultNamespace` is true.
+## Please consider setting `additionalFissionNamespaces` if you want more than one namespace to be used for Fission custom resources.
 ##
 defaultNamespace: default
 
@@ -81,12 +75,7 @@ builderNamespace: ""
 ##
 functionNamespace: ""
 
-## If true, fission will only watch for fission custom resources created in the `defaultNamespace` above.
-##
-singleDefaultNamespace: true
-
 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
-## Only works if `singleDefaultNamespace` is false.
 ## additionalFissionNamespaces: 
 ## - namespace1
 ## - namespace2
@@ -103,6 +92,13 @@ createNamespace: true
 ##
 enableIstio: false
 
+## Kubernetes client QPS and Burst settings
+##
+## kubernetesClientQPS represents the maximum queries per second to the kubernetes api server from client instances of fission components.
+kubernetesClientQPS: 200
+## kubernetesClientBurst represents the maximum burst queries to the kubernetes api server from client instances of fission components.
+kubernetesClientBurst: 500
+
 ## fetcher is a light weight component that helps in running functions.
 ## fetcher helps in fetching function source code/build and uploading it when function is invoked.
 ##
@@ -110,7 +106,7 @@ fetcher:
   ## image represents the image of the fetcher component.
   image: fission/fetcher
   ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.18.0-rc1
+  imageTag: v1.20.4
 
   ## Fetcher is only for to downloading or uploading archive.
   ## Normally, you don't need to change the value here, unless necessary.
@@ -166,7 +162,7 @@ executor:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -193,6 +189,14 @@ executor:
     ##
     ## objectReaperInterval: 5
 
+  serviceAccountCheck:
+    ## enables fission to create service account, roles and rolebinding for missing permission for builder and fetcher.
+    enabled: true
+    ## indicates the time interval in minutes, after that fission will create service account, roles and rolebinding for builder and fetcher.
+    ## interval will be applicable only if enable value is set to true.
+    ## default timing will be 0 minutes. That means check will run only once.
+    ## if you want to run check every 30 minutes then set interval to 30.
+    interval: 0
 ## router is responsible for routing function calls to the appropriate function.
 ##
 router:
@@ -210,6 +214,9 @@ router:
   ## deployAsDaemonSet decides whether to deploy router as a DaemonSet or a Deployment.
   ##
   deployAsDaemonSet: false
+  ## replicas decides how many router pods to deploy. Only used when deployAsDaemonSet is false.
+  ##
+  replicas: 1
   ## svcAddressMaxRetries is the max times for router to retry with a specific function service address
   ##
   svcAddressMaxRetries: 5
@@ -303,7 +310,7 @@ router:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -329,41 +336,13 @@ buildermgr:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
     runAsUser: 10001
     runAsGroup: 10001
 
-## controller is the component that the client talks to.
-## It contains CRUD APIs for functions, triggers, environments, Kubernetes event watches, etc. and proxy APIs to internal 3rd-party services.
-##
-controller:
-  enabled: false
-  ## Pod resources as:
-  ##  resources:
-  ##    limits:
-  ##      cpu: <tbd>
-  ##      memory: <tbd>
-  ##    requests:
-  ##      cpu: <tbd>
-  ##      memory: <tbd>
-  ##
-  resources: {}
-
-  ## Security Context
-  ## It holds pod-level and container level security configuration.
-  ## This is an experimental section, please verify before enabling in production.
-  ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
-  securityContext:
-    enabled: false
-    ## Mark it false, if you want to stop the non root user validation
-    runAsNonRoot: true
-    fsGroup: 10001
-    runAsUser: 10001
-    runAsGroup: 10001 
-
 ## webhook is the component that validates API calls.
 ## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
 ##
@@ -394,7 +373,7 @@ webhook:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -421,7 +400,7 @@ kubewatcher:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -453,7 +432,7 @@ storagesvc:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -480,7 +459,7 @@ timer:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -530,7 +509,7 @@ kafka:
   # version: "0.11.2.0"
 
 # The following components expose Prometheus metrics and have servicemonitors in this chart (disabled by default)
-# Controller, router, executor, storage svc
+# router, executor, storage svc
 serviceMonitor:
   enabled: false
   ##namespace in which you want to deploy servicemonitor
@@ -641,11 +620,22 @@ logger:
 
   ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked
   ## files and a state of offsets, this is very useful to resume a state if the ser-
-  ## vice is restarted. For Kubernetes environment with constraints like OpenShift,
+  ## vice is restarted.
+  ##
+  ## For Kubernetes environment with constraints like OpenShift,
   ## the containers are limited to write hostPath volume. Hence, we have to enable
   ## security context and set privileged to true.
   ##
-  enableSecurityContext: false
+  ## The user ID in runAsUser should have access to the `/var/log` and
+  ## `/var/lib/docker/containers` directories on your host.
+  ## On many hosts, this user might be root ,i.e., `runAsUser: 0`.
+  ## Although it is recommended not to use root user for security reasons.
+  ##
+  ## The `/var/log` and `/var/lib/docker/containers` directories on host are mounted
+  ## to logger container with volumeType `HostPath`.
+  securityContext: {}
+    # privileged: true
+    # runAsUser: 0
 
   ## Enable PodSecurityPolicies to allow privileged container
   ## Only required in some clusters and when enableSecurityContext is true
@@ -684,7 +674,7 @@ preUpgradeChecks:
   image: fission/pre-upgrade-checks
   ## pre-install/pre-upgrade checks image version
   ##
-  imageTag: v1.18.0-rc1
+  imageTag: v1.20.4
 
 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -725,7 +715,7 @@ canaryDeployment:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -752,7 +742,7 @@ authentication:
   ## jwtSigningKey is the signing key used for
   ## signing the JWT token
   ##
-  jwtSigningKey: serverless
+  jwtSigningKey: 
   ## jwtExpiryTime is the JWT expiry time
   ## in seconds
   ## default '120'
@@ -815,29 +805,29 @@ mqt_keda:
   enabled: true
   connector_images:
     kafka:
-      image: fission/keda-kafka-http-connector
-      tag: v0.11
+      image: ghcr.io/fission/keda-kafka-http-connector
+      tag: v0.15
     rabbitmq:
-      image: fission/keda-rabbitmq-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-rabbitmq-http-connector
+      tag: v0.13
     awskinesis:
-      image: fission/keda-aws-kinesis-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-aws-kinesis-http-connector
+      tag: v0.13
     aws_sqs:
-      image: fission/keda-aws-sqs-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-aws-sqs-http-connector
+      tag: v0.14
     nats_steaming:
-      image: fission/keda-nats-streaming-http-connector
-      tag: v0.12
+      image: ghcr.io/fission/keda-nats-streaming-http-connector
+      tag: v0.16
     nats_jetstream:
-      image: fission/keda-nats-jetstream-http-connector
-      tag: v0.2
+      image: ghcr.io/fission/keda-nats-jetstream-http-connector
+      tag: v0.7
     gcp_pubsub:
-      image: fission/keda-gcp-pubsub-http-connector
-      tag: v0.5
+      image: ghcr.io/fission/keda-gcp-pubsub-http-connector
+      tag: v0.9
     redis:
-      image: fission/keda-redis-http-connector
-      tag: v0.3
+      image: ghcr.io/fission/keda-redis-http-connector
+      tag: v0.6
 
   ## Pod resources as:
   ##  resources:

cmd/builder/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest
+COPY builder /builder
+ENTRYPOINT ["/builder"]

cmd/builder/Dockerfile.fission-builder

@@ -1,4 +0,0 @@
-FROM alpine:3.16
-RUN apk add --update ca-certificates
-COPY builder /builder
-ENTRYPOINT ["/builder"]

cmd/builder/app/server.go

@@ -24,16 +24,18 @@ import (
 
 	builder "github.com/fission/fission/pkg/builder"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 )
 
 // Usage: builder <shared volume path>
-func Run(ctx context.Context, logger *zap.Logger, shareVolume string) {
+func Run(ctx context.Context, logger *zap.Logger, mgr manager.Interface, shareVolume string) {
 	builder := builder.MakeBuilder(logger, shareVolume)
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", builder.Handler)
+	mux.HandleFunc("/clean", builder.Clean)
 	mux.HandleFunc("/version", builder.VersionHandler)
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
-	httpserver.StartServer(ctx, logger, "builder", "8001", mux)
+	httpserver.StartServer(ctx, logger, mgr, "builder", "8001", mux)
 }

cmd/builder/main.go

@@ -24,15 +24,21 @@ import (
 
 	"github.com/fission/fission/cmd/builder/app"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/profile"
 )
 
 // Usage: builder <shared volume path>
 func main() {
+
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()
 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
 	shareVolume := os.Args[1]
 	if _, err := os.Stat(shareVolume); err != nil {
 		if os.IsNotExist(err) {
@@ -42,5 +48,5 @@ func main() {
 			}
 		}
 	}
-	app.Run(ctx, logger, shareVolume)
+	app.Run(ctx, logger, mgr, shareVolume)
 }

cmd/fetcher/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest
+COPY fetcher /
+ENTRYPOINT ["/fetcher"]

cmd/fetcher/Dockerfile.fission-fetcher

@@ -1,4 +0,0 @@
-FROM alpine:3.16
-RUN apk add --update ca-certificates
-COPY fetcher /
-ENTRYPOINT ["/fetcher"]

cmd/fetcher/app/server.go

@@ -28,8 +28,10 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.uber.org/zap"
 
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/fetcher"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
 
@@ -37,7 +39,7 @@ var (
 	readyToServe uint32
 )
 
-func Run(ctx context.Context, logger *zap.Logger) {
+func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port string, podInfoMountDir string) {
 	flag.Usage = fetcherUsage
 	specializeOnStart := flag.Bool("specialize-on-startup", false, "Flag to activate specialize process at pod startup")
 	specializePayload := flag.String("specialize-request", "", "JSON payload for specialize request")
@@ -72,13 +74,13 @@ func Run(ctx context.Context, logger *zap.Logger) {
 	ctx, span := tracer.Start(ctx, "fetcher/Run")
 	defer span.End()
 
-	f, err := fetcher.MakeFetcher(logger, dir, *secretDir, *configDir)
+	f, err := fetcher.MakeFetcher(logger, clientGen, dir, *secretDir, *configDir, podInfoMountDir)
 	if err != nil {
 		logger.Fatal("error making fetcher", zap.Error(err))
 	}
 
 	// do specialization in other goroutine to prevent blocking in newdeploy
-	go func() {
+	mgr.Add(ctx, func(_ context.Context) {
 		if *specializeOnStart {
 			var specializeReq fetcher.FunctionSpecializeRequest
 
@@ -93,7 +95,7 @@ func Run(ctx context.Context, logger *zap.Logger) {
 			}
 		}
 		atomic.StoreUint32(&readyToServe, 1)
-	}()
+	})
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/fetch", f.FetchHandler)
@@ -119,7 +121,7 @@ func Run(ctx context.Context, logger *zap.Logger) {
 	logger.Info("fetcher ready to receive requests")
 
 	handler := otelUtils.GetHandlerWithOTEL(mux, "fission-fetcher", otelUtils.UrlsToIgnore("/healthz", "/readiness-healthz"))
-	httpserver.StartServer(ctx, logger, "fetcher", "8000", handler)
+	httpserver.StartServer(ctx, logger, mgr, "fetcher", port, handler)
 }
 
 func fetcherUsage() {

cmd/fetcher/main.go

@@ -20,16 +20,26 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 
 	"github.com/fission/fission/cmd/fetcher/app"
+	fv1 "github.com/fission/fission/pkg/apis/core/v1"
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/profile"
 )
 
+const fetcherPort = "8000"
+
 // Usage: fetcher <shared volume path>
 func main() {
+
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()
 
 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
-	app.Run(ctx, logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
+	app.Run(ctx, crd.NewClientGenerator(), logger, mgr, fetcherPort, fv1.PodInfoMount)
 }

cmd/fission-bundle/Dockerfile

@@ -0,0 +1,3 @@
+FROM cgr.dev/chainguard/static:latest
+COPY fission-bundle /
+ENTRYPOINT ["/fission-bundle"]

cmd/fission-bundle/Dockerfile.fission-bundle

@@ -1,4 +0,0 @@
-FROM alpine:3.16
-RUN apk add --update ca-certificates
-COPY fission-bundle /
-ENTRYPOINT ["/fission-bundle"]

cmd/fission-bundle/main.go

@@ -26,12 +26,14 @@ import (
 	docopt "github.com/docopt/docopt-go"
 	"go.uber.org/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
+	cnwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
 
 	"github.com/fission/fission/cmd/fission-bundle/mqtrigger"
 	"github.com/fission/fission/pkg/buildermgr"
 	"github.com/fission/fission/pkg/canaryconfigmgr"
-	"github.com/fission/fission/pkg/controller"
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/executor"
+	eclient "github.com/fission/fission/pkg/executor/client"
 	"github.com/fission/fission/pkg/info"
 	"github.com/fission/fission/pkg/kubewatcher"
 	functionLogger "github.com/fission/fission/pkg/logger"
@@ -40,59 +42,58 @@ import (
 	"github.com/fission/fission/pkg/storagesvc"
 	"github.com/fission/fission/pkg/timer"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/otel"
 	"github.com/fission/fission/pkg/utils/profile"
 	"github.com/fission/fission/pkg/webhook"
 )
 
 // runWebhook starts admission webhook server
-func runWebhook(ctx context.Context, logger *zap.Logger, port int) error {
-	return webhook.Start(ctx, logger, port)
+func runWebhook(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
+	return webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
+		Port: port,
+	})
 }
 
-func runController(ctx context.Context, logger *zap.Logger, port int) {
-	controller.Start(ctx, logger, port, false)
+func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) error {
+	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
 }
 
-func runCanaryConfigServer(ctx context.Context, logger *zap.Logger) error {
-	return canaryconfigmgr.StartCanaryServer(ctx, logger, false)
+func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, executorUrl string) error {
+	return router.Start(ctx, clientGen, logger, mgr, port, eclient.MakeClient(logger, executorUrl))
 }
 
-func runRouter(ctx context.Context, logger *zap.Logger, port int, executorUrl string) {
-	router.Start(ctx, logger, port, executorUrl)
+func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int) error {
+	return executor.StartExecutor(ctx, clientGen, logger, mgr, port)
 }
 
-func runExecutor(ctx context.Context, logger *zap.Logger, port int) error {
-	return executor.StartExecutor(ctx, logger, port)
+func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return kubewatcher.Start(ctx, clientGen, logger, mgr, routerUrl)
 }
 
-func runKubeWatcher(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return kubewatcher.Start(ctx, logger, routerUrl)
+func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return timer.Start(ctx, clientGen, logger, mgr, routerUrl)
 }
 
-func runTimer(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return timer.Start(ctx, logger, routerUrl)
-}
-
-func runMessageQueueMgr(ctx context.Context, logger *zap.Logger, routerUrl string) error {
-	return mqtrigger.Start(ctx, logger, routerUrl)
+func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return mqtrigger.Start(ctx, clientGen, logger, mgr, routerUrl)
 }
 
 // KEDA based MessageQueue Trigger Manager
-func runMQManager(ctx context.Context, logger *zap.Logger, routerURL string) error {
-	return mqt.StartScalerManager(ctx, logger, routerURL)
+func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerURL string) error {
+	return mqt.StartScalerManager(ctx, clientGen, logger, mgr, routerURL)
 }
 
-func runStorageSvc(ctx context.Context, logger *zap.Logger, port int, storage storagesvc.Storage) error {
-	return storagesvc.Start(ctx, logger, storage, port)
+func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, storage storagesvc.Storage) error {
+	return storagesvc.Start(ctx, clientGen, logger, storage, mgr, port)
 }
 
-func runBuilderMgr(ctx context.Context, logger *zap.Logger, storageSvcUrl string) error {
-	return buildermgr.Start(ctx, logger, storageSvcUrl)
+func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, storageSvcUrl string) error {
+	return buildermgr.Start(ctx, clientGen, logger, mgr, storageSvcUrl)
 }
 
-func runLogger(ctx context.Context, logger *zap.Logger) {
-	functionLogger.Start(ctx, logger)
+func runLogger(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
+	return functionLogger.Start(ctx, clientGen, logger)
 }
 
 func getPort(logger *zap.Logger, portArg interface{}) int {
@@ -115,9 +116,7 @@ func getStringArgWithDefault(arg interface{}, defaultValue string) string {
 func getServiceName(arguments map[string]interface{}) string {
 	serviceName := "Fission-Unknown"
 
-	if arguments["--controllerPort"] != nil {
-		serviceName = "Fission-Controller"
-	} else if arguments["--routerPort"] != nil {
+	if arguments["--routerPort"] != nil {
 		serviceName = "Fission-Router"
 	} else if arguments["--executorPort"] != nil {
 		serviceName = "Fission-Executor"
@@ -145,6 +144,9 @@ func exitWithSync(logger *zap.Logger) {
 }
 
 func main() {
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	var err error
 
 	// From https://github.com/containous/traefik/pull/1817/files
@@ -155,18 +157,17 @@ func main() {
 	// TODO: fix the lint error. Error checking here is causing all components to crash with error "logtostderr not found"
 	flag.Set("logtostderr", "true") //nolint: errcheck
 
-	usage := `fission-bundle: Package of all fission microservices: controller, router, executor.
+	usage := `fission-bundle: Package of all fission microservices: router, executor.
 
 Use it to start one or more of the fission servers:
 
- Controller is a stateless API frontend for fission resources.
 
  Pool manager maintains a pool of generalized function containers, and
  specializes them on-demand. Executor must be run from a pod in a
  Kubernetes cluster.
 
  Router implements HTTP triggers: it routes to running instances,
- working with the controller and executor.
+ working with the executor.
 
  Kubewatcher implements Kubernetes Watch triggers: it watches
  Kubernetes resources and invokes functions described in the
@@ -177,7 +178,6 @@ Use it to start one or more of the fission servers:
  backends.
 
 Usage:
-  fission-bundle --controllerPort=<port>
   fission-bundle --canaryConfig
   fission-bundle --routerPort=<port> [--executorUrl=<url>]
   fission-bundle --executorPort=<port> [--namespace=<namespace>] [--fission-namespace=<namespace>]
@@ -191,7 +191,6 @@ Usage:
   fission-bundle --logger
   fission-bundle --version
 Options:
-  --controllerPort=<port>         Port that the controller should listen on.
   --canaryConfig		  		  Start canary config server.
   --webhookPort=<port>             Port that the webhook should listen on.
   --routerPort=<port>             Port that the router should listen on.
@@ -214,9 +213,9 @@ Options:
 	defer exitWithSync(logger)
 
 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)
 
-	version := fmt.Sprintf("Fission Bundle Version: %v", info.BuildInfo().String())
+	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
 	arguments, err := docopt.ParseArgs(usage, nil, version)
 	if err != nil {
 		logger.Error("failed to parse arguments", zap.Error(err))
@@ -235,23 +234,17 @@ Options:
 	executorUrl := getStringArgWithDefault(arguments["--executorUrl"], "http://executor.fission")
 	routerUrl := getStringArgWithDefault(arguments["--routerUrl"], "http://router.fission")
 	storageSvcUrl := getStringArgWithDefault(arguments["--storageSvcUrl"], "http://storagesvc.fission")
+	clientGen := crd.NewClientGenerator()
 
 	if arguments["--webhookPort"] != nil {
 		port := getPort(logger, arguments["--webhookPort"])
-		err = runWebhook(ctx, logger, port)
+		err = runWebhook(ctx, clientGen, logger, port)
 		logger.Error("webhook server exited:", zap.Error(err))
 		return
 	}
 
-	if arguments["--controllerPort"] != nil {
-		port := getPort(logger, arguments["--controllerPort"])
-		runController(ctx, logger, port)
-		logger.Error("controller exited")
-		return
-	}
-
 	if arguments["--canaryConfig"] == true {
-		err := runCanaryConfigServer(ctx, logger)
+		err := runCanaryConfigServer(ctx, clientGen, logger, mgr)
 		if err != nil {
 			logger.Error("canary config server exited with error: ", zap.Error(err))
 			return
@@ -260,14 +253,16 @@ Options:
 
 	if arguments["--routerPort"] != nil {
 		port := getPort(logger, arguments["--routerPort"])
-		runRouter(ctx, logger, port, executorUrl)
-		logger.Error("router exited")
-		return
+		err = runRouter(ctx, clientGen, logger, mgr, port, executorUrl)
+		if err != nil {
+			logger.Error("router exited", zap.Error(err))
+			return
+		}
 	}
 
 	if arguments["--executorPort"] != nil {
 		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, logger, port)
+		err = runExecutor(ctx, clientGen, logger, mgr, port)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
 			return
@@ -275,7 +270,7 @@ Options:
 	}
 
 	if arguments["--kubewatcher"] == true {
-		err = runKubeWatcher(ctx, logger, routerUrl)
+		err = runKubeWatcher(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("kubewatcher exited", zap.Error(err))
 			return
@@ -283,7 +278,7 @@ Options:
 	}
 
 	if arguments["--timer"] == true {
-		err = runTimer(ctx, logger, routerUrl)
+		err = runTimer(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("timer exited", zap.Error(err))
 			return
@@ -291,7 +286,7 @@ Options:
 	}
 
 	if arguments["--mqt"] == true {
-		err = runMessageQueueMgr(ctx, logger, routerUrl)
+		err = runMessageQueueMgr(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("message queue manager exited", zap.Error(err))
 			return
@@ -299,7 +294,7 @@ Options:
 	}
 
 	if arguments["--mqt_keda"] == true {
-		err = runMQManager(ctx, logger, routerUrl)
+		err = runMQManager(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("mqt scaler manager exited", zap.Error(err))
 			return
@@ -307,7 +302,7 @@ Options:
 	}
 
 	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, logger, storageSvcUrl)
+		err = runBuilderMgr(ctx, clientGen, logger, mgr, storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
 			return
@@ -315,8 +310,10 @@ Options:
 	}
 
 	if arguments["--logger"] == true {
-		runLogger(ctx, logger)
-		logger.Error("logger exited")
+		err = runLogger(ctx, clientGen, logger)
+		if err != nil {
+			logger.Error("logger exited", zap.Error(err))
+		}
 		return
 	}
 
@@ -330,7 +327,7 @@ Options:
 		} else if arguments["--storageType"] == string(storagesvc.StorageTypeLocal) {
 			storage = storagesvc.NewLocalStorage("/fission")
 		}
-		err := runStorageSvc(ctx, logger, port, storage)
+		err := runStorageSvc(ctx, clientGen, logger, mgr, port, storage)
 		if err != nil {
 			logger.Error("storage service exited", zap.Error(err))
 			return