Bump the go-dependencies group with 17 updates (#3147 )

* Bump the go-dependencies group with 17 updates Bumps the go-dependencies group with 17 updates: | Package | From | To | | --- | --- | --- | | [github.com/prometheus/common](https://github.com/prometheus/common) | `0.61.0` | `0.62.0` | | [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.58.0` | `0.59.0` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.58.0` | `0.59.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.33.0` | `1.34.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.33.0` | `1.34.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.33.0` | `1.34.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.33.0` | `1.34.0` | | [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.33.0` | `1.34.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.69.2` | `1.69.4` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.32.0` | `0.32.1` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.32.0` | `0.32.1` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.32.0` | `0.32.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.32.0` | `0.32.1` | | [k8s.io/code-generator](https://github.com/kubernetes/code-generator) | `0.32.0` | `0.32.1` | | [k8s.io/metrics](https://github.com/kubernetes/metrics) | `0.32.0` | `0.32.1` | | [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.19.4` | `0.20.0` | | [sigs.k8s.io/controller-tools](https://github.com/kubernetes-sigs/controller-tools) | `0.17.0` | `0.17.1` | Updates `github.com/prometheus/common` from 0.61.0 to 0.62.0 - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md) - [Commits](https://github.com/prometheus/common/compare/v0.61.0...v0.62.0) Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.58.0 to 0.59.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.58.0...zpages/v0.59.0) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.58.0 to 0.59.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.58.0...zpages/v0.59.0) Updates `go.opentelemetry.io/otel` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.33.0...v1.34.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.33.0...v1.34.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.33.0...v1.34.0) Updates `go.opentelemetry.io/otel/sdk` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.33.0...v1.34.0) Updates `go.opentelemetry.io/otel/trace` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.33.0...v1.34.0) Updates `google.golang.org/grpc` from 1.69.2 to 1.69.4 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.69.2...v1.69.4) Updates `k8s.io/api` from 0.32.0 to 0.32.1 - [Commits](https://github.com/kubernetes/api/compare/v0.32.0...v0.32.1) Updates `k8s.io/apiextensions-apiserver` from 0.32.0 to 0.32.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.32.0...v0.32.1) Updates `k8s.io/apimachinery` from 0.32.0 to 0.32.1 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.32.0...v0.32.1) Updates `k8s.io/client-go` from 0.32.0 to 0.32.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.32.0...v0.32.1) Updates `k8s.io/code-generator` from 0.32.0 to 0.32.1 - [Commits](https://github.com/kubernetes/code-generator/compare/v0.32.0...v0.32.1) Updates `k8s.io/metrics` from 0.32.0 to 0.32.1 - [Commits](https://github.com/kubernetes/metrics/compare/v0.32.0...v0.32.1) Updates `sigs.k8s.io/controller-runtime` from 0.19.4 to 0.20.0 - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.19.4...v0.20.0) Updates `sigs.k8s.io/controller-tools` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/kubernetes-sigs/controller-tools/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-tools/blob/main/envtest-releases.yaml) - [Commits](https://github.com/kubernetes-sigs/controller-tools/compare/v0.17.0...v0.17.1) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/sdk dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/trace dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/api dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/apiextensions-apiserver dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/apimachinery dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/client-go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/code-generator dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: k8s.io/metrics dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: sigs.k8s.io/controller-tools dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Revert sigs.k8s.io/controller-runtime to v0.19.4 Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
Update SECURITY.md (#3151 )
2025-01-23 17:26:36 +05:30 · 2025-01-23 15:36:32 +05:30 · 2025-01-23 15:36:07 +05:30 · 2025-01-22 18:12:14 +05:30 · 2025-01-21 23:18:39 +05:30 · 2025-01-20 17:21:27 +05:30
313 changed files with 29724 additions and 21189 deletions
@@ -1,11 +1,9 @@
 ignore:
  - "charts"
-  - "demos"
-  - "Documentation"
-  - "examples"
-  - "test"
+  - "test/"
  - "tools"
-  - "pkg/apis/genclient"
+  - "pkg/generated" # generated code
+  - "pkg/apis/*/*/zz_generated*" # generated code
 coverage:
  status:
    project:
@@ -0,0 +1,36 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /cmd/builder
+      - /cmd/fetcher
+      - /cmd/fission-bundle
+      - /cmd/preupgradechecks
+      - /cmd/reporter
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      docker-images:
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
@@ -4,39 +4,43 @@ on:
  push:
    branches:
      - main
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
+      - '!dependabot/**'
  pull_request:
    branches:
      - main
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
  schedule:
    - cron: "0 0 * * 0"
-  workflow_dispatch:
+
+permissions:
+  contents: read

 jobs:
  CodeQL-Build:
-    runs-on: ubuntu-latest
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    runs-on: ubuntu-24.04
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
        with:
          languages: go

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
@@ -11,18 +11,25 @@ on:
      - main
    paths:
      - 'charts/fission-all/dashboards/**.json'
-  workflow_dispatch:
+
+permissions:
+  contents: read

 jobs:
  lint-dashboards:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"

@@ -15,22 +15,32 @@ on:
      - "**.go"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  GOLANGCI_LINT_VERSION: v1.51.1
+  GOLANGCI_LINT_VERSION: v1.63.4
  GOLANGCI_LINT_TIMEOUT: 5m

+permissions:
+  contents: read
+
 jobs:
  lint:
-    runs-on: ubuntu-latest
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-24.04
+    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true
@@ -41,8 +51,9 @@ jobs:
          go mod download

      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6.2.0
        with:
+          skip-cache: true
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          args: --timeout=${{ env.GOLANGCI_LINT_TIMEOUT }}

@@ -61,8 +72,8 @@ jobs:
        run: ./hack/runtests.sh

      - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
-          token: ${{secrets.CODECOV_TOKEN}}
+          token: ${{ secrets.CODECOV_TOKEN }}
          flags: unittests
          file: ./coverage.txt
@@ -4,6 +4,7 @@ on:
  push:
    branches:
      - main
+      - '!dependabot/**'
    paths:
      - "**.go"
      - "charts/**"
@@ -19,13 +20,15 @@ on:
      - "test/**"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  HELM_VERSION: v3.13.0
-  KIND_VERSION: v0.20.0
+  HELM_VERSION: v3.16.4
+  KIND_VERSION: v0.26.0
  KIND_CLUSTER_NAME: kind

+permissions:
+  contents: read
+
 jobs:
  # Job to run change detection
  integration-test:
@@ -34,31 +37,36 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.23.17", "v1.25.11", "v1.27.3"]
-        os: [ubuntu-latest]
+        kindversion: ["v1.28.15", "v1.30.8", "v1.32.0"]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@v1.8.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -79,14 +87,15 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          install-only: true
+          version: "~> v2"

      - name: Setup Prometheus Stack
        run: |
@@ -144,7 +153,7 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -153,7 +162,7 @@ jobs:
      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
@@ -162,7 +171,7 @@ jobs:
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -177,30 +186,35 @@ jobs:
      fail-fast: false
      matrix:
        kindversion: ["v1.19.16"]
-        os: [ubuntu-latest]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@v1.8.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -221,14 +235,15 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.0.3/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          install-only: true
+          version: "~> v2"

      - name: Setup Prometheus Stack
        run: |
@@ -289,26 +304,26 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
-          name: fission-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
          retention-days: 5

      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
-          name: prom-dump-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
          retention-days: 5

      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
-          name: kind-logs-${{ github.run_id }}-${{ github.job_id }}-${{ matrix.kindversion }}
+          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
          retention-days: 5
@@ -6,36 +6,52 @@ on:
      - v2.**

 env:
-  KIND_VERSION: v0.20.0
-  KIND_NODE_IMAGE_TAG: v1.23.17
+  KIND_VERSION: v0.26.0
+  KIND_NODE_IMAGE_TAG: v1.28.15
  KIND_CLUSTER_NAME: kind
+  COSIGN_VERSION: v2.4.1

 jobs:
  create-draft-release:
-    runs-on: ubuntu-latest
+    name: Create Draft Release with Goreleaser
+    outputs:
+      hashes: ${{ steps.binary.outputs.hashes }}
+      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
+      version: ${{ steps.get_version.outputs.VERSION }}
+    permissions:
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
+      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
+      id-token: write # for cosign to sign the image and binary
+    runs-on: ubuntu-24.04
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Get the version
        id: get_version
-        run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
+        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          install-only: true
+          version: "~> v2"

-      - name: Kind Clutser
-        uses: helm/kind-action@v1.8.0
+      - name: Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
          version: ${{ env.KIND_VERSION }}
@@ -43,33 +59,24 @@ jobs:
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0

      - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Login to docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
      - name: Install Cosign
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
        with:
-          cosign-release: 'v1.12.0'
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
      - name: Check cosign install!
        run: cosign version

-      - name: Write cosign signing key to disk
-        run: 'echo "$KEY" > cosign.key'
-        shell: bash
-        env:
-          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+      - uses: anchore/sbom-action/download-syft@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 #v0.17.9

      - name: Generate yaml for manifest, Minikube and Openshift installation
        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
@@ -78,14 +85,191 @@ jobs:
        shell: bash

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
-          version: latest
+          version: "~> v2"
          args: release
        env:
-          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"

-    #ToDo - Verify and upload releases
+      - name: Generate binary hashes
+        id: binary
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+
+          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+      - name: Image digest
+        id: image
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
+            split("\n")
+            | map(select(. != ""))
+            | map(
+                split("@")
+                | {
+                    "image": .[0] | split(":")[0],
+                    "checksum": .[1]
+                  }
+              )')
+          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"
+
+  binary-provenance:
+    name: Create Binary Provenance
+    needs: [create-draft-release]
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0  # Do not use commit hash
+    with:
+      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
+      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
+      upload-assets: true # upload to a new release
+      draft-release: true # create a draft release
+
+  image-provenance-ghcr:
+    name: Create Image Provenance
+    needs: [create-draft-release]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: read
+      id-token: write
+      packages: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0 # Do not use commit hash
+    with:
+      image: ${{ fromJson(toJson(matrix)).image }}
+      digest: ${{ fromJson(toJson(matrix)).checksum }}
+      registry-username: ${{ github.actor }}
+    secrets:
+      registry-password: ${{ secrets.GITHUB_TOKEN }}
+
+  image-sbom-ghcr:
+    name: Create SBOM for container images
+    # Goreleaser does not support generating SBOM for container images.
+    needs: [create-draft-release]
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: write
+      id-token: write
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Trivy in fs mode to generate SBOM
+        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
+        with:
+          scan-type: "fs"
+          format: "spdx-json"
+          output: "spdx.sbom.json"
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+      - name: Sign image and sbom
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
+          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
+
+  binary-provenance-verification-with-slsa-verifier:
+    name : Verify Binary Provenance
+    needs: [create-draft-release, binary-provenance]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write # To download the assets from draft release.
+    steps:
+      - name: Install the verifier
+        uses: slsa-framework/slsa-verifier/actions/installer@3714a2a4684014deb874a0e737dffa0ee02dd647 # v2.6.0
+
+      - name: Download assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "repo=$GITHUB_REPOSITORY"
+          echo "ref=$VERSION"
+          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
+
+      - name: Verify assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "CHECKSUMS=$CHECKSUMS"
+          echo "PROVENANCE=$PROVENANCE"
+          checksums=$(echo "$CHECKSUMS" | base64 -d)
+          while read -r line; do
+              fn=$(echo $line | cut -d ' ' -f2)
+              echo "Verifying $fn"
+              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
+              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
+                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
+                                            --source-tag "$VERSION" \
+                                            "$fn"
+          done <<<"$checksums"
+
+  image-provenance-verification-with-cosign:
+    name: Verify Image Provenance
+    needs: [create-draft-release, image-provenance-ghcr]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    runs-on: ubuntu-24.04
+    permissions: read-all
+    steps:
+      - name: Login
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Verify image
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          echo "Verifying $IMAGE@$DIGEST"
+          cosign verify-attestation \
+             --type slsaprovenance \
+             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
+             $IMAGE@$DIGEST
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '41 18 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-24.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        with:
+          sarif_file: results.sarif
@@ -4,6 +4,7 @@ on:
  push:
    branches:
      - main
+      - '!dependabot/**'
    paths:
      - "**.go"
      - "charts/**"
@@ -19,13 +20,15 @@ on:
      - "test/**"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  HELM_VERSION: v3.13.0
-  KIND_VERSION: v0.20.0
+  HELM_VERSION: v3.16.4
+  KIND_VERSION: v0.26.0
  KIND_CLUSTER_NAME: kind

+permissions:
+  contents: read
+
 jobs:
  upgrade-test:
    runs-on: ${{ matrix.os }}
@@ -33,34 +36,40 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindimage: ["kindest/node:v1.23.17"]
-        os: [ubuntu-latest]
+        kindversion: ["v1.28.15"]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
      - name: Checkout action sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Setup Helm
-        uses: Azure/setup-helm@v3
+        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: ${{ env.HELM_VERSION }}

-      - name: Setup Kind Clutser
-        uses: helm/kind-action@v1.8.0
+      - name: Setup Kind Cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
-          node_image: ${{ matrix.kindimage }}
+          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          install-only: true
+          version: "~> v2"

      - name: Setup kubectl & fetch node information
        run: |
@@ -105,7 +114,7 @@ jobs:

      - name: Archive fission dump
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -113,7 +122,7 @@ jobs:

      - name: Archive kind logs
        if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -9,6 +9,7 @@ cmd/reporter/reporter

 # Logs
 test/logs/
+test/e2e/cli/fission-dump/

 # Pycharm IDE
 .idea
@@ -1,9 +1,14 @@
+version: 2
+
+env:
+  - GHCR_REPO=ghcr.io/fission
+
 project_name: fission
 release:
  github:
    owner: fission
    name: fission
-  prerelease: true
+  prerelease: "true"
  draft: true
  header: |
    Release Highlights: https://fission.io/docs/releases/{{ .Tag }}/
@@ -16,7 +21,7 @@ before:
  hooks:
    - go mod tidy
 snapshot:
-  name_template: "{{ .Tag }}"
+  version_template: "{{ .Tag }}"
 builds:
  - &build-linux
    id: builder
@@ -36,9 +41,6 @@ builds:
    goarch:
      - amd64
      - arm64
-      - arm
-    goarm:
-      - 7
    binary: builder
    dir: ./cmd/builder
  - <<: *build-linux
@@ -60,12 +62,6 @@ builds:
    ignore:
      - goos: windows
        goarch: arm64
-      - goos: darwin
-        goarch: arm
-        goarm: 7
-      - goos: windows
-        goarch: arm
-        goarm: 7
  - <<: *build-linux
    id: pre-upgrade-checks
    binary: pre-upgrade-checks
@@ -82,77 +78,87 @@ dockers:
    ids:
      - builder
    image_templates:
-      - "fission/builder:latest-amd64"
-      - "fission/builder:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/builder:latest-amd64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - fetcher
    image_templates:
-      - "fission/fetcher:latest-amd64"
-      - "fission/fetcher:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fetcher:latest-amd64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
    dockerfile: cmd/fetcher/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - fission-bundle
    image_templates:
-      - "fission/fission-bundle:latest-amd64"
-      - "fission/fission-bundle:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fission-bundle:latest-amd64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
    dockerfile: cmd/fission-bundle/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - pre-upgrade-checks
    image_templates:
-      - "fission/pre-upgrade-checks:latest-amd64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
    dockerfile: cmd/preupgradechecks/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - reporter
    image_templates:
-      - "fission/reporter:latest-amd64"
-      - "fission/reporter:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/reporter:latest-amd64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
    dockerfile: cmd/reporter/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - &docker-arm64
    use: buildx
    goos: linux
@@ -160,259 +166,130 @@ dockers:
    ids:
      - builder
    image_templates:
-      - "fission/builder:latest-arm64"
-      - "fission/builder:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/builder:latest-arm64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - fetcher
    image_templates:
-      - "fission/fetcher:latest-arm64"
-      - "fission/fetcher:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fetcher:latest-arm64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
    dockerfile: cmd/fetcher/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - fission-bundle
    image_templates:
-      - "fission/fission-bundle:latest-arm64"
-      - "fission/fission-bundle:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fission-bundle:latest-arm64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
    dockerfile: cmd/fission-bundle/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - pre-upgrade-checks
    image_templates:
-      - "fission/pre-upgrade-checks:latest-arm64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
    dockerfile: cmd/preupgradechecks/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - reporter
    image_templates:
-      - "fission/reporter:latest-arm64"
-      - "fission/reporter:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/reporter:latest-arm64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
    dockerfile: cmd/reporter/Dockerfile
    build_flag_templates:
+      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
-  - &docker-armv7
-    use: buildx
-    goos: linux
-    goarch: arm
-    goarm: 7
-    ids:
-      - builder
-    image_templates:
-      - "fission/builder:latest-armv7"
-      - "fission/builder:{{ .Tag }}-armv7"
-      - "ghcr.io/fission/builder:latest-armv7"
-      - "ghcr.io/fission/builder:{{ .Tag }}-armv7"
-    dockerfile: cmd/builder/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm/v7"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - fetcher
-    image_templates:
-      - "fission/fetcher:latest-armv7"
-      - "fission/fetcher:{{ .Tag }}-armv7"
-      - "ghcr.io/fission/fetcher:latest-armv7"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-armv7"
-    dockerfile: cmd/fetcher/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm/v7"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - fission-bundle
-    image_templates:
-      - "fission/fission-bundle:latest-armv7"
-      - "fission/fission-bundle:{{ .Tag }}-armv7"
-      - "ghcr.io/fission/fission-bundle:latest-armv7"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-armv7"
-    dockerfile: cmd/fission-bundle/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm/v7"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "fission/pre-upgrade-checks:latest-armv7"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-armv7"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-armv7"
-    dockerfile: cmd/preupgradechecks/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm/v7"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-  - <<: *docker-armv7
-    ids:
-      - reporter
-    image_templates:
-      - "fission/reporter:latest-armv7"
-      - "fission/reporter:{{ .Tag }}-armv7"
-      - "ghcr.io/fission/reporter:latest-armv7"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-armv7"
-    dockerfile: cmd/reporter/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm/v7"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
 docker_manifests:
-  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/builder:{{ .Tag }}-amd64
-      - ghcr.io/fission/builder:{{ .Tag }}-arm64
-      - ghcr.io/fission/builder:{{ .Tag }}-armv7
-  - name_template: fission/builder:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
    image_templates:
-      - fission/builder:{{ .Tag }}-amd64
-      - fission/builder:{{ .Tag }}-arm64
-      - fission/builder:{{ .Tag }}-armv7
-  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
-      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
-      - ghcr.io/fission/fetcher:{{ .Tag }}-armv7
-  - name_template: fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
    image_templates:
-      - fission/fetcher:{{ .Tag }}-amd64
-      - fission/fetcher:{{ .Tag }}-arm64
-      - fission/fetcher:{{ .Tag }}-armv7
-  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-armv7
-  - name_template: fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
    image_templates:
-      - fission/fission-bundle:{{ .Tag }}-amd64
-      - fission/fission-bundle:{{ .Tag }}-arm64
-      - fission/fission-bundle:{{ .Tag }}-armv7
-  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
    image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-armv7
-  - name_template: fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
    image_templates:
-      - fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-      - fission/pre-upgrade-checks:{{ .Tag }}-armv7
-  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
    image_templates:
-      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
-      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
-      - ghcr.io/fission/reporter:{{ .Tag }}-armv7
-  - name_template: fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
    image_templates:
-      - fission/reporter:{{ .Tag }}-amd64
-      - fission/reporter:{{ .Tag }}-arm64
-      - fission/reporter:{{ .Tag }}-armv7
-  - name_template: ghcr.io/fission/builder:latest
-    image_templates:
-      - ghcr.io/fission/builder:latest-amd64
-      - ghcr.io/fission/builder:latest-arm64
-      - ghcr.io/fission/builder:latest-armv7
-  - name_template: fission/builder:latest
-    image_templates:
-      - fission/builder:latest-amd64
-      - fission/builder:latest-arm64
-      - fission/builder:latest-armv7
-  - name_template: ghcr.io/fission/fetcher:latest
-    image_templates:
-      - ghcr.io/fission/fetcher:latest-amd64
-      - ghcr.io/fission/fetcher:latest-arm64
-      - ghcr.io/fission/fetcher:latest-armv7
-  - name_template: fission/fetcher:latest
-    image_templates:
-      - fission/fetcher:latest-amd64
-      - fission/fetcher:latest-arm64
-      - fission/fetcher:latest-armv7 
-  - name_template: ghcr.io/fission/fission-bundle:latest
-    image_templates:
-      - ghcr.io/fission/fission-bundle:latest-amd64
-      - ghcr.io/fission/fission-bundle:latest-arm64
-      - ghcr.io/fission/fission-bundle:latest-armv7
-  - name_template: fission/fission-bundle:latest
-    image_templates:
-      - fission/fission-bundle:latest-amd64
-      - fission/fission-bundle:latest-arm64
-      - fission/fission-bundle:latest-armv7
-  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
-    image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
-      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
-      - ghcr.io/fission/pre-upgrade-checks:latest-armv7
-  - name_template: fission/pre-upgrade-checks:latest
-    image_templates:
-      - fission/pre-upgrade-checks:latest-amd64
-      - fission/pre-upgrade-checks:latest-arm64
-      - fission/pre-upgrade-checks:latest-armv7
-  - name_template: ghcr.io/fission/reporter:latest
-    image_templates:
-      - ghcr.io/fission/reporter:latest-amd64
-      - ghcr.io/fission/reporter:latest-arm64
-      - ghcr.io/fission/reporter:latest-armv7
-  - name_template: fission/reporter:latest
-    image_templates:
-      - fission/reporter:latest-amd64
-      - fission/reporter:latest-arm64
-      - fission/reporter:latest-armv7
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
-  skip: false
+  disable: true
 archives:
  - id: fission
    builds:
@@ -426,25 +303,37 @@ checksum:
 # signs the checksum file
 # https://goreleaser.com/customization/sign
 signs:
- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - sign-blob
-    - '--key=cosign.key'
-    - '--output-certificate=${certificate}'
-    - '--output-signature=${signature}'
-    - '${artifact}'
+  - id: cosign-binary
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    artifacts: binary
+    args:
+      - sign-blob
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+

 # signs our docker image
 # https://goreleaser.com/customization/docker_sign
 docker_signs:
- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - 'sign'
-    - '--key=cosign.key'
-    - '${artifact}'
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: all
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+sboms:
+  - artifacts: archive
+    id: archive
+  - artifacts: source
+    id: source
+  - artifacts: binary
+    id: binary
+  - artifacts: package
+    id: package
@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
@@ -23,6 +23,7 @@ COMMITSHA ?= $(shell git rev-parse HEAD)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 GOAMD64 ?= $(shell go env GOAMD64)
+GOPATH ?= $(shell go env GOPATH)

 FISSION-CLI-SUFFIX :=
 ifeq ($(GOOS), windows)
@@ -58,23 +59,20 @@ install-fission-cli:
 	mv dist/fission-cli_$(GOOS)_$(GOARCH)_v1/fission$(FISSION-CLI-SUFFIX) /usr/local/bin/fission

 ### Codegen
-codegen: controller-gen-install
-	@controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
+codegen:
 	@./hack/update-codegen.sh
+	go run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."

 ### CRDs
-controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.13.0
-
-generate-crds: controller-gen-install
-	controller-gen crd \
+generate-crds:
+	go run sigs.k8s.io/controller-tools/cmd/controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1

 ### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
-generate-webhooks: controller-gen-install
-	controller-gen webhook \
-	 paths=./pkg/apis/core/v1 \
+generate-webhooks:
+	go run sigs.k8s.io/controller-tools/cmd/controller-gen webhook \
+	 paths=./pkg/webhook \
 	 output:dir=charts/fission-all/templates/webhook-server


@@ -98,12 +96,9 @@ generate-swagger-doc:
 generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"

-install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@v0.0.9
-
-generate-crd-ref-docs: install-crd-ref-docs
+generate-crd-ref-docs:
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	go run github.com/elastic/crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
@@ -133,4 +128,4 @@ install-envtest:
 	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

 setup-envtest:
-	setup-envtest -p path use 1.23.x
+	setup-envtest -p path use 1.30.x
@@ -36,12 +36,16 @@
  <a href="https://github.com/fission/fission">
    <img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/fission/fission?style=social">
  </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/fission/fission">
+    <image alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/fission/fission/badge">
+  </a>
 </p>

 --------------

-Fission is a fast serverless framework for Kubernetes with a focus on
-developer productivity and high performance.
+Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. With Fission, developers can easily create and deploy serverless functions that can be triggered by a variety of events, such as HTTP requests, messages from a message queue, or scheduled tasks.
+
+Fission provides a simple, easy-to-use interface for developers to create serverless functions in their language of choice, without having to worry about the underlying infrastructure. The framework also offers automatic scaling, so functions can scale up or down based on demand, without any additional configuration.

 Fission operates on _just the code_: Docker and Kubernetes are
 abstracted away under normal operation, though you can use both to
@@ -6,12 +6,12 @@ Please refer using [latest stable release](https://github.com/fission/fission/re

 | Version | Supported          |
 | ------- | ------------------ |
-| >=1.14.x   | :white_check_mark: |
-| < 1.14.0   | :x:                |
+| >=1.20.x   | :white_check_mark: |
+| < 1.20.0   | :x:                |

 ## Reporting a Vulnerability

 Please send the details to both of us:

- Sanket Sudake sanket@infracloud.io
- Vishal Biyani vishal@infracloud.io
+- Sanket Sudake sanket[at]infracloud.io
+- Vishal Biyani vishal[at]infracloud.io
@@ -1,8 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.20.0-rc1
-appVersion: v1.20.0-rc1
+version: v1.21.0-rc2
+appVersion: v1.21.0-rc2
 description: Fission is a fast serverless framework for Kubernetes.
+kubeVersion: ">=1.27.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -21,4 +22,8 @@ maintainers:
  - name: Sanket Sudake
    email: sanket@infracloud.io
 engine: gotpl
-type: application
+type: application
+annotations:
+  artifacthub.io/signKey: |
+    fingerprint: 2EAE29FDF8A387050C82CD5ABBDD4FD6A1FFCBF6
+    url: https://raw.githubusercontent.com/fission/fission-charts/main/public_key/pgp_keys.asc
@@ -1,3 +1,5 @@
+{{ template "deprecationWarnings" . }}
+
 1. Install the client CLI.

 Mac:
@@ -0,0 +1,21 @@
+{{- define "deprecationWarnings" -}}
+{{- $deprecations := list -}}
+
+{{- if .Values.builderNamespace -}}
+{{- $deprecations = append $deprecations "The 'builderNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.functionNamespace -}}
+{{- $deprecations = append $deprecations "The 'functionNamespace' parameter is deprecated and will be removed in future release." -}}
+{{- end -}}
+
+{{- if .Values.disableOwnerReference -}}
+{{- $deprecations = append $deprecations "The 'disableOwnerReference' flag is temporary addition and will be removed in future release." -}}
+{{- end -}}
+
+{{- if $deprecations -}}
+{{- range $deprecations }}
+{{- printf "WARNING: %s" . | nindent 0 }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
@@ -71,7 +71,6 @@ rules:
  - pods
  - services
  - replicationcontrollers
-  - events
  verbs:
  - create
  - delete
@@ -79,6 +78,16 @@ rules:
  - list
  - watch
  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
 - apiGroups:
  - ""
  resources:
@@ -251,7 +260,6 @@ rules:
  - pods
  - services
  - replicationcontrollers
-  - events
  verbs:
  - create
  - delete
@@ -259,6 +267,16 @@ rules:
  - list
  - watch
  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - patch
 - apiGroups:
  - ""
  resources:
@@ -336,6 +354,8 @@ rules:
 # TODO: Kept for future in case preupgrade needs any permissions in the future
 rules: []
 {{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
 {{- define "router-kuberules" }}
 rules:
 - apiGroups:
@@ -37,38 +37,37 @@ auth:
 {{- end -}}

 {{/*
-This template generates the image name for the deployment depending on the value of "repository" field in values.yaml file.
+Helper template to construct image names with repository and tag
 */}}
-{{- define "fission-bundleImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.image }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
+{{- define "imageWithTag" -}}
+{{- $repository := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $tag := index . 2 -}}
+{{- if $repository -}}
+{{- printf "%s/%s%s" $repository $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
 {{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.image }}
-  {{- else -}}
-    {{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- printf "%s%s" $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-bundleImage" -}}
+{{- $args := list .Values.repository .Values.image .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "reporterImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- $args := list .Values.repository .Values.postInstallReportImage .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "fetcherImage" -}}
+{{- $args := list (.Values.fetcher.repository | default .Values.repository) .Values.fetcher.image .Values.fetcher.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "preUpgradeChecksImage" -}}
+{{- $args := list (.Values.preUpgradeChecks.repository | default .Values.repository) .Values.preUpgradeChecks.image .Values.preUpgradeChecks.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "opentelemtry.envs" }}
@@ -103,6 +102,13 @@ This template generates the image name for the deployment depending on the value
 {{- end }}
 {{- end }}

+{{- define "kube_client.envs" }}
+- name: KUBE_CLIENT_QPS
+  value: "{{ .Values.kubernetesClientQPS }}"
+- name: KUBE_CLIENT_BURST
+  value: "{{ .Values.kubernetesClientBurst }}"
+{{- end}}
+
 {{/*
 Define the svc's name
 */}}
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-install
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-upgrade
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -30,11 +30,7 @@ spec:
        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: BUILDER_IMAGE_PULL_POLICY
@@ -51,11 +47,14 @@ spec:
          value: {{ .Values.fetcher.resource.mem.limits | quote }}
        - name: DEBUG_ENV
          value: {{ .Values.debugEnv | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        {{- if .Values.builderPodSpec.enabled }}
        volumeMounts:
@@ -37,7 +37,8 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }} 
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
@@ -30,11 +30,7 @@ spec:
        args: ["--executorPort", "8888"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: RUNTIME_IMAGE_PULL_POLICY
@@ -76,8 +72,11 @@ spec:
          value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}  
        - name: SERVICEACCOUNT_CHECK_INTERVAL
          value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
+        - name: DISABLE_OWNER_REFERENCES
+          value: {{ .Values.disableOwnerReference | quote }}
        {{- end}}  
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        - name: HELM_RELEASE_NAME
          value: {{ .Release.Name | quote }}
        {{- include "opentelemtry.envs" . | indent 8 }}
@@ -118,6 +118,7 @@ spec:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
+            {{- include "fission-resource-namespace.envs" . | indent 12 }}
          command: ["/fission-bundle"]
          args: ["--logger"]
          volumeMounts:
@@ -127,10 +128,8 @@ spec:
            - name: docker-log
              mountPath: /var/lib/docker/containers
              readOnly: true
-{{- if .Values.logger.enableSecurityContext }}
          securityContext:
-            privileged: true
-{{- end }}
+            {{- toYaml .Values.logger.securityContext | nindent 12 }}
        - name: fluentbit
 {{- if .Values.repository }}
          image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -29,7 +29,8 @@ spec:
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.kubewatcher.resources | nindent 10 }}
@@ -47,6 +47,7 @@ spec:
        - name: REDIS_IMAGE
          value: "{{ .Values.mqt_keda.connector_images.redis.image }}:{{ .Values.mqt_keda.connector_images.redis.tag }}"
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.mqt_keda.resources | nindent 10 }}
@@ -28,15 +28,12 @@ spec:
      restartPolicy: Never
      containers:
      - name: pre-upgrade-job
-      {{- if .Values.preUpgradeChecks.imageTag }}
-        image: {{ .Values.preUpgradeChecks.image }}:{{ .Values.preUpgradeChecks.imageTag }}
-      {{- else }}
-        image: {{ .Values.preUpgradeChecks.image }}
-      {{- end }}
+        image: {{ include "preUpgradeChecksImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: [ "/pre-upgrade-checks" ]
        env:
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- if .Values.terminationMessagePath }}
        terminationMessagePath: {{ .Values.terminationMessagePath }}
        {{- end }}
@@ -83,7 +83,8 @@ spec:
          value: {{ .Values.pprof.enabled | quote }}
        - name: DISPLAY_ACCESS_LOG
          value: {{ .Values.router.displayAccessLog | default false | quote }}
-        {{- include "fission-resource-namespace.envs" . | indent 8 }}  
+        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.router.resources | nindent 10 }}
@@ -1,4 +1,4 @@
-{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Release.Namespace "component" "router") .) }}

 {{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}
@@ -10,5 +10,5 @@ metadata:
 data:
  username: {{ .Values.authentication.authUsername | b64enc | quote }}
  password: {{ randAlphaNum 20 | b64enc | quote }}
-  jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
+  jwtSigningKey: {{ default (randAlphaNum 20) .Values.authentication.jwtSigningKey | b64enc | quote }}
 {{- end }}
@@ -61,6 +61,7 @@ spec:
          value: {{ .Values.persistence.s3.region }}
        {{- end }}
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.storagesvc.resources | nindent 10 }}
@@ -30,6 +30,7 @@ spec:
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
        {{- include "fission-resource-namespace.envs" . | indent 8 }}
+        {{- include "kube_client.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        resources:
          {{- toYaml .Values.timer.resources | nindent 10 }}
@@ -38,6 +38,8 @@ spec:
        ports:
          - containerPort: 8080
            name: metrics
+        resources:
+          {{- toYaml .Values.webhook.resources | nindent 10 }}
      volumes:
      - name: serving-certs
        secret:
@@ -16,7 +16,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
  creationTimestamp: null
-  name: mutating-webhook-configuration
+  name: fission-mutating-webhooks
  {{- if $certManagerEnabled }}
  annotations:
    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
@@ -49,7 +49,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
  creationTimestamp: null
-  name: validating-webhook-configuration
+  name: fission-validating-webhooks
  {{- if $certManagerEnabled }}
  annotations:
    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
@@ -25,7 +25,7 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.20.0-rc1
+imageTag: v1.21.0-rc2

 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
@@ -67,12 +67,16 @@ defaultNamespace: default
 ## if builderNamespace is set to empty then builder resources will be created in the same namespace as the Fission resources.
 ## This is different from the release namespace.
 ##
+## Note: This parameter is deprecated and will be removed in future fission releases.
+##
 builderNamespace: ""

 ## functionNamespace represents the namespace in which Fission Function resources will be created.
 ## if functionNamespace is set to empty then function resources will be created in the same namespace as the Fission resources.
 ## This is different from the release namespace.
 ##
+## Note: This parameter is deprecated and will be removed in future fission releases.
+##
 functionNamespace: ""

 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
@@ -88,18 +92,39 @@ additionalFissionNamespaces: []
 ##
 createNamespace: true

+## disableOwnerReference decides to set OwnerReference to K8s resources like deployment, services, hpa etc. created by Fission.
+## If set to true, the K8s resources created by Fission will not have OwnerReference set.
+## Set to false if you want to add OwnerReference to K8s resources created by Fission.
+##
+## Set to true if you are using cross namespace meaning `builderNamespace` and `functionNamespace` are set.
+##
+## Note: This flag is temporary addition and would be removed in future fission releases.
+##
+disableOwnerReference: false
+
 ## enableIstio indicates whether to enable istio integration.
 ##
 enableIstio: false

+## Kubernetes client QPS and Burst settings
+##
+## kubernetesClientQPS represents the maximum queries per second to the kubernetes api server from client instances of fission components.
+kubernetesClientQPS: 200
+## kubernetesClientBurst represents the maximum burst queries to the kubernetes api server from client instances of fission components.
+kubernetesClientBurst: 500
+
 ## fetcher is a light weight component that helps in running functions.
 ## fetcher helps in fetching function source code/build and uploading it when function is invoked.
 ##
 fetcher:
+  ## repository represents the repository of the fetcher component.
+  ##
+  ## By default, it is empty, which means global repository will be used.
+  repository: ""
  ## image represents the image of the fetcher component.
  image: fission/fetcher
  ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.20.0-rc1
+  imageTag: v1.21.0-rc2

  ## Fetcher is only for to downloading or uploading archive.
  ## Normally, you don't need to change the value here, unless necessary.
@@ -613,11 +638,22 @@ logger:

  ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked
  ## files and a state of offsets, this is very useful to resume a state if the ser-
-  ## vice is restarted. For Kubernetes environment with constraints like OpenShift,
+  ## vice is restarted.
+  ##
+  ## For Kubernetes environment with constraints like OpenShift,
  ## the containers are limited to write hostPath volume. Hence, we have to enable
  ## security context and set privileged to true.
  ##
-  enableSecurityContext: false
+  ## The user ID in runAsUser should have access to the `/var/log` and
+  ## `/var/lib/docker/containers` directories on your host.
+  ## On many hosts, this user might be root ,i.e., `runAsUser: 0`.
+  ## Although it is recommended not to use root user for security reasons.
+  ##
+  ## The `/var/log` and `/var/lib/docker/containers` directories on host are mounted
+  ## to logger container with volumeType `HostPath`.
+  securityContext: {}
+    # privileged: true
+    # runAsUser: 0

  ## Enable PodSecurityPolicies to allow privileged container
  ## Only required in some clusters and when enableSecurityContext is true
@@ -651,12 +687,16 @@ preUpgradeChecks:
  ## Run pre-install/pre-upgrade checks if true
  ##
  enabled: true
+  ## Repository for pre-install/pre-upgrade checks image
+  ## By default it uses the global repository
+  ##
+  repository: ""
  ## pre-install/pre-upgrade checks live in this image
  ##
  image: fission/pre-upgrade-checks
  ## pre-install/pre-upgrade checks image version
  ##
-  imageTag: v1.20.0-rc1
+  imageTag: v1.21.0-rc2

 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -724,7 +764,7 @@ authentication:
  ## jwtSigningKey is the signing key used for
  ## signing the JWT token
  ##
-  jwtSigningKey: serverless
+  jwtSigningKey: 
  ## jwtExpiryTime is the JWT expiry time
  ## in seconds
  ## default '120'
@@ -787,29 +827,29 @@ mqt_keda:
  enabled: true
  connector_images:
    kafka:
-      image: fission/keda-kafka-http-connector
-      tag: v0.12
+      image: ghcr.io/fission/keda-kafka-http-connector
+      tag: v0.17
    rabbitmq:
-      image: fission/keda-rabbitmq-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-rabbitmq-http-connector
+      tag: v0.15
    awskinesis:
-      image: fission/keda-aws-kinesis-http-connector
-      tag: v0.10
+      image: ghcr.io/fission/keda-aws-kinesis-http-connector
+      tag: v0.15
    aws_sqs:
-      image: fission/keda-aws-sqs-http-connector
-      tag: v0.11
+      image: ghcr.io/fission/keda-aws-sqs-http-connector
+      tag: v0.16
    nats_steaming:
-      image: fission/keda-nats-streaming-http-connector
-      tag: v0.13
+      image: ghcr.io/fission/keda-nats-streaming-http-connector
+      tag: v0.18
    nats_jetstream:
-      image: fission/keda-nats-jetstream-http-connector
-      tag: v0.4
+      image: ghcr.io/fission/keda-nats-jetstream-http-connector
+      tag: v0.9
    gcp_pubsub:
-      image: fission/keda-gcp-pubsub-http-connector
-      tag: v0.6
+      image: ghcr.io/fission/keda-gcp-pubsub-http-connector
+      tag: v0.11
    redis:
-      image: fission/keda-redis-http-connector
-      tag: v0.3
+      image: ghcr.io/fission/keda-redis-http-connector
+      tag: v0.8

  ## Pod resources as:
  ##  resources:
@@ -1,4 +1,3 @@
-FROM alpine:3.18
-RUN apk add --update ca-certificates
+FROM cgr.dev/chainguard/static:latest@sha256:5497b01f36ef14a5198c0165e50ae6a0006d0c7457d4566f1110257e1c0812ed
 COPY builder /builder
 ENTRYPOINT ["/builder"]
@@ -24,16 +24,18 @@ import (

 	builder "github.com/fission/fission/pkg/builder"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 // Usage: builder <shared volume path>
-func Run(ctx context.Context, logger *zap.Logger, shareVolume string) {
+func Run(ctx context.Context, logger *zap.Logger, mgr manager.Interface, shareVolume string) {
 	builder := builder.MakeBuilder(logger, shareVolume)
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", builder.Handler)
+	mux.HandleFunc("/clean", builder.Clean)
 	mux.HandleFunc("/version", builder.VersionHandler)
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
-	httpserver.StartServer(ctx, logger, "builder", "8001", mux)
+	httpserver.StartServer(ctx, logger, mgr, "builder", "8001", mux)
 }
@@ -24,15 +24,21 @@ import (

 	"github.com/fission/fission/cmd/builder/app"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/profile"
 )

 // Usage: builder <shared volume path>
 func main() {
+
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()
 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
 	shareVolume := os.Args[1]
 	if _, err := os.Stat(shareVolume); err != nil {
 		if os.IsNotExist(err) {
@@ -42,5 +48,5 @@ func main() {
 			}
 		}
 	}
-	app.Run(ctx, logger, shareVolume)
+	app.Run(ctx, logger, mgr, shareVolume)
 }
@@ -1,4 +1,3 @@
-FROM alpine:3.18
-RUN apk add --update ca-certificates
+FROM cgr.dev/chainguard/static:latest@sha256:5497b01f36ef14a5198c0165e50ae6a0006d0c7457d4566f1110257e1c0812ed
 COPY fetcher /
 ENTRYPOINT ["/fetcher"]
@@ -31,6 +31,7 @@ import (
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/fetcher"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )

@@ -38,7 +39,7 @@ var (
 	readyToServe uint32
 )

-func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) {
+func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port string, podInfoMountDir string) {
 	flag.Usage = fetcherUsage
 	specializeOnStart := flag.Bool("specialize-on-startup", false, "Flag to activate specialize process at pod startup")
 	specializePayload := flag.String("specialize-request", "", "JSON payload for specialize request")
@@ -73,13 +74,13 @@ func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *za
 	ctx, span := tracer.Start(ctx, "fetcher/Run")
 	defer span.End()

-	f, err := fetcher.MakeFetcher(logger, clientGen, dir, *secretDir, *configDir)
+	f, err := fetcher.MakeFetcher(logger, clientGen, dir, *secretDir, *configDir, podInfoMountDir)
 	if err != nil {
 		logger.Fatal("error making fetcher", zap.Error(err))
 	}

 	// do specialization in other goroutine to prevent blocking in newdeploy
-	go func() {
+	mgr.Add(ctx, func(_ context.Context) {
 		if *specializeOnStart {
 			var specializeReq fetcher.FunctionSpecializeRequest

@@ -94,7 +95,7 @@ func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *za
 			}
 		}
 		atomic.StoreUint32(&readyToServe, 1)
-	}()
+	})

 	mux := http.NewServeMux()
 	mux.HandleFunc("/fetch", f.FetchHandler)
@@ -120,7 +121,7 @@ func Run(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *za
 	logger.Info("fetcher ready to receive requests")

 	handler := otelUtils.GetHandlerWithOTEL(mux, "fission-fetcher", otelUtils.UrlsToIgnore("/healthz", "/readiness-healthz"))
-	httpserver.StartServer(ctx, logger, "fetcher", "8000", handler)
+	httpserver.StartServer(ctx, logger, mgr, "fetcher", port, handler)
 }

 func fetcherUsage() {
@@ -20,17 +20,26 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"

 	"github.com/fission/fission/cmd/fetcher/app"
+	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/profile"
 )

+const fetcherPort = "8000"
+
 // Usage: fetcher <shared volume path>
 func main() {
+
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()

 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
-	app.Run(ctx, crd.NewClientGenerator(), logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
+	app.Run(ctx, crd.NewClientGenerator(), logger, mgr, fetcherPort, fv1.PodInfoMount)
 }
@@ -1,4 +1,3 @@
-FROM alpine:3.18
-RUN apk add --update ca-certificates
+FROM cgr.dev/chainguard/static:latest@sha256:5497b01f36ef14a5198c0165e50ae6a0006d0c7457d4566f1110257e1c0812ed
 COPY fission-bundle /
 ENTRYPOINT ["/fission-bundle"]
@@ -26,12 +26,14 @@ import (
 	docopt "github.com/docopt/docopt-go"
 	"go.uber.org/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
+	cnwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"

 	"github.com/fission/fission/cmd/fission-bundle/mqtrigger"
 	"github.com/fission/fission/pkg/buildermgr"
 	"github.com/fission/fission/pkg/canaryconfigmgr"
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/executor"
+	eclient "github.com/fission/fission/pkg/executor/client"
 	"github.com/fission/fission/pkg/info"
 	"github.com/fission/fission/pkg/kubewatcher"
 	functionLogger "github.com/fission/fission/pkg/logger"
@@ -40,51 +42,54 @@ import (
 	"github.com/fission/fission/pkg/storagesvc"
 	"github.com/fission/fission/pkg/timer"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/otel"
 	"github.com/fission/fission/pkg/utils/profile"
 	"github.com/fission/fission/pkg/webhook"
 )

 // runWebhook starts admission webhook server
-func runWebhook(ctx context.Context, logger *zap.Logger, port int) error {
-	return webhook.Start(ctx, logger, port)
+func runWebhook(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
+	return webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
+		Port: port,
+	})
 }

-func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
-	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, false)
+func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) error {
+	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
 }

-func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int, executorUrl string) error {
-	return router.Start(ctx, clientGen, logger, port, executorUrl)
+func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, executorUrl string) error {
+	return router.Start(ctx, clientGen, logger, mgr, port, eclient.MakeClient(logger, executorUrl))
 }

-func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
-	return executor.StartExecutor(ctx, clientGen, logger, port)
+func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int) error {
+	return executor.StartExecutor(ctx, clientGen, logger, mgr, port)
 }

-func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
-	return kubewatcher.Start(ctx, clientGen, logger, routerUrl)
+func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return kubewatcher.Start(ctx, clientGen, logger, mgr, routerUrl)
 }

-func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
-	return timer.Start(ctx, clientGen, logger, routerUrl)
+func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return timer.Start(ctx, clientGen, logger, mgr, routerUrl)
 }

-func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
-	return mqtrigger.Start(ctx, clientGen, logger, routerUrl)
+func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
+	return mqtrigger.Start(ctx, clientGen, logger, mgr, routerUrl)
 }

 // KEDA based MessageQueue Trigger Manager
-func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerURL string) error {
-	return mqt.StartScalerManager(ctx, clientGen, logger, routerURL)
+func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerURL string) error {
+	return mqt.StartScalerManager(ctx, clientGen, logger, mgr, routerURL)
 }

-func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int, storage storagesvc.Storage) error {
-	return storagesvc.Start(ctx, clientGen, logger, storage, port)
+func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, storage storagesvc.Storage) error {
+	return storagesvc.Start(ctx, clientGen, logger, storage, mgr, port)
 }

-func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, storageSvcUrl string) error {
-	return buildermgr.Start(ctx, clientGen, logger, storageSvcUrl)
+func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, storageSvcUrl string) error {
+	return buildermgr.Start(ctx, clientGen, logger, mgr, storageSvcUrl)
 }

 func runLogger(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
@@ -139,6 +144,9 @@ func exitWithSync(logger *zap.Logger) {
 }

 func main() {
+	mgr := manager.New()
+	defer mgr.Wait()
+
 	var err error

 	// From https://github.com/containous/traefik/pull/1817/files
@@ -153,7 +161,6 @@ func main() {

 Use it to start one or more of the fission servers:

-
 Pool manager maintains a pool of generalized function containers, and
 specializes them on-demand. Executor must be run from a pod in a
 Kubernetes cluster.
@@ -205,7 +212,7 @@ Options:
 	defer exitWithSync(logger)

 	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger)
+	profile.ProfileIfEnabled(ctx, logger, mgr)

 	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
 	arguments, err := docopt.ParseArgs(usage, nil, version)
@@ -230,13 +237,13 @@ Options:

 	if arguments["--webhookPort"] != nil {
 		port := getPort(logger, arguments["--webhookPort"])
-		err = runWebhook(ctx, logger, port)
+		err = runWebhook(ctx, clientGen, logger, port)
 		logger.Error("webhook server exited:", zap.Error(err))
 		return
 	}

 	if arguments["--canaryConfig"] == true {
-		err := runCanaryConfigServer(ctx, clientGen, logger)
+		err := runCanaryConfigServer(ctx, clientGen, logger, mgr)
 		if err != nil {
 			logger.Error("canary config server exited with error: ", zap.Error(err))
 			return
@@ -245,7 +252,7 @@ Options:

 	if arguments["--routerPort"] != nil {
 		port := getPort(logger, arguments["--routerPort"])
-		err = runRouter(ctx, clientGen, logger, port, executorUrl)
+		err = runRouter(ctx, clientGen, logger, mgr, port, executorUrl)
 		if err != nil {
 			logger.Error("router exited", zap.Error(err))
 			return
@@ -254,7 +261,7 @@ Options:

 	if arguments["--executorPort"] != nil {
 		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, clientGen, logger, port)
+		err = runExecutor(ctx, clientGen, logger, mgr, port)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
 			return
@@ -262,7 +269,7 @@ Options:
 	}

 	if arguments["--kubewatcher"] == true {
-		err = runKubeWatcher(ctx, clientGen, logger, routerUrl)
+		err = runKubeWatcher(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("kubewatcher exited", zap.Error(err))
 			return
@@ -270,7 +277,7 @@ Options:
 	}

 	if arguments["--timer"] == true {
-		err = runTimer(ctx, clientGen, logger, routerUrl)
+		err = runTimer(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("timer exited", zap.Error(err))
 			return
@@ -278,7 +285,7 @@ Options:
 	}

 	if arguments["--mqt"] == true {
-		err = runMessageQueueMgr(ctx, clientGen, logger, routerUrl)
+		err = runMessageQueueMgr(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("message queue manager exited", zap.Error(err))
 			return
@@ -286,7 +293,7 @@ Options:
 	}

 	if arguments["--mqt_keda"] == true {
-		err = runMQManager(ctx, clientGen, logger, routerUrl)
+		err = runMQManager(ctx, clientGen, logger, mgr, routerUrl)
 		if err != nil {
 			logger.Error("mqt scaler manager exited", zap.Error(err))
 			return
@@ -294,7 +301,7 @@ Options:
 	}

 	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, clientGen, logger, storageSvcUrl)
+		err = runBuilderMgr(ctx, clientGen, logger, mgr, storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
 			return
@@ -319,7 +326,7 @@ Options:
 		} else if arguments["--storageType"] == string(storagesvc.StorageTypeLocal) {
 			storage = storagesvc.NewLocalStorage("/fission")
 		}
-		err := runStorageSvc(ctx, clientGen, logger, port, storage)
+		err := runStorageSvc(ctx, clientGen, logger, mgr, port, storage)
 		if err != nil {
 			logger.Error("storage service exited", zap.Error(err))
 			return
@@ -22,25 +22,29 @@ import (
 	"os"
 	"path"
 	"strings"
+	"time"

 	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/crd"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/mqtrigger"
 	"github.com/fission/fission/pkg/mqtrigger/factory"
 	"github.com/fission/fission/pkg/mqtrigger/messageQueue"
 	_ "github.com/fission/fission/pkg/mqtrigger/messageQueue/kafka"
+	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 )

-func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, routerUrl string) error {
+func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
 		return errors.Wrap(err, "failed to get fission client")
 	}

-	err = crd.WaitForCRDs(ctx, logger, fissionClient)
+	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
@@ -72,11 +76,24 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *
 	if err != nil {
 		logger.Fatal("failed to connect to remote message queue server", zap.Error(err))
 	}
-	mqtMgr := mqtrigger.MakeMessageQueueTriggerManager(logger, fissionClient, mqType, mq)
-	err = mqtMgr.Run(ctx)
+
+	finformerFactory := make(map[string]genInformer.SharedInformerFactory, 0)
+	for _, ns := range utils.DefaultNSResolver().FissionResourceNS {
+		finformerFactory[ns] = genInformer.NewFilteredSharedInformerFactory(fissionClient, time.Minute*30, ns, nil)
+	}
+
+	mqtMgr, err := mqtrigger.MakeMessageQueueTriggerManager(logger, fissionClient, mqType, finformerFactory, mq)
 	if err != nil {
 		return err
 	}
+
+	// Start informer factory
+	for _, factory := range finformerFactory {
+		factory.Start(ctx.Done())
+	}
+
+	mqtMgr.Run(ctx, ctx.Done(), mgr)
+
 	return nil
 }

@@ -81,7 +81,7 @@ func App(clientOptions cmd.ClientOptions) *cobra.Command {
 	})

 	wrapper.SetFlags(rootCmd, flag.FlagSet{
-		Global: []flag.Flag{flag.GlobalServer, flag.GlobalVerbosity, flag.KubeContext, flag.Namespace},
+		Global: []flag.Flag{flag.GlobalVerbosity, flag.KubeContext, flag.Namespace},
 	})

 	groups := helptemplate.CommandGroups{}
@@ -1,4 +1,3 @@
-FROM alpine:3.18
-RUN apk add --update ca-certificates
+FROM cgr.dev/chainguard/static:latest@sha256:5497b01f36ef14a5198c0165e50ae6a0006d0c7457d4566f1110257e1c0812ed
 COPY pre-upgrade-checks /
 ENTRYPOINT ["/pre-upgrade-checks"]
@@ -124,7 +124,7 @@ func (client *PreUpgradeTaskClient) LatestSchemaApplied(ctx context.Context) err

 // VerifyFunctionSpecReferences verifies that a function references secrets, configmaps, pkgs in its own namespace and
 // outputs a list of functions that don't adhere to this requirement.
-func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Context) {
+func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Context) error {
 	client.logger.Info("verifying function spec references for all functions in the cluster")

 	var err error
@@ -140,9 +140,11 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Con
 		}

 		if err != nil {
-			client.logger.Fatal("error listing functions after max retries",
+			client.logger.Error("error listing functions after max retries",
 				zap.Error(err),
 				zap.Int("max_retries", maxRetries))
+			errs = errors.Join(errs, fmt.Errorf("error listing functions in namespace : %s", namespace))
+			continue
 		}

 		// check that all secrets, configmaps, packages are in the same namespace
@@ -169,10 +171,8 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences(ctx context.Con
 	}

 	if errs != nil {
-		client.logger.Fatal("installation failed",
-			zap.Error(errs),
-			zap.String("summary", "a function cannot reference secrets, configmaps and packages outside it's own namespace"))
+		return errs
 	}
-
 	client.logger.Info("function spec references verified")
+	return nil
 }
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fission/fission/test/e2e/framework"
+)
+
+func TestPreUpgradeTaskClient(t *testing.T) {
+	f := framework.NewFramework()
+	defer f.Logger().Sync()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	err := f.Start(ctx)
+	require.NoError(t, err)
+
+	preupgradeClient, err := makePreUpgradeTaskClient(f.ClientGen(), f.Logger())
+	require.NoError(t, err)
+
+	crd := preupgradeClient.GetFunctionCRD(ctx)
+	require.NotNil(t, crd)
+
+	err = preupgradeClient.LatestSchemaApplied(ctx)
+	require.NoError(t, err)
+
+	err = preupgradeClient.VerifyFunctionSpecReferences(ctx)
+	require.NoError(t, err)
+}
@@ -28,22 +28,25 @@ func main() {
 	logger := loggerfactory.GetLogger()
 	defer logger.Sync()

-	crdBackedClient, err := makePreUpgradeTaskClient(crd.NewClientGenerator(), logger)
+	ctx := signals.SetupSignalHandler()
+
+	preupgradeClient, err := makePreUpgradeTaskClient(crd.NewClientGenerator(), logger)
 	if err != nil {
 		logger.Fatal("error creating a crd client, please retry helm upgrade",
 			zap.Error(err))
 	}

-	ctx := signals.SetupSignalHandler()
-	crd := crdBackedClient.GetFunctionCRD(ctx)
+	crd := preupgradeClient.GetFunctionCRD(ctx)
 	if crd == nil {
 		logger.Info("nothing to do since CRDs are not present on the cluster")
 		return
 	}
-
-	err = crdBackedClient.LatestSchemaApplied(ctx)
+	err = preupgradeClient.LatestSchemaApplied(ctx)
 	if err != nil {
 		logger.Fatal("New CRDs are not applied", zap.Error(err))
 	}
-	crdBackedClient.VerifyFunctionSpecReferences(ctx)
+	err = preupgradeClient.VerifyFunctionSpecReferences(ctx)
+	if err != nil {
+		logger.Fatal("Function spec references are not valid", zap.Error(err))
+	}
 }
@@ -1,4 +1,3 @@
-FROM alpine:3.18
-RUN apk add --update ca-certificates
+FROM cgr.dev/chainguard/static:latest@sha256:5497b01f36ef14a5198c0165e50ae6a0006d0c7457d4566f1110257e1c0812ed
 COPY reporter /
-ENTRYPOINT ["/reporter"]
+ENTRYPOINT ["/reporter"]
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.17.0
  name: canaryconfigs.fission.io
 spec:
  group: fission.io
@@ -20,14 +20,19 @@ spec:
        description: CanaryConfig is for canary deployment of two functions.
        properties:
          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.17.0
  name: httptriggers.fission.io
 spec:
  group: fission.io
@@ -21,14 +21,19 @@ spec:
          HTTP requests.
        properties:
          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
@@ -46,35 +51,36 @@ spec:
                  functionweights:
                    additionalProperties:
                      type: integer
-                    description: Function Reference by weight. this map contains function
-                      name as key and its weight as the value. This is for canary
-                      upgrade purpose.
+                    description: |-
+                      Function Reference by weight. this map contains function name as key and its weight
+                      as the value. This is for canary upgrade purpose.
                    nullable: true
                    type: object
                  name:
                    description: Name of the function.
                    type: string
                  type:
-                    description: 'Type indicates whether this function reference is
-                      by name or selector. For now, the only supported reference type
-                      is by "name".  Future reference types: * Function by label or
-                      annotation * Branch or tag of a versioned function * A "rolling
-                      upgrade" from one version of a function to another Available
-                      value: - name - function-weights'
+                    description: |-
+                      Type indicates whether this function reference is by name or selector. For now,
+                      the only supported reference type is by "name".  Future reference types:
+                        * Function by label or annotation
+                        * Branch or tag of a versioned function
+                        * A "rolling upgrade" from one version of a function to another
+                      Available value:
+                      - name
+                      - function-weights
                    type: string
                required:
                - name
                - type
                type: object
              host:
-                description: 'TODO: remove this field since we have IngressConfig
-                  already Deprecated: the original idea of this field is not for setting
-                  Ingress. Since we have IngressConfig now, remove Host after couple
-                  releases.'
+                description: |-
+                  Deprecated: the original idea of this field is not for setting Ingress.
+                  Since we have IngressConfig now, remove Host after couple releases.
                type: string
              ingressconfig:
-                description: 'TODO: make IngressConfig an independent Fission resource
-                  IngressConfig for router to set up Ingress.'
+                description: IngressConfig for router to set up Ingress.
                properties:
                  annotations:
                    additionalProperties:
@@ -84,26 +90,32 @@ spec:
                    nullable: true
                    type: object
                  host:
-                    description: Host is for ingress controller to apply rules. If
-                      host is empty or "*", the rule applies to all inbound HTTP traffic.
+                    description: |-
+                      Host is for ingress controller to apply rules. If
+                      host is empty or "*", the rule applies to all
+                      inbound HTTP traffic.
                    type: string
                  path:
-                    description: Path is for path matching. The format of path depends
-                      on what ingress controller you used.
+                    description: |-
+                      Path is for path matching. The format of path
+                      depends on what ingress controller you used.
                    type: string
                  tls:
-                    description: TLS is for user to specify a Secret that contains
-                      TLS key and certificate. The domain name in the key and crt
-                      must match the value of Host field.
+                    description: |-
+                      TLS is for user to specify a Secret that contains
+                      TLS key and certificate. The domain name in the
+                      key and crt must match the value of Host field.
                    type: string
                type: object
              keepPrefix:
-                description: When function is exposed with Prefix based path, keepPrefix
-                  decides whether to keep or trim prefix in URL while invoking function.
+                description: |-
+                  When function is exposed with Prefix based path,
+                  keepPrefix decides whether to keep or trim prefix in URL while invoking function.
                type: boolean
              method:
-                description: Use Methods instead of Method. This field is going to
-                  be deprecated in a future release HTTP method to access a function.
+                description: |-
+                  Use Methods instead of Method. This field is going to be deprecated in a future release
+                  HTTP method to access a function.
                type: string
              methods:
                description: HTTP methods to access a function
@@ -111,9 +123,11 @@ spec:
                  type: string
                type: array
              prefix:
-                description: 'Prefix with which functions are exposed. NOTE: Prefix
-                  takes precedence over URL/RelativeURL. Note that it does not treat
-                  slashes specially ("/foobar/" will be matched by the prefix "/foobar").'
+                description: |-
+                  Prefix with which functions are exposed.
+                  NOTE: Prefix takes precedence over URL/RelativeURL.
+                  Note that it does not treat slashes specially ("/foobar/" will be matched by
+                  the prefix "/foobar").
                type: string
              relativeurl:
                description: RelativeURL is the exposed URL for external client to
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.17.0
  name: kuberneteswatchtriggers.fission.io
 spec:
  group: fission.io
@@ -21,14 +21,19 @@ spec:
          invokes functions.
        properties:
          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
@@ -36,27 +41,31 @@ spec:
            description: KubernetesWatchTriggerSpec defines spec of KuberenetesWatchTrigger
            properties:
              functionref:
-                description: The reference to a function for kubewatcher to invoke
-                  with when receiving events.
+                description: |-
+                  The reference to a function for kubewatcher to invoke with
+                  when receiving events.
                properties:
                  functionweights:
                    additionalProperties:
                      type: integer
-                    description: Function Reference by weight. this map contains function
-                      name as key and its weight as the value. This is for canary
-                      upgrade purpose.
+                    description: |-
+                      Function Reference by weight. this map contains function name as key and its weight
+                      as the value. This is for canary upgrade purpose.
                    nullable: true
                    type: object
                  name:
                    description: Name of the function.
                    type: string
                  type:
-                    description: 'Type indicates whether this function reference is
-                      by name or selector. For now, the only supported reference type
-                      is by "name".  Future reference types: * Function by label or
-                      annotation * Branch or tag of a versioned function * A "rolling
-                      upgrade" from one version of a function to another Available
-                      value: - name - function-weights'
+                    description: |-
+                      Type indicates whether this function reference is by name or selector. For now,
+                      the only supported reference type is by "name".  Future reference types:
+                        * Function by label or annotation
+                        * Branch or tag of a versioned function
+                        * A "rolling upgrade" from one version of a function to another
+                      Available value:
+                      - name
+                      - function-weights
                    type: string
                required:
                - name
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.17.0
  name: packages.fission.io
 spec:
  group: fission.io
@@ -22,14 +22,19 @@ spec:
        description: Package Think of these as function-level images.
        properties:
          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
@@ -46,24 +51,30 @@ spec:
                  runtime used to run user function.
                properties:
                  checksum:
-                    description: Checksum ensures the integrity of packages referenced
-                      by URL. Ignored for literals.
+                    description: |-
+                      Checksum ensures the integrity of packages
+                      referenced by URL. Ignored for literals.
                    properties:
                      sum:
                        type: string
                      type:
-                        description: ChecksumType specifies the checksum algorithm,
-                          such as sha256, used for a checksum.
+                        description: |-
+                          ChecksumType specifies the checksum algorithm, such as
+                          sha256, used for a checksum.
                        type: string
                    type: object
                  literal:
-                    description: Literal contents of the package. Can be used for
+                    description: |-
+                      Literal contents of the package. Can be used for
                      encoding packages below TODO (256 KB?) size.
                    format: byte
                    type: string
                  type:
-                    description: 'Type defines how the package is specified: literal
-                      or URL. Available value: - literal - url'
+                    description: |-
+                      Type defines how the package is specified: literal or URL.
+                      Available value:
+                       - literal
+                       - url
                    type: string
                  url:
                    description: URL references a package.
@@ -82,30 +93,36 @@ spec:
                - namespace
                type: object
              source:
-                description: Source is the archive contains source code and dependencies
-                  file. If the package status is in PENDING state, builder manager
-                  will then notify builder to compile source and save the result as
-                  deployable archive.
+                description: |-
+                  Source is the archive contains source code and dependencies file.
+                  If the package status is in PENDING state, builder manager will then
+                  notify builder to compile source and save the result as deployable archive.
                properties:
                  checksum:
-                    description: Checksum ensures the integrity of packages referenced
-                      by URL. Ignored for literals.
+                    description: |-
+                      Checksum ensures the integrity of packages
+                      referenced by URL. Ignored for literals.
                    properties:
                      sum:
                        type: string
                      type:
-                        description: ChecksumType specifies the checksum algorithm,
-                          such as sha256, used for a checksum.
+                        description: |-
+                          ChecksumType specifies the checksum algorithm, such as
+                          sha256, used for a checksum.
                        type: string
                    type: object
                  literal:
-                    description: Literal contents of the package. Can be used for
+                    description: |-
+                      Literal contents of the package. Can be used for
                      encoding packages below TODO (256 KB?) size.
                    format: byte
                    type: string
                  type:
-                    description: 'Type defines how the package is specified: literal
-                      or URL. Available value: - literal - url'
+                    description: |-
+                      Type defines how the package is specified: literal or URL.
+                      Available value:
+                       - literal
+                       - url
                    type: string
                  url:
                    description: URL references a package.
@@ -125,9 +142,10 @@ spec:
                description: BuildStatus is the package build status.
                type: string
              lastUpdateTimestamp:
-                description: LastUpdateTimestamp will store the timestamp the package
-                  was last updated metav1.Time is a wrapper around time.Time which
-                  supports correct marshaling to YAML and JSON. https://github.com/kubernetes/apimachinery/blob/44bd77c24ef93cd3a5eb6fef64e514025d10d44e/pkg/apis/meta/v1/time.go#L26-L35
+                description: |-
+                  LastUpdateTimestamp will store the timestamp the package was last updated
+                  metav1.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.
+                  https://github.com/kubernetes/apimachinery/blob/44bd77c24ef93cd3a5eb6fef64e514025d10d44e/pkg/apis/meta/v1/time.go#L26-L35
                format: date-time
                nullable: true
                type: string
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.17.0
  name: timetriggers.fission.io
 spec:
  group: fission.io
@@ -20,19 +20,25 @@ spec:
        description: TimeTrigger invokes functions based on given cron schedule.
        properties:
          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
-            description: TimeTriggerSpec invokes the specific function at a time or
+            description: |-
+              TimeTriggerSpec invokes the specific function at a time or
              times specified by a cron string.
            properties:
              cron:
@@ -44,26 +50,40 @@ spec:
                  functionweights:
                    additionalProperties:
                      type: integer
-                    description: Function Reference by weight. this map contains function
-                      name as key and its weight as the value. This is for canary
-                      upgrade purpose.
+                    description: |-
+                      Function Reference by weight. this map contains function name as key and its weight
+                      as the value. This is for canary upgrade purpose.
                    nullable: true
                    type: object
                  name:
                    description: Name of the function.
                    type: string
                  type:
-                    description: 'Type indicates whether this function reference is
-                      by name or selector. For now, the only supported reference type
-                      is by "name".  Future reference types: * Function by label or
-                      annotation * Branch or tag of a versioned function * A "rolling
-                      upgrade" from one version of a function to another Available
-                      value: - name - function-weights'
+                    description: |-
+                      Type indicates whether this function reference is by name or selector. For now,
+                      the only supported reference type is by "name".  Future reference types:
+                        * Function by label or annotation
+                        * Branch or tag of a versioned function
+                        * A "rolling upgrade" from one version of a function to another
+                      Available value:
+                      - name
+                      - function-weights
                    type: string
                required:
                - name
                - type
                type: object
+              method:
+                default: POST
+                description: 'HTTP Method for trigger, ex : GET, POST, PUT, DELETE,
+                  HEAD (default: "POST")'
+                type: string
+              subpath:
+                default: /
+                description: |-
+                  Subpath to trigger a specific route if function
+                  internally supports routing, (default: "/")
+                type: string
            required:
            - cron
            - functionref
@@ -1,115 +1,124 @@
 module github.com/fission/fission

-go 1.21
+go 1.23.4

 require (
-	dario.cat/mergo v1.0.0
-	github.com/IBM/sarama v1.41.3
+	dario.cat/mergo v1.0.1
+	github.com/IBM/sarama v1.45.0
 	github.com/bep/debounce v1.2.1
 	github.com/dchest/uniuri v1.2.0
 	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/crd-ref-docs v0.0.10
-	github.com/fatih/color v1.15.0
-	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-git/go-git/v5 v5.10.0
-	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/elastic/crd-ref-docs v0.1.0
+	github.com/fatih/color v1.18.0
+	github.com/fsnotify/fsnotify v1.8.0
+	github.com/go-git/go-git/v5 v5.13.1
+	github.com/go-logr/zapr v1.3.0
+	github.com/golang-jwt/jwt/v4 v4.5.1
 	github.com/google/go-cmp v0.6.0
-	github.com/google/uuid v1.4.0
-	github.com/gorilla/mux v1.8.0
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/mux v1.8.1
 	github.com/graymeta/stow v0.2.8
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-retryablehttp v0.7.4
-	github.com/influxdata/influxdb v1.11.2
-	github.com/mholt/archiver/v3 v3.5.1
+	github.com/hashicorp/go-retryablehttp v0.7.7
+	github.com/influxdata/influxdb v1.11.8
+	github.com/kedacore/keda/v2 v2.16.1
+	github.com/mholt/archives v0.1.0
 	github.com/minio/minio-go v6.0.14+incompatible
 	github.com/ory/dockertest v3.3.5+incompatible
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.17.0
-	github.com/prometheus/common v0.45.0
+	github.com/prometheus/client_golang v1.20.5
+	github.com/prometheus/common v0.62.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
-	github.com/spf13/cobra v1.7.0
+	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.10.0
 	github.com/wcharczuk/go-chart v2.0.1+incompatible
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0
-	go.opentelemetry.io/contrib/propagators/autoprop v0.45.0
-	go.opentelemetry.io/otel v1.19.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
-	go.opentelemetry.io/otel/sdk v1.19.0
-	go.opentelemetry.io/otel/trace v1.19.0
-	go.uber.org/zap v1.26.0
-	golang.org/x/net v0.17.0
-	google.golang.org/grpc v1.59.0
-	k8s.io/api v0.28.3
-	k8s.io/apiextensions-apiserver v0.28.3
-	k8s.io/apimachinery v0.28.3
-	k8s.io/client-go v0.28.3
-	k8s.io/metrics v0.28.3
-	sigs.k8s.io/controller-runtime v0.16.3
-	sigs.k8s.io/controller-tools v0.13.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0
+	go.opentelemetry.io/contrib/propagators/autoprop v0.59.0
+	go.opentelemetry.io/otel v1.34.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0
+	go.opentelemetry.io/otel/sdk v1.34.0
+	go.opentelemetry.io/otel/trace v1.34.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/net v0.34.0
+	google.golang.org/grpc v1.69.4
+	k8s.io/api v0.32.1
+	k8s.io/apiextensions-apiserver v0.32.1
+	k8s.io/apimachinery v0.32.1
+	k8s.io/client-go v0.32.1
+	k8s.io/code-generator v0.32.1
+	k8s.io/metrics v0.32.1
+	sigs.k8s.io/controller-runtime v0.19.4
+	sigs.k8s.io/controller-tools v0.17.1
+	sigs.k8s.io/structured-merge-diff/v4 v4.5.0
 	sigs.k8s.io/yaml v1.4.0
 )

 require (
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
-	github.com/acomagu/bufpipe v1.0.4 // indirect
-	github.com/andybalholm/brotli v1.0.1 // indirect
+	github.com/ProtonMail/go-crypto v1.1.3 // indirect
+	github.com/STARRY-S/zip v0.2.1 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/aws/aws-sdk-go v1.42.34 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blend/go-sdk v1.20220112.5 // indirect
+	github.com/bodgit/plumbing v1.3.0 // indirect
+	github.com/bodgit/sevenzip v1.6.0 // indirect
+	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/containerd/continuity v0.2.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/eapache/go-resiliency v1.4.0 // indirect
+	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
+	github.com/eapache/go-resiliency v1.7.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
-	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/expr-lang/expr v1.16.9 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-billy/v5 v5.6.1 // indirect
 	github.com/go-ini/ini v1.66.4 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-logr/zapr v1.2.4 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
-	github.com/gobuffalo/flect v1.0.2 // indirect
-	github.com/goccy/go-yaml v1.11.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/gobuffalo/flect v1.0.3 // indirect
+	github.com/goccy/go-yaml v1.11.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
 	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
@@ -121,69 +130,74 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.16.7 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/lib/pq v1.10.4 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.5 // indirect
-	github.com/pierrec/lz4/v4 v4.1.18 // indirect
+	github.com/opencontainers/runc v1.1.14 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
-	github.com/skeema/knownhosts v1.2.0 // indirect
-	github.com/ulikunitz/xz v0.5.9 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/skeema/knownhosts v1.3.0 // indirect
+	github.com/sorairolake/lzip-go v0.3.5 // indirect
+	github.com/therootcompany/xz v1.0.1 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	go.opentelemetry.io/contrib/propagators/aws v1.20.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.20.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.20.0 // indirect
-	go.opentelemetry.io/contrib/propagators/ot v1.20.0 // indirect
-	go.opentelemetry.io/otel/metric v1.19.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/propagators/aws v1.34.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.34.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.34.0 // indirect
+	go.opentelemetry.io/contrib/propagators/ot v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.34.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.14.0 // indirect
-	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
-	golang.org/x/image v0.5.0 // indirect
-	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.13.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
+	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa // indirect
+	golang.org/x/image v0.18.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/oauth2 v0.24.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
+	google.golang.org/protobuf v1.36.3 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
-	k8s.io/component-base v0.28.3 // indirect
-	k8s.io/klog/v2 v2.100.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
-	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	knative.dev/pkg v0.0.0-20241218051509-40afb7c5436e // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 )
@@ -29,16 +29,18 @@ set +x
 echo "" > coverage.txt

 make install-envtest
-KUBEBUILDER_ASSETS=$(setup-envtest -p path use 1.23.x)
+KUBEBUILDER_ASSETS=$(setup-envtest -p path use 1.30.x)
 export KUBEBUILDER_ASSETS

 # The executor unit test only works with NodePort-type services for
 # now. So disable it for our travis ci tests except some partial tests.
-for d in $(go list ./... | grep -v '/vendor/' | grep -v 'examples/go' | grep -v 'benchmark'); do
-    echo "Running tests in $d"
-    go test -race -v -coverprofile=profile.out -covermode=atomic $d
-    if [ -f profile.out ]; then
-        cat profile.out >> coverage.txt
-        rm profile.out
-    fi
-done
+# for d in $(go list ./... | grep -v '/vendor/' | grep -v 'examples/go' | grep -v 'benchmark'); do
+#     echo "Running tests in $d"
+#     go test -race -v -coverprofile=profile.out -covermode=atomic $d
+#     if [ -f profile.out ]; then
+#         cat profile.out >> coverage.txt
+#         rm profile.out
+#     fi
+# done
+echo "Running tests ..."
+go test -race -v -coverprofile=coverage.txt -covermode=atomic --coverpkg=./... ./...
@@ -3,17 +3,27 @@ set -o errexit
 set -o nounset
 set -o pipefail

-if [ ! -d "../code-generator" ]; then
-	echo "Please get code-generator from fission org"
-	exit 1
-fi
-
+GOPATH=$(go env GOPATH)
 SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
-CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
+CODEGEN_PKG=${CODEGEN_PKG:-$(
+	cd "${SCRIPT_ROOT}"
+	ls -d -1 ${SCRIPT_ROOT}/../code-generator 2>/dev/null || echo $GOPATH/pkg/mod/k8s.io/code-generator@v0.32.0
+)}
+OUTDIR="${SCRIPT_ROOT}/pkg/generated"

-bash "${CODEGEN_PKG}"/generate-groups.sh "client,informer,lister" \
-	github.com/fission/fission/pkg/generated \
-	github.com/fission/fission/pkg/apis \
-	"core:v1" \
-	--output-base "$(dirname "${BASH_SOURCE[0]}")/../../../.." \
-	--go-header-file "$(dirname "${BASH_SOURCE[0]}")/boilerplate.txt"
+echo "Generating code under ${OUTDIR} using ${CODEGEN_PKG} ..."
+
+source "${CODEGEN_PKG}/kube_codegen.sh"
+
+# kube::codegen::gen_helpers \
+#     --input-pkg-root github.com/fission/fission/pkg/apis \
+#     --output-base "${OUTDIR}" \
+#     --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.txt"
+
+kube::codegen::gen_client \
+	--with-watch \
+	--with-applyconfig \
+	--output-pkg github.com/fission/fission/pkg/generated \
+	--output-dir "${OUTDIR}" \
+	--boilerplate "${SCRIPT_ROOT}/hack/boilerplate.txt" \
+	"${SCRIPT_ROOT}/pkg/apis" \
@@ -167,3 +167,7 @@ const (
 	ConfigMaps  = "configmaps"
 	Secrets     = "secrets"
 )
+
+const (
+	BuilderContainerName = "builder"
+)
@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var environmentlog = loggerfactory.GetLogger().Named("environment-resource")
-
-func (r *Environment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-environment,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create;update,versions=v1,name=menvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Environment{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Environment) Default() {
-	environmentlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-environment,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create,versions=v1,name=venvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Environment{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateCreate() (admission.Warnings, error) {
-	environmentlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Environment", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	environmentlog.Debug("validate update", zap.String("name", r.Name))
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateDelete() (admission.Warnings, error) {
-	environmentlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,105 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var functionlog = loggerfactory.GetLogger().Named("function-resource")
-
-func (r *Function) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-function,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=mfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Function{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Function) Default() {
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-function,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=vfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Function{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateCreate() (admission.Warnings, error) {
-	functionlog.Debug("validate create", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	functionlog.Debug("validate update", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateDelete() (admission.Warnings, error) {
-	functionlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,80 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var httptriggerlog = loggerfactory.GetLogger().Named("httptrigger-resource")
-
-func (r *HTTPTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-httptrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=mhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &HTTPTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *HTTPTrigger) Default() {
-	httptriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-httptrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=vhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &HTTPTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (t *HTTPTrigger) ValidateCreate() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate create", zap.String("name", t.Name))
-	err := t.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	httptriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateDelete() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate delete", zap.String("name", r.Name))
-
-	return nil, nil
-}
@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var kuberneteswatchtriggerlog = loggerfactory.GetLogger().Named("kuberneteswatchtrigger-resource")
-
-func (r *KubernetesWatchTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-kuberneteswatchtrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create;update,versions=v1,name=mkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &KubernetesWatchTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) Default() {
-	kuberneteswatchtriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-kuberneteswatchtrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create,versions=v1,name=vkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &KubernetesWatchTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateCreate() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Watch", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	// WATCH UPDATE NOT IMPLEMENTED
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateDelete() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,99 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"github.com/dustin/go-humanize"
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var packagelog = loggerfactory.GetLogger().Named("package-resource")
-
-func (r *Package) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-//+kubebuilder:webhook:path=/mutate-fission-io-v1-package,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=mpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Package{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Package) Default() {
-	packagelog.Debug("default", zap.String("name", r.Name))
-	if r.Status.BuildStatus == "" {
-		r.Status.BuildStatus = BuildStatusPending
-	}
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-package,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=vpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Package{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateCreate() (admission.Warnings, error) {
-	packagelog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	// Ensure size limits
-	if len(r.Spec.Source.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	if len(r.Spec.Deployment.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	packagelog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateDelete() (admission.Warnings, error) {
-	packagelog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,92 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var timetriggerlog = loggerfactory.GetLogger().Named("timetrigger-resource")
-
-func (r *TimeTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-timetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=mtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &TimeTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *TimeTrigger) Default() {
-	timetriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-timetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=vtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &TimeTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateCreate() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	timetriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateDelete() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -821,6 +821,17 @@ type (

 		// The reference to function
 		FunctionReference `json:"functionref"`
+
+		// HTTP Method for trigger, ex : GET, POST, PUT, DELETE, HEAD (default: "POST")
+		// +kubebuilder:default:="POST"
+		// +optional
+		Method string `json:"method,omitempty"`
+
+		// Subpath to trigger a specific route if function
+		// internally supports routing, (default: "/")
+		// +kubebuilder:default:="/"
+		// +optional
+		Subpath string `json:"subpath,omitempty"`
 	}
 	// FailureType refers to the type of failure
 	FailureType string
@@ -337,7 +337,7 @@ func (es ExecutionStrategy) Validate() error {
 		}

 		// TODO Add validation warning
-		//if es.SpecializationTimeout < 120 {
+		// if es.SpecializationTimeout < 120 {
 		//	result = multierror.Append(result, MakeValidationErr(ErrorInvalidValue, "ExecutionStrategy.SpecializationTimeout", es.SpecializationTimeout, "SpecializationTimeout must be a value equal to or greater than 120"))
 		//}
 	}
@@ -0,0 +1,537 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Fission Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&Environment{}, func(obj interface{}) { SetObjectDefaults_Environment(obj.(*Environment)) })
+	scheme.AddTypeDefaultingFunc(&EnvironmentList{}, func(obj interface{}) { SetObjectDefaults_EnvironmentList(obj.(*EnvironmentList)) })
+	scheme.AddTypeDefaultingFunc(&Function{}, func(obj interface{}) { SetObjectDefaults_Function(obj.(*Function)) })
+	scheme.AddTypeDefaultingFunc(&FunctionList{}, func(obj interface{}) { SetObjectDefaults_FunctionList(obj.(*FunctionList)) })
+	scheme.AddTypeDefaultingFunc(&MessageQueueTrigger{}, func(obj interface{}) { SetObjectDefaults_MessageQueueTrigger(obj.(*MessageQueueTrigger)) })
+	scheme.AddTypeDefaultingFunc(&MessageQueueTriggerList{}, func(obj interface{}) { SetObjectDefaults_MessageQueueTriggerList(obj.(*MessageQueueTriggerList)) })
+	return nil
+}
+
+func SetObjectDefaults_Environment(in *Environment) {
+	if in.Spec.Runtime.Container != nil {
+		for i := range in.Spec.Runtime.Container.Ports {
+			a := &in.Spec.Runtime.Container.Ports[i]
+			if a.Protocol == "" {
+				a.Protocol = "TCP"
+			}
+		}
+		if in.Spec.Runtime.Container.LivenessProbe != nil {
+			if in.Spec.Runtime.Container.LivenessProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Runtime.Container.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Runtime.Container.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+		if in.Spec.Runtime.Container.ReadinessProbe != nil {
+			if in.Spec.Runtime.Container.ReadinessProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Runtime.Container.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Runtime.Container.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+		if in.Spec.Runtime.Container.StartupProbe != nil {
+			if in.Spec.Runtime.Container.StartupProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Runtime.Container.StartupProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Runtime.Container.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+	}
+	if in.Spec.Runtime.PodSpec != nil {
+		for i := range in.Spec.Runtime.PodSpec.InitContainers {
+			a := &in.Spec.Runtime.PodSpec.InitContainers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.Runtime.PodSpec.Containers {
+			a := &in.Spec.Runtime.PodSpec.Containers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.Runtime.PodSpec.EphemeralContainers {
+			a := &in.Spec.Runtime.PodSpec.EphemeralContainers[i]
+			for j := range a.EphemeralContainerCommon.Ports {
+				b := &a.EphemeralContainerCommon.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.EphemeralContainerCommon.LivenessProbe != nil {
+				if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.ReadinessProbe != nil {
+				if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.StartupProbe != nil {
+				if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+	}
+	if in.Spec.Builder.Container != nil {
+		for i := range in.Spec.Builder.Container.Ports {
+			a := &in.Spec.Builder.Container.Ports[i]
+			if a.Protocol == "" {
+				a.Protocol = "TCP"
+			}
+		}
+		if in.Spec.Builder.Container.LivenessProbe != nil {
+			if in.Spec.Builder.Container.LivenessProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Builder.Container.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Builder.Container.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+		if in.Spec.Builder.Container.ReadinessProbe != nil {
+			if in.Spec.Builder.Container.ReadinessProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Builder.Container.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Builder.Container.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+		if in.Spec.Builder.Container.StartupProbe != nil {
+			if in.Spec.Builder.Container.StartupProbe.ProbeHandler.GRPC != nil {
+				if in.Spec.Builder.Container.StartupProbe.ProbeHandler.GRPC.Service == nil {
+					var ptrVar1 string = ""
+					in.Spec.Builder.Container.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+				}
+			}
+		}
+	}
+	if in.Spec.Builder.PodSpec != nil {
+		for i := range in.Spec.Builder.PodSpec.InitContainers {
+			a := &in.Spec.Builder.PodSpec.InitContainers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.Builder.PodSpec.Containers {
+			a := &in.Spec.Builder.PodSpec.Containers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.Builder.PodSpec.EphemeralContainers {
+			a := &in.Spec.Builder.PodSpec.EphemeralContainers[i]
+			for j := range a.EphemeralContainerCommon.Ports {
+				b := &a.EphemeralContainerCommon.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.EphemeralContainerCommon.LivenessProbe != nil {
+				if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.ReadinessProbe != nil {
+				if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.StartupProbe != nil {
+				if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+	}
+}
+
+func SetObjectDefaults_EnvironmentList(in *EnvironmentList) {
+	for i := range in.Items {
+		a := &in.Items[i]
+		SetObjectDefaults_Environment(a)
+	}
+}
+
+func SetObjectDefaults_Function(in *Function) {
+	if in.Spec.PodSpec != nil {
+		for i := range in.Spec.PodSpec.InitContainers {
+			a := &in.Spec.PodSpec.InitContainers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.PodSpec.Containers {
+			a := &in.Spec.PodSpec.Containers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.PodSpec.EphemeralContainers {
+			a := &in.Spec.PodSpec.EphemeralContainers[i]
+			for j := range a.EphemeralContainerCommon.Ports {
+				b := &a.EphemeralContainerCommon.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.EphemeralContainerCommon.LivenessProbe != nil {
+				if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.ReadinessProbe != nil {
+				if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.StartupProbe != nil {
+				if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+	}
+}
+
+func SetObjectDefaults_FunctionList(in *FunctionList) {
+	for i := range in.Items {
+		a := &in.Items[i]
+		SetObjectDefaults_Function(a)
+	}
+}
+
+func SetObjectDefaults_MessageQueueTrigger(in *MessageQueueTrigger) {
+	if in.Spec.PodSpec != nil {
+		for i := range in.Spec.PodSpec.InitContainers {
+			a := &in.Spec.PodSpec.InitContainers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.PodSpec.Containers {
+			a := &in.Spec.PodSpec.Containers[i]
+			for j := range a.Ports {
+				b := &a.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.LivenessProbe != nil {
+				if a.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.ReadinessProbe != nil {
+				if a.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.StartupProbe != nil {
+				if a.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+		for i := range in.Spec.PodSpec.EphemeralContainers {
+			a := &in.Spec.PodSpec.EphemeralContainers[i]
+			for j := range a.EphemeralContainerCommon.Ports {
+				b := &a.EphemeralContainerCommon.Ports[j]
+				if b.Protocol == "" {
+					b.Protocol = "TCP"
+				}
+			}
+			if a.EphemeralContainerCommon.LivenessProbe != nil {
+				if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.LivenessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.ReadinessProbe != nil {
+				if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+			if a.EphemeralContainerCommon.StartupProbe != nil {
+				if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC != nil {
+					if a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service == nil {
+						var ptrVar1 string = ""
+						a.EphemeralContainerCommon.StartupProbe.ProbeHandler.GRPC.Service = &ptrVar1
+					}
+				}
+			}
+		}
+	}
+}
+
+func SetObjectDefaults_MessageQueueTriggerList(in *MessageQueueTriggerList) {
+	for i := range in.Items {
+		a := &in.Items[i]
+		SetObjectDefaults_MessageQueueTrigger(a)
+	}
+}
@@ -428,6 +428,8 @@ var map_TimeTriggerSpec = map[string]string{
 	"":            "TimeTriggerSpec invokes the specific function at a time or times specified by a cron string.",
 	"cron":        "Cron schedule",
 	"functionref": "The reference to function",
+	"method":      "HTTP Method for trigger, ex : GET, POST, PUT, DELETE, HEAD (default: \"POST\")",
+	"subpath":     "Subpath to trigger a specific route if function internally supports routing, (default: \"/\")",
 }

 func (TimeTriggerSpec) SwaggerDoc() map[string]string {
@@ -35,6 +35,7 @@ import (
 	"go.uber.org/zap"

 	"github.com/fission/fission/pkg/info"
+	"github.com/fission/fission/pkg/utils"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )

@@ -121,9 +122,19 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
 	logger.Info("builder received request", zap.Any("request", req))

 	logger.Debug("starting build")
-	srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
+	srcPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename), builder.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
+		builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
+		return
+	}
 	deployPkgFilename := fmt.Sprintf("%s-%s", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))
-	deployPkgPath := filepath.Join(builder.sharedVolumePath, deployPkgFilename)
+	deployPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, deployPkgFilename), builder.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
+		builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
+		return
+	}

 	var buildArgs []string
 	buildCmd := req.BuildCommand
@@ -154,6 +165,38 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
 	builder.reply(r.Context(), w, deployPkgFilename, buildLogs, http.StatusOK)
 }

+func (builder *Builder) Clean(w http.ResponseWriter, r *http.Request) {
+	logger := otelUtils.LoggerWithTraceID(r.Context(), builder.logger)
+
+	if r.Method != "DELETE" {
+		e := "method not allowed"
+		logger.Error(e, zap.String("http_method", r.Method))
+		builder.reply(r.Context(), w, "", fmt.Sprintf("%s: %s", e, r.Method), http.StatusMethodNotAllowed)
+		return
+	}
+
+	startTime := time.Now()
+	defer func() {
+		elapsed := time.Since(startTime)
+		logger.Info("clean request complete", zap.Duration("elapsed_time", elapsed))
+	}()
+
+	srcPkgFilename := r.URL.Query().Get("name")
+	srcPkgPath := filepath.Join(builder.sharedVolumePath, srcPkgFilename)
+
+	logger.Info("builder received clean request", zap.Any("source_package", srcPkgFilename))
+
+	err := utils.DeleteOldPackages(srcPkgPath, envSrcPkg)
+	if err != nil {
+		e := "error deleting src package after build"
+		logger.Error(e, zap.Error(err))
+		builder.reply(r.Context(), w, srcPkgFilename, "", http.StatusInternalServerError)
+		return
+	}
+
+	builder.reply(r.Context(), w, srcPkgFilename, "", http.StatusOK)
+}
+
 func (builder *Builder) reply(ctx context.Context, w http.ResponseWriter, pkgFilename string, buildLogs string, statusCode int) {
 	logger := otelUtils.LoggerWithTraceID(ctx, builder.logger)
 	resp := PackageBuildResponse{
@@ -168,4 +168,50 @@ func TestBuilder(t *testing.T) {
 			})
 		}
 	})
+
+	// Test CleanHandler
+	t.Run("CleanHandler", func(t *testing.T) {
+		for _, test := range []struct {
+			name           string
+			srcPkgFilename string
+			handler        func(w http.ResponseWriter, r *http.Request)
+			status         int
+		}{
+			{
+				name:           "should fail deleting src pkg: invalid shared volume path",
+				srcPkgFilename: "test2",
+				handler: func(w http.ResponseWriter, r *http.Request) {
+					builder.Clean(w, r)
+				},
+				status: http.StatusInternalServerError,
+			},
+			{
+				name:           "should fail deleting src pkg: method not allowed",
+				srcPkgFilename: "test3",
+				handler: func(w http.ResponseWriter, r *http.Request) {
+					builder.Handler(w, r)
+				},
+				status: http.StatusMethodNotAllowed,
+			},
+		} {
+			t.Run(test.name, func(t *testing.T) {
+				_, err := os.MkdirTemp(dir, test.srcPkgFilename)
+				if err != nil {
+					t.Fatal(err)
+				}
+				srcFile, err := os.Create(dir + "/" + test.srcPkgFilename)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer srcFile.Close()
+				w := httptest.NewRecorder()
+				r := httptest.NewRequest(http.MethodDelete, "/clean/"+test.srcPkgFilename, http.NoBody)
+				test.handler(w, r)
+				resp := w.Result()
+				if resp.StatusCode != test.status {
+					t.Errorf("expected status code %d, got %d", test.status, resp.StatusCode)
+				}
+			})
+		}
+	})
 }
@@ -21,6 +21,7 @@ import (
 	"context"
 	"encoding/json"
 	"io"
+	"net/http"
 	"strings"

 	"github.com/hashicorp/go-retryablehttp"
@@ -35,25 +36,34 @@ import (
 )

 type (
-	Client struct {
+	ClientInterface interface {
+		Build(context.Context, *builder.PackageBuildRequest) (*builder.PackageBuildResponse, error)
+		Clean(context.Context, string) error
+	}
+
+	client struct {
 		logger     *zap.Logger
 		url        string
 		httpClient *retryablehttp.Client
 	}
 )

-func MakeClient(logger *zap.Logger, builderUrl string) *Client {
+func MakeClient(logger *zap.Logger, builderUrl string) ClientInterface {
 	hc := retryablehttp.NewClient()
 	hc.ErrorHandler = retryablehttp.PassthroughErrorHandler
 	hc.HTTPClient.Transport = otelhttp.NewTransport(hc.HTTPClient.Transport)
-	return &Client{
+	return &client{
 		logger:     logger.Named("builder_client"),
 		url:        strings.TrimSuffix(builderUrl, "/"),
 		httpClient: hc,
 	}
 }

-func (c *Client) Build(ctx context.Context, req *builder.PackageBuildRequest) (*builder.PackageBuildResponse, error) {
+func (c *client) getCleanUrl(srcPkgFilename string) string {
+	return c.url + "/clean" + "?name=" + srcPkgFilename
+}
+
+func (c *client) Build(ctx context.Context, req *builder.PackageBuildRequest) (*builder.PackageBuildResponse, error) {
 	logger := otelUtils.LoggerWithTraceID(ctx, c.logger)

 	body, err := json.Marshal(req)
@@ -82,3 +92,29 @@ func (c *Client) Build(ctx context.Context, req *builder.PackageBuildRequest) (*

 	return &pkgBuildResp, ferror.MakeErrorFromHTTP(resp)
 }
+
+func (c *client) Clean(ctx context.Context, srcPkgFilename string) error {
+	logger := otelUtils.LoggerWithTraceID(ctx, c.logger)
+
+	req, err := http.NewRequest(http.MethodDelete, c.getCleanUrl(srcPkgFilename), http.NoBody)
+	if err != nil {
+		return errors.Wrap(err, "failed to create http request for clean api")
+	}
+
+	resp, err := ctxhttp.Do(ctx, c.httpClient.StandardClient(), req)
+	if err != nil {
+		logger.Error("error sending clean request", zap.Error(err))
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusMethodNotAllowed {
+		return nil
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return ferror.MakeErrorFromHTTP(resp)
+	}
+
+	return nil
+}
@@ -29,10 +29,11 @@ import (
 	"github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 // Start the buildermgr service.
-func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, storageSvcUrl string) error {
+func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, storageSvcUrl string) error {
 	bmLogger := logger.Named("builder_manager")

 	fissionClient, err := clientGen.GetFissionClient()
@@ -44,7 +45,7 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *
 		return errors.Wrap(err, "failed to get kubernetes client")
 	}

-	err = crd.WaitForCRDs(ctx, logger, fissionClient)
+	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
@@ -60,16 +61,16 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *
 	}

 	envWatcher, err := makeEnvironmentWatcher(ctx, bmLogger, fissionClient, kubernetesClient, fetcherConfig, podSpecPatch)
-	envWatcher.Run(ctx)
 	if err != nil {
 		return err
 	}
+	envWatcher.Run(ctx, mgr)

 	pkgWatcher := makePackageWatcher(bmLogger, fissionClient,
 		kubernetesClient, storageSvcUrl,
 		utils.GetK8sInformersForNamespaces(kubernetesClient, time.Minute*30, fv1.Pods),
 		utils.GetInformersForNamespaces(fissionClient, time.Minute*30, fv1.PackagesResource))
-	err = pkgWatcher.Run(ctx)
+	err = pkgWatcher.Run(ctx, mgr)
 	if err != nil {
 		return err
 	}
@@ -60,6 +60,15 @@ func buildPackage(ctx context.Context, logger *zap.Logger, fissionClient version
 	fetcherC := fetcherClient.MakeClient(logger, fmt.Sprintf("http://%v:8000", svcName))
 	builderC := builderClient.MakeClient(logger, fmt.Sprintf("http://%v:8001", svcName))

+	defer func() {
+		logger.Info("cleaning src pkg from builder storage", zap.String("source_package", srcPkgFilename))
+		errC := cleanPackage(ctx, builderC, srcPkgFilename)
+		if errC != nil {
+			m := "error cleaning src pkg from builder storage"
+			logger.Error(m, zap.Error(errC))
+		}
+	}()
+
 	fetchReq := &fetcher.FunctionFetchRequest{
 		FetchType:   fv1.FETCH_SOURCE,
 		Package:     pkg.ObjectMeta,
@@ -121,6 +130,15 @@ func buildPackage(ctx context.Context, logger *zap.Logger, fissionClient version
 	return uploadResp, buildResp.BuildLogs, nil
 }

+func cleanPackage(ctx context.Context, builderClient builderClient.ClientInterface, srcPkgFileName string) error {
+	err := builderClient.Clean(ctx, srcPkgFileName)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func updatePackage(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface,
 	pkg *fv1.Package, status fv1.BuildStatus, buildLogs string,
 	uploadResp *fetcher.ArchiveUploadResponse) (*fv1.Package, error) {
@@ -28,6 +28,7 @@ import (
 	apiv1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/client-go/kubernetes"
@@ -39,6 +40,7 @@ import (
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 const (
@@ -72,6 +74,7 @@ type (
 		useIstio               bool
 		podSpecPatch           *apiv1.PodSpec
 		envWatchInformer       map[string]k8sCache.SharedIndexInformer
+		enableOwnerReferences  bool
 	}
 )

@@ -106,6 +109,7 @@ func makeEnvironmentWatcher(
 		fetcherConfig:          fetcherConfig,
 		podSpecPatch:           podSpecPatch,
 		envWatchInformer:       utils.GetInformersForNamespaces(fissionClient, time.Minute*30, fv1.EnvironmentResource),
+		enableOwnerReferences:  utils.IsOwnerReferencesEnabled(),
 	}

 	err := envWatcher.EnvWatchEventHandlers(ctx)
@@ -131,10 +135,8 @@ func (envw *environmentWatcher) getLabels(envName string, envNamespace string, e
 	}
 }

-func (envw *environmentWatcher) Run(ctx context.Context) {
-	for _, informer := range envw.envWatchInformer {
-		go informer.Run(ctx.Done())
-	}
+func (envw *environmentWatcher) Run(ctx context.Context, mgr manager.Interface) {
+	mgr.AddInformers(ctx, envw.envWatchInformer)
 }

 func (envw *environmentWatcher) EnvWatchEventHandlers(ctx context.Context) error {
@@ -164,7 +166,7 @@ func (envw *environmentWatcher) EnvWatchEventHandlers(ctx context.Context) error
 }

 func (envw *environmentWatcher) AddUpdateBuilder(ctx context.Context, env *fv1.Environment) {
-	//builder is not supported with v1 interface and ignore env without builder image
+	// builder is not supported with v1 interface and ignore env without builder image
 	if env.Spec.Version != 1 && len(env.Spec.Builder.Image) != 0 {
 		if _, ok := envw.cache[crd.CacheKeyUIDFromMeta(&env.ObjectMeta)]; !ok {
 			builderInfo, err := envw.createBuilder(ctx, env, envw.nsResolver.GetBuilderNS(env.ObjectMeta.Namespace))
@@ -325,11 +327,22 @@ func (envw *environmentWatcher) getBuilderServiceList(ctx context.Context, sel m
 func (envw *environmentWatcher) createBuilderService(ctx context.Context, env *fv1.Environment, ns string) (*apiv1.Service, error) {
 	name := fmt.Sprintf("%v-%v", env.ObjectMeta.Name, env.ObjectMeta.ResourceVersion)
 	sel := envw.getLabels(env.ObjectMeta.Name, ns, env.ObjectMeta.ResourceVersion)
+	var ownerReferences []metav1.OwnerReference
+	if envw.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(env, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Environment",
+			}),
+		}
+	}
 	service := apiv1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Namespace: ns,
-			Name:      name,
-			Labels:    sel,
+			Namespace:       ns,
+			Name:            name,
+			Labels:          sel,
+			OwnerReferences: ownerReferences,
 		},
 		Spec: apiv1.ServiceSpec{
 			Selector: sel,
@@ -390,7 +403,7 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
 	}

 	container, err := util.MergeContainer(&apiv1.Container{
-		Name:                   "builder",
+		Name:                   fv1.BuilderContainerName,
 		Image:                  env.Spec.Builder.Image,
 		ImagePullPolicy:        envw.builderImagePullPolicy,
 		TerminationMessagePath: "/dev/termination-log",
@@ -436,11 +449,23 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env

 	pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))

+	var ownerReferences []metav1.OwnerReference
+	if envw.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(env, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Environment",
+			}),
+		}
+	}
+
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Namespace: ns,
-			Name:      name,
-			Labels:    sel,
+			Namespace:       ns,
+			Name:            name,
+			Labels:          sel,
+			OwnerReferences: ownerReferences,
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: &replicas,
@@ -30,8 +30,10 @@ import (

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/cache"
+	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/metrics"
 )

@@ -44,7 +46,7 @@ type (
 		podInformer   map[string]k8sCache.SharedIndexInformer
 		pkgInformer   map[string]k8sCache.SharedIndexInformer
 		storageSvcUrl string
-		buildCache    *cache.Cache
+		buildCache    *cache.Cache[crd.CacheKeyUR, *fv1.Package]
 	}
 )

@@ -59,13 +61,13 @@ func makePackageWatcher(logger *zap.Logger, fissionClient versioned.Interface, k
 		podInformer:   podInformer,
 		pkgInformer:   pkgInformer,
 		storageSvcUrl: storageSvcUrl,
-		buildCache:    cache.MakeCache(0, 0),
+		buildCache:    cache.MakeCache[crd.CacheKeyUR, *fv1.Package](0, 0),
 	}
 	return pkgw
 }

-func (pkgw *packageWatcher) buildCacheKey(obj metav1.ObjectMeta) string {
-	return fmt.Sprintf("%s-%s-%s", obj.Namespace, obj.Name, obj.ResourceVersion)
+func (pkgw *packageWatcher) buildCacheKey(obj metav1.ObjectMeta) crd.CacheKeyUR {
+	return crd.CacheKeyURFromMeta(&obj)
 }

 func (pkgw *packageWatcher) buildWithCache(ctx context.Context, srcpkg *fv1.Package) {
@@ -89,33 +91,33 @@ func (pkgw *packageWatcher) buildWithCache(ctx context.Context, srcpkg *fv1.Pack
 // 6. Update package status to succeed state
 // *. Update package status to failed state,if any one of steps above failed/time out
 func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
+	key := pkgw.buildCacheKey(srcpkg.ObjectMeta)
+	logger := pkgw.logger.With(zap.String("package", srcpkg.Name), zap.String("namespace", srcpkg.Namespace), zap.String("resource_version", srcpkg.ResourceVersion), zap.String("key", key.String()))
+
 	defer func() {
-		key := pkgw.buildCacheKey(srcpkg.ObjectMeta)
 		err := pkgw.buildCache.Delete(key)
 		if err != nil {
-			pkgw.logger.Error("error deleting key from cache", zap.String("key", key), zap.Error(err))
+			logger.Error("error deleting key from cache", zap.Any("key", key), zap.Error(err))
 		}
 	}()

-	pkgw.logger.Info("starting build for package", zap.String("package_name", srcpkg.ObjectMeta.Name), zap.String("resource_version", srcpkg.ObjectMeta.ResourceVersion))
+	logger.Info("starting build for package")

-	pkg, err := updatePackage(ctx, pkgw.logger, pkgw.fissionClient, srcpkg, fv1.BuildStatusRunning, "", nil)
+	pkg, err := updatePackage(ctx, logger, pkgw.fissionClient, srcpkg, fv1.BuildStatusRunning, "", nil)
 	if err != nil {
-		pkgw.logger.Error("error setting package pending state", zap.Error(err))
+		logger.Error("error setting package pending state", zap.Error(err))
 		return
 	}

 	env, err := pkgw.fissionClient.CoreV1().Environments(pkg.Spec.Environment.Namespace).Get(ctx, pkg.Spec.Environment.Name, metav1.GetOptions{})
 	if k8serrors.IsNotFound(err) {
 		e := "environment does not exist"
-		pkgw.logger.Error(e, zap.String("environment", pkg.Spec.Environment.Name))
-		_, er := updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg,
+		logger.Error(e, zap.String("environment", pkg.Spec.Environment.Name))
+		_, er := updatePackage(ctx, logger, pkgw.fissionClient, pkg,
 			fv1.BuildStatusFailed, fmt.Sprintf("%s: %q", e, pkg.Spec.Environment.Name), nil)
 		if er != nil {
-			pkgw.logger.Error(
+			logger.Error(
 				"error updating package",
-				zap.String("package_name", pkg.ObjectMeta.Name),
-				zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
 				zap.Error(er),
 			)
 		}
@@ -126,7 +128,9 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 	healthCheckBackOff := utils.NewDefaultBackOff()
 	builderNs := pkgw.nsResolver.GetBuilderNS(env.ObjectMeta.Namespace)

-	//if err != nil {
+	logger = logger.With(zap.String("environment", env.Name), zap.String("builder_namespace", builderNs), zap.String("environment_namespace", env.Namespace))
+
+	// if err != nil {
 	//	pkgw.logger.Error("Unable to create BackOff for Health Check", zap.Error(err))
 	//}
 	// Do health check for environment builder pod
@@ -135,12 +139,12 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 		// iterate all available environment builders.
 		items := pkgw.podInformer[builderNs].GetStore().List()
 		if err != nil {
-			pkgw.logger.Error("error retrieving pod information for environment", zap.Error(err), zap.String("environment", env.ObjectMeta.Name))
+			logger.Error("error retrieving pod information for environment", zap.Error(err))
 			return
 		}

 		if len(items) == 0 {
-			pkgw.logger.Info("builder pod does not exist for environment, will retry again later", zap.String("environment", pkg.Spec.Environment.Name))
+			logger.Info("builder pod does not exist for environment, will retry again later")
 			time.Sleep(healthCheckBackOff.GetCurrentBackoffDuration())
 			continue
 		}
@@ -164,27 +168,22 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 			}

 			if !podIsReady {
-				pkgw.logger.Info("builder pod is not ready for environment, will retry again later", zap.String("environment", pkg.Spec.Environment.Name))
+				logger.Info("builder pod is not ready for environment, will retry again later")
 				time.Sleep(healthCheckBackOff.GetCurrentBackoffDuration())
 				break
 			}

 			uploadResp, buildLogs, err := buildPackage(ctx, pkgw.logger, pkgw.fissionClient, builderNs, pkgw.storageSvcUrl, pkg)
 			if err != nil {
-				pkgw.logger.Error("error building package", zap.Error(err), zap.String("package_name", pkg.ObjectMeta.Name))
-				_, er := updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
+				logger.Error("error building package", zap.Error(err))
+				_, er := updatePackage(ctx, logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
 				if er != nil {
-					pkgw.logger.Error(
-						"error updating package",
-						zap.String("package_name", pkg.ObjectMeta.Name),
-						zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
-						zap.Error(er),
-					)
+					logger.Error("error updating package", zap.Error(er))
 				}
 				return
 			}

-			pkgw.logger.Info("starting package info update", zap.String("package_name", pkg.ObjectMeta.Name))
+			logger.Info("starting package info update")

 			fnList, err := pkgw.fissionClient.CoreV1().
 				Functions(pkg.Namespace).List(ctx, metav1.ListOptions{})
@@ -196,8 +195,6 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 				if er != nil {
 					pkgw.logger.Error(
 						"error updating package",
-						zap.String("package_name", pkg.ObjectMeta.Name),
-						zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
 						zap.Error(er),
 					)
 				}
@@ -214,57 +211,41 @@ func (pkgw *packageWatcher) build(ctx context.Context, srcpkg *fv1.Package) {
 					_, err = pkgw.fissionClient.CoreV1().Functions(fn.ObjectMeta.Namespace).Update(ctx, &fn, metav1.UpdateOptions{})
 					if err != nil {
 						e := "error updating function package resource version"
-						pkgw.logger.Error(e, zap.Error(err))
+						logger.Error(e, zap.Error(err))
 						buildLogs += fmt.Sprintf("%s: %v\n", e, err)
-						_, er := updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
+						_, er := updatePackage(ctx, logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
 						if er != nil {
-							pkgw.logger.Error(
-								"error updating package",
-								zap.String("package_name", pkg.ObjectMeta.Name),
-								zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
-								zap.Error(er),
-							)
+							logger.Error("error updating package", zap.Error(er))
 						}
 						return
 					}
 				}
 			}

-			_, err = updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg,
+			_, err = updatePackage(ctx, logger, pkgw.fissionClient, pkg,
 				fv1.BuildStatusSucceeded, buildLogs, uploadResp)
 			if err != nil {
-				pkgw.logger.Error("error updating package info", zap.Error(err), zap.String("package_name", pkg.ObjectMeta.Name))
-				_, er := updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
+				logger.Error("error updating package info", zap.Error(err))
+				_, er := updatePackage(ctx, logger, pkgw.fissionClient, pkg, fv1.BuildStatusFailed, buildLogs, nil)
 				if er != nil {
-					pkgw.logger.Error(
-						"error updating package",
-						zap.String("package_name", pkg.ObjectMeta.Name),
-						zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
-						zap.Error(er),
-					)
+					logger.Error("error updating package", zap.Error(er))
 				}
 				return
 			}

-			pkgw.logger.Info("completed package build request", zap.String("package_name", pkg.ObjectMeta.Name))
+			logger.Info("completed package build request")
 			return
 		}
 		time.Sleep(healthCheckBackOff.GetNext())
 	}
 	// build timeout
-	_, err = updatePackage(ctx, pkgw.logger, pkgw.fissionClient, pkg,
+	_, err = updatePackage(ctx, logger, pkgw.fissionClient, pkg,
 		fv1.BuildStatusFailed, "Build timeout due to environment builder not ready", nil)
 	if err != nil {
-		pkgw.logger.Error(
-			"error updating package",
-			zap.String("package_name", pkg.ObjectMeta.Name),
-			zap.String("resource_version", pkg.ObjectMeta.ResourceVersion),
-			zap.Error(err),
-		)
+		logger.Error("error updating package", zap.Error(err))
 	}

-	pkgw.logger.Error("max retries exceeded in building source package, timeout due to environment builder not ready",
-		zap.String("package", fmt.Sprintf("%s.%s", pkg.ObjectMeta.Name, pkg.ObjectMeta.Namespace)))
+	logger.Error("max retries exceeded in building source package, timeout due to environment builder not ready")
 }

 func (pkgw *packageWatcher) packageInformerHandler(ctx context.Context) k8sCache.ResourceEventHandlerFuncs {
@@ -308,19 +289,20 @@ func (pkgw *packageWatcher) packageInformerHandler(ctx context.Context) k8sCache
 	}
 }

-func (pkgw *packageWatcher) Run(ctx context.Context) error {
-	go metrics.ServeMetrics(ctx, "buildermgr", pkgw.logger)
-	for _, podInformer := range pkgw.podInformer {
-		go podInformer.Run(ctx.Done())
-	}
+func (pkgw *packageWatcher) Run(ctx context.Context, mgr manager.Interface) error {
+
+	mgr.Add(ctx, func(ctx context.Context) {
+		metrics.ServeMetrics(ctx, "buildermgr", pkgw.logger, mgr)
+	})
+	mgr.AddInformers(ctx, pkgw.podInformer)
 	for _, pkgInformer := range pkgw.pkgInformer {
 		_, err := pkgInformer.AddEventHandler(pkgw.packageInformerHandler(ctx))
 		if err != nil {
 			pkgw.logger.Fatal("error adding package informer handler", zap.Error(err))
 			return err
 		}
-		go pkgInformer.Run(ctx.Done())
 	}
+	mgr.AddInformers(ctx, pkgw.pkgInformer)
 	return nil
 }

@@ -34,33 +34,33 @@ const (
 )

 type (
-	Value struct {
+	Value[V any] struct {
 		ctime time.Time
 		atime time.Time
-		value interface{}
+		value V
 	}
-	Cache struct {
-		cache          map[interface{}]*Value
+	Cache[K comparable, V any] struct {
+		cache          map[K]*Value[V]
 		ctimeExpiry    time.Duration
 		atimeExpiry    time.Duration
-		requestChannel chan *request
+		requestChannel chan *request[K, V]
 	}

-	request struct {
+	request[K comparable, V any] struct {
 		requestType
-		key             interface{}
-		value           interface{}
-		responseChannel chan *response
+		key             K
+		value           V
+		responseChannel chan *response[K, V]
 	}
-	response struct {
+	response[K comparable, V any] struct {
 		error
-		existingValue interface{}
-		mapCopy       map[interface{}]interface{}
-		value         interface{}
+		existingValue V
+		mapCopy       map[K]V
+		value         V
 	}
 )

-func (c *Cache) IsOld(v *Value) bool {
+func (c *Cache[K, V]) IsOld(v *Value[V]) bool {
 	if (c.ctimeExpiry != time.Duration(0)) && (time.Since(v.ctime) > c.ctimeExpiry) {
 		return true
 	}
@@ -72,12 +72,12 @@ func (c *Cache) IsOld(v *Value) bool {
 	return false
 }

-func MakeCache(ctimeExpiry, atimeExpiry time.Duration) *Cache {
-	c := &Cache{
-		cache:          make(map[interface{}]*Value),
+func MakeCache[K comparable, V any](ctimeExpiry, atimeExpiry time.Duration) *Cache[K, V] {
+	c := &Cache[K, V]{
+		cache:          make(map[K]*Value[V]),
 		ctimeExpiry:    ctimeExpiry,
 		atimeExpiry:    atimeExpiry,
-		requestChannel: make(chan *request),
+		requestChannel: make(chan *request[K, V]),
 	}
 	go c.service()
 	if ctimeExpiry != time.Duration(0) || atimeExpiry != time.Duration(0) {
@@ -86,10 +86,10 @@ func MakeCache(ctimeExpiry, atimeExpiry time.Duration) *Cache {
 	return c
 }

-func (c *Cache) service() {
+func (c *Cache[K, V]) service() {
 	for {
 		req := <-c.requestChannel
-		resp := &response{}
+		resp := &response[K, V]{}
 		switch req.requestType {
 		case GET:
 			val, ok := c.cache[req.key]
@@ -115,7 +115,7 @@ func (c *Cache) service() {
 				resp.existingValue = val.value
 				resp.error = ferror.MakeError(ferror.ErrorNameExists, "key already exists")
 			} else {
-				c.cache[req.key] = &Value{
+				c.cache[req.key] = &Value[V]{
 					value: req.value,
 					ctime: now,
 					atime: now,
@@ -133,7 +133,7 @@ func (c *Cache) service() {
 			}
 			// no response
 		case COPY:
-			resp.mapCopy = make(map[interface{}]interface{})
+			resp.mapCopy = make(map[K]V)
 			for k, v := range c.cache {
 				resp.mapCopy[k] = v.value
 			}
@@ -146,9 +146,9 @@ func (c *Cache) service() {
 	}
 }

-func (c *Cache) Get(key interface{}) (interface{}, error) {
-	respChannel := make(chan *response)
-	c.requestChannel <- &request{
+func (c *Cache[K, V]) Get(key K) (V, error) {
+	respChannel := make(chan *response[K, V])
+	c.requestChannel <- &request[K, V]{
 		requestType:     GET,
 		key:             key,
 		responseChannel: respChannel,
@@ -159,9 +159,9 @@ func (c *Cache) Get(key interface{}) (interface{}, error) {

 // if key exists in the cache, the new value is NOT set; instead an
 // error and the old value are returned
-func (c *Cache) Set(key interface{}, value interface{}) (interface{}, error) {
-	respChannel := make(chan *response)
-	c.requestChannel <- &request{
+func (c *Cache[K, V]) Set(key K, value V) (V, error) {
+	respChannel := make(chan *response[K, V])
+	c.requestChannel <- &request[K, V]{
 		requestType:     SET,
 		key:             key,
 		value:           value,
@@ -171,9 +171,9 @@ func (c *Cache) Set(key interface{}, value interface{}) (interface{}, error) {
 	return resp.existingValue, resp.error
 }

-func (c *Cache) Delete(key interface{}) error {
-	respChannel := make(chan *response)
-	c.requestChannel <- &request{
+func (c *Cache[K, V]) Delete(key K) error {
+	respChannel := make(chan *response[K, V])
+	c.requestChannel <- &request[K, V]{
 		requestType:     DELETE,
 		key:             key,
 		responseChannel: respChannel,
@@ -182,9 +182,9 @@ func (c *Cache) Delete(key interface{}) error {
 	return resp.error
 }

-func (c *Cache) Copy() map[interface{}]interface{} {
-	respChannel := make(chan *response)
-	c.requestChannel <- &request{
+func (c *Cache[K, V]) Copy() map[K]V {
+	respChannel := make(chan *response[K, V])
+	c.requestChannel <- &request[K, V]{
 		requestType:     COPY,
 		responseChannel: respChannel,
 	}
@@ -192,10 +192,10 @@ func (c *Cache) Copy() map[interface{}]interface{} {
 	return resp.mapCopy
 }

-func (c *Cache) expiryService() {
+func (c *Cache[K, V]) expiryService() {
 	for {
 		time.Sleep(time.Minute)
-		c.requestChannel <- &request{
+		c.requestChannel <- &request[K, V]{
 			requestType: EXPIRE,
 		}
 	}
@@ -29,7 +29,7 @@ func checkErr(err error) {
 }

 func TestCache(t *testing.T) {
-	c := MakeCache(100*time.Millisecond, 100*time.Millisecond)
+	c := MakeCache[string, string](100*time.Millisecond, 100*time.Millisecond)

 	_, err := c.Set("a", "b")
 	checkErr(err)
@@ -27,7 +27,7 @@ import (

 type (
 	canaryConfigCancelFuncMap struct {
-		cache *cache.Cache // map[metadataKey]*context.Context
+		cache *cache.Cache[metadataKey, *CanaryProcessingInfo]
 	}

 	// metav1.ObjectMeta is not hashable, so we make a hashable copy
@@ -45,7 +45,7 @@ type (

 func makecanaryConfigCancelFuncMap() *canaryConfigCancelFuncMap {
 	return &canaryConfigCancelFuncMap{
-		cache: cache.MakeCache(0, 0),
+		cache: cache.MakeCache[metadataKey, *CanaryProcessingInfo](0, 0),
 	}
 }

@@ -62,8 +62,7 @@ func (cancelFuncMap *canaryConfigCancelFuncMap) lookup(f *metav1.ObjectMeta) (*C
 	if err != nil {
 		return nil, err
 	}
-	value := item.(*CanaryProcessingInfo)
-	return value, nil
+	return item, nil
 }

 func (cancelFuncMap *canaryConfigCancelFuncMap) assign(f *metav1.ObjectMeta, value *CanaryProcessingInfo) error {
@@ -35,6 +35,7 @@ import (
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 const (
@@ -136,10 +137,8 @@ func (canaryCfgMgr *canaryConfigMgr) CanaryConfigEventHandlers(ctx context.Conte
 	return nil
 }

-func (canaryCfgMgr *canaryConfigMgr) Run(ctx context.Context) {
-	for _, informer := range canaryCfgMgr.canaryConfigInformer {
-		go informer.Run(ctx.Done())
-	}
+func (canaryCfgMgr *canaryConfigMgr) Run(ctx context.Context, mgr manager.Interface) {
+	mgr.AddInformers(ctx, canaryCfgMgr.canaryConfigInformer)
 	canaryCfgMgr.logger.Info("started canary configmgr controller")
 }

@@ -558,7 +557,7 @@ func getEnvValue(envVar string) string {
 	return envVarSplit[1]
 }

-func StartCanaryServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, unitTestFlag bool) error {
+func StartCanaryServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, unitTestFlag bool) error {
 	cLogger := logger.Named("CanaryServer")

 	fissionClient, err := clientGen.GetFissionClient()
@@ -570,7 +569,7 @@ func StartCanaryServer(ctx context.Context, clientGen crd.ClientGeneratorInterfa
 		return fmt.Errorf("failed to get kubernetes client: %w", err)
 	}

-	err = ConfigureFeatures(ctx, cLogger, unitTestFlag, fissionClient, kubernetesClient)
+	err = ConfigureFeatures(ctx, cLogger, unitTestFlag, fissionClient, kubernetesClient, mgr)
 	if err != nil {
 		cLogger.Error("error configuring features - proceeding without optional features", zap.Error(err))
 	}
@@ -25,10 +25,12 @@ import (

 	config "github.com/fission/fission/pkg/featureconfig"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 // ConfigureFeatures gets the feature config and configures the features that are enabled
-func ConfigureFeatures(ctx context.Context, logger *zap.Logger, unitTestMode bool, fissionClient versioned.Interface, kubeClient kubernetes.Interface) error {
+func ConfigureFeatures(ctx context.Context, logger *zap.Logger, unitTestMode bool, fissionClient versioned.Interface,
+	kubeClient kubernetes.Interface, mgr manager.Interface) error {
 	// set feature enabled to false if unitTestMode
 	if unitTestMode {
 		return nil
@@ -47,7 +49,7 @@ func ConfigureFeatures(ctx context.Context, logger *zap.Logger, unitTestMode boo
 	if err != nil {
 		return errors.Wrap(err, "failed to start canary config manager")
 	}
-	canaryCfgMgr.Run(ctx)
+	canaryCfgMgr.Run(ctx, mgr)

 	return err
 }
@@ -63,7 +63,7 @@ func (promApiClient *PrometheusApiClient) GetFunctionFailurePercentage(ctx conte
 	}

 	if reqs <= 0 {
-		return -1, fmt.Errorf("no requests to this url %v and method %v in the window: %v", path, methods, window)
+		return -1, fmt.Errorf("no requests to this url %s and method %v in the window: %s", path, methods, window)
 	}

 	// next, get a total count of errored out requests to this function in the same window
@@ -18,13 +18,12 @@ package crd

 import (
 	"context"
-	"errors"
+	"fmt"
 	"time"

 	"go.uber.org/zap"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/client-go/rest"
@@ -33,15 +32,22 @@ import (

 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
+	kedaClient "github.com/kedacore/keda/v2/pkg/generated/clientset/versioned"
+)
+
+const (
+	EnvKubeClientQps   = "KUBE_CLIENT_QPS"
+	EnvKubeClientBurst = "KUBE_CLIENT_BURST"
 )

 type (
 	ClientGeneratorInterface interface {
+		GetRestConfig() (*rest.Config, error)
 		GetFissionClient() (versioned.Interface, error)
 		GetKubernetesClient() (kubernetes.Interface, error)
 		GetApiExtensionsClient() (apiextensionsclient.Interface, error)
 		GetMetricsClient() (metricsclient.Interface, error)
-		GetDynamicClient() (dynamic.Interface, error)
+		GetKedaClient() (kedaClient.Interface, error)
 	}

 	ClientGenerator struct {
@@ -59,9 +65,27 @@ func (cg *ClientGenerator) getRestConfig() (*rest.Config, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	qps, _ := utils.GetUIntValueFromEnv(EnvKubeClientQps)
+	burst, _ := utils.GetIntValueFromEnv(EnvKubeClientBurst)
+
+	// Set QPS and Burst to higher values to avoid throttling
+	if qps == 0 {
+		qps = 200
+	}
+	if burst == 0 {
+		burst = 500
+	}
+	cg.restConfig.QPS = float32(qps)
+	cg.restConfig.Burst = burst
+
 	return cg.restConfig, nil
 }

+func (cg *ClientGenerator) GetRestConfig() (*rest.Config, error) {
+	return cg.getRestConfig()
+}
+
 func (cg *ClientGenerator) GetFissionClient() (versioned.Interface, error) {
 	config, err := cg.getRestConfig()
 	if err != nil {
@@ -94,12 +118,12 @@ func (cg *ClientGenerator) GetMetricsClient() (metricsclient.Interface, error) {
 	return metricsclient.NewForConfig(config)
 }

-func (cg *ClientGenerator) GetDynamicClient() (dynamic.Interface, error) {
+func (cg *ClientGenerator) GetKedaClient() (kedaClient.Interface, error) {
 	config, err := cg.getRestConfig()
 	if err != nil {
 		return nil, err
 	}
-	return dynamic.NewForConfig(config)
+	return kedaClient.NewForConfig(config)
 }

 func NewClientGenerator() *ClientGenerator {
@@ -110,25 +134,24 @@ func NewClientGeneratorWithRestConfig(restConfig *rest.Config) *ClientGenerator
 	return &ClientGenerator{restConfig: restConfig}
 }

-// WaitForCRDs does a timeout to check if CRDs have been installed
-func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error {
-	logger.Info("Waiting for CRDs to be installed")
+// WaitForFunctionCRDs does a timeout to check if CRDs have been installed
+func WaitForFunctionCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error {
 	defaultNs := utils.DefaultNSResolver().DefaultNamespace
 	if defaultNs == "" {
 		defaultNs = metav1.NamespaceDefault
 	}
+	logger.Info("Checking function CRD access", zap.String("namespace", defaultNs), zap.String("timeout", "30s"))
 	start := time.Now()
 	for {
 		fi := fissionClient.CoreV1().Functions(defaultNs)
 		_, err := fi.List(ctx, metav1.ListOptions{})
-		if err != nil {
-			time.Sleep(100 * time.Millisecond)
-		} else {
+		if err == nil {
 			return nil
 		}
+		time.Sleep(100 * time.Millisecond)

 		if time.Since(start) > 30*time.Second {
-			return errors.New("timeout waiting for CRDs")
+			return fmt.Errorf("timeout waiting for function CRD access")
 		}
 	}
 }
@@ -42,7 +42,7 @@ func (ck CacheKeyURG) String() string {
 	return fmt.Sprintf("%v_%v_%v", ck.UID, ck.ResourceVersion, ck.Generation)
 }

-// CacheKeyForUID create a key that uniquely identifies the
+// CacheKeyUIDFromMeta create a key that uniquely identifies the
 // of the object. Since resourceVersion changes on every update and
 // UIDs are unique, we don't use resource version here
 func CacheKeyUIDFromMeta(metadata *metav1.ObjectMeta) types.UID {
@@ -34,6 +34,7 @@ import (
 	"github.com/fission/fission/pkg/executor/client"
 	"github.com/fission/fission/pkg/executor/fscache"
 	"github.com/fission/fission/pkg/utils/httpserver"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/metrics"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
@@ -286,8 +287,7 @@ func (executor *Executor) GetHandler() http.Handler {
 }

 // Serve starts an HTTP server.
-func (executor *Executor) Serve(ctx context.Context, port int) {
+func (executor *Executor) Serve(ctx context.Context, mgr manager.Interface, port int) {
 	handler := otelUtils.GetHandlerWithOTEL(executor.GetHandler(), "fission-executor", otelUtils.UrlsToIgnore("/healthz"))
-	httpserver.StartServer(ctx, executor.logger, "executor", fmt.Sprintf("%d", port), handler)
-
+	httpserver.StartServer(ctx, executor.logger, mgr, "executor", fmt.Sprintf("%d", port), handler)
 }
@@ -36,8 +36,14 @@ import (
 )

 type (
-	// Client is wrapper on a HTTP client.
-	Client struct {
+	// ClientInterface is the interface for executor client.
+	ClientInterface interface {
+		GetServiceForFunction(ctx context.Context, fn *fv1.Function) (string, error)
+		TapService(fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL url.URL)
+		UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL *url.URL) error
+	}
+	// client is wrapper on a HTTP client.
+	client struct {
 		logger      *zap.Logger
 		executorURL string
 		tappedByURL map[string]TapServiceRequest
@@ -54,10 +60,10 @@ type (
 )

 // MakeClient initializes and returns a Client instance.
-func MakeClient(logger *zap.Logger, executorURL string) *Client {
+func MakeClient(logger *zap.Logger, executorURL string) ClientInterface {
 	hc := retryablehttp.NewClient()
 	hc.HTTPClient.Transport = otelhttp.NewTransport(hc.HTTPClient.Transport)
-	c := &Client{
+	c := &client{
 		logger:      logger.Named("executor_client"),
 		executorURL: strings.TrimSuffix(executorURL, "/"),
 		tappedByURL: make(map[string]TapServiceRequest),
@@ -69,7 +75,7 @@ func MakeClient(logger *zap.Logger, executorURL string) *Client {
 }

 // GetServiceForFunction returns the service name for a given function.
-func (c *Client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (string, error) {
+func (c *client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (string, error) {
 	executorURL := c.executorURL + "/v2/getServiceForFunction"

 	body, err := json.Marshal(fn)
@@ -102,7 +108,7 @@ func (c *Client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (s
 }

 // UnTapService sends a request to /v2/unTapService.
-func (c *Client) UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL *url.URL) error {
+func (c *client) UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL *url.URL) error {
 	url := c.executorURL + "/v2/unTapService"
 	tapSvc := TapServiceRequest{
 		FnMetadata:     fnMeta,
@@ -133,7 +139,7 @@ func (c *Client) UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, exe
 	return nil
 }

-func (c *Client) service() {
+func (c *client) service() {
 	ticker := time.NewTicker(time.Second * 5)
 	for {
 		select {
@@ -163,7 +169,7 @@ func (c *Client) service() {
 }

 // TapService sends a TapServiceRequest over the request channel.
-func (c *Client) TapService(fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL url.URL) {
+func (c *client) TapService(fnMeta metav1.ObjectMeta, executorType fv1.ExecutorType, serviceURL url.URL) {
 	c.requestChan <- TapServiceRequest{
 		FnMetadata: metav1.ObjectMeta{
 			Name:            fnMeta.Name,
@@ -178,7 +184,7 @@ func (c *Client) TapService(fnMeta metav1.ObjectMeta, executorType fv1.ExecutorT
 	}
 }

-func (c *Client) _tapService(ctx context.Context, tapSvcReqs []TapServiceRequest) error {
+func (c *client) _tapService(ctx context.Context, tapSvcReqs []TapServiceRequest) error {
 	executorURL := c.executorURL + "/v2/tapServices"

 	body, err := json.Marshal(tapSvcReqs)
@@ -58,13 +58,18 @@ func ConfigMapEventHandlers(ctx context.Context, logger *zap.Logger, fissionClie
 			oldCm := oldObj.(*apiv1.ConfigMap)
 			newCm := newObj.(*apiv1.ConfigMap)
 			if oldCm.ObjectMeta.ResourceVersion != newCm.ObjectMeta.ResourceVersion {
-				logger.Debug("Configmap changed",
-					zap.String("configmap_name", newCm.ObjectMeta.Name),
-					zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				funcs, err := getConfigmapRelatedFuncs(ctx, logger, &newCm.ObjectMeta, fissionClient)
 				if err != nil {
 					logger.Error("Failed to get functions related to configmap", zap.String("configmap_name", newCm.ObjectMeta.Name), zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				}
+
+				if len(funcs) == 0 {
+					return
+				}
+
+				logger.Debug("Configmap changed",
+					zap.String("configmap_name", newCm.ObjectMeta.Name),
+					zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				refreshPods(ctx, logger, funcs, types)
 			}
 		},
@@ -57,13 +57,18 @@ func SecretEventHandlers(ctx context.Context, logger *zap.Logger, fissionClient
 			oldS := oldObj.(*apiv1.Secret)
 			newS := newObj.(*apiv1.Secret)
 			if oldS.ObjectMeta.ResourceVersion != newS.ObjectMeta.ResourceVersion {
-				logger.Debug("Secret changed",
-					zap.String("configmap_name", newS.ObjectMeta.Name),
-					zap.String("configmap_namespace", newS.ObjectMeta.Namespace))
 				funcs, err := getSecretRelatedFuncs(ctx, logger, &newS.ObjectMeta, fissionClient)
 				if err != nil {
 					logger.Error("Failed to get functions related to secret", zap.String("secret_name", newS.ObjectMeta.Name), zap.String("secret_namespace", newS.ObjectMeta.Namespace))
 				}
+
+				if len(funcs) == 0 {
+					return
+				}
+
+				logger.Debug("Secret changed",
+					zap.String("secret_name", newS.ObjectMeta.Name),
+					zap.String("secret_namespace", newS.ObjectMeta.Namespace))
 				refreshPods(ctx, logger, funcs, types)
 			}
 		},
@@ -43,6 +43,7 @@ import (
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/metrics"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
@@ -73,7 +74,7 @@ type (
 )

 // MakeExecutor returns an Executor for given ExecutorType(s).
-func MakeExecutor(ctx context.Context, logger *zap.Logger, cms *cms.ConfigSecretController,
+func MakeExecutor(ctx context.Context, logger *zap.Logger, mgr manager.Interface, cms *cms.ConfigSecretController,
 	fissionClient versioned.Interface, types map[fv1.ExecutorType]executortype.ExecutorType,
 	informers ...k8sCache.SharedIndexInformer) (*Executor, error) {
 	executor := &Executor{
@@ -87,17 +88,21 @@ func MakeExecutor(ctx context.Context, logger *zap.Logger, cms *cms.ConfigSecret

 	// Run all informers
 	for _, informer := range informers {
-		go informer.Run(ctx.Done())
+		informer := informer
+		mgr.Add(ctx, func(ctx context.Context) {
+			informer.Run(ctx.Done())
+		})
 	}

 	for _, et := range types {
-		go func(et executortype.ExecutorType) {
-			et.Run(ctx)
-		}(et)
+		et := et
+		mgr.Add(ctx, func(ctx context.Context) {
+			et.Run(ctx, mgr)
+		})
 	}
-
-	go executor.serveCreateFuncServices()
-
+	mgr.Add(ctx, func(ctx context.Context) {
+		executor.serveCreateFuncServices(ctx)
+	})
 	return executor, nil
 }

@@ -107,9 +112,14 @@ func MakeExecutor(ctx context.Context, logger *zap.Logger, cms *cms.ConfigSecret
 // get specialized. In other words, it ensures that when there's an
 // ongoing request for a certain function, all other requests wait for
 // that request to complete.
-func (executor *Executor) serveCreateFuncServices() {
+func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 	for {
-		req := <-executor.requestChan
+		var req *createFuncServiceRequest
+		select {
+		case <-ctx.Done():
+			return
+		case req = <-executor.requestChan:
+		}
 		function := req.function
 		fnName := k8sCache.MetaObjectToName(function)
 		fnkeyUR := crd.CacheKeyURFromObject(function)
@@ -251,7 +261,7 @@ func (executor *Executor) getFunctionServiceFromCache(ctx context.Context, fn *f

 // StartExecutor Starts executor and the executor components such as Poolmgr,
 // deploymgr and potential future executor types
-func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
+func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int) error {

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
@@ -266,7 +276,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		logger.Error("error making the metrics client", zap.Error(err))
 	}

-	err = crd.WaitForCRDs(ctx, logger, fissionClient)
+	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
@@ -383,7 +393,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		informerFactory.Start(ctx.Done())
 	}

-	api, err := MakeExecutor(ctx, logger, cms, fissionClient, executorTypes,
+	api, err := MakeExecutor(ctx, logger, mgr, cms, fissionClient, executorTypes,
 		fissionInformers...,
 	)
 	if err != nil {
@@ -392,8 +402,13 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	utils.CreateMissingPermissionForSA(ctx, kubernetesClient, logger)

-	go metrics.ServeMetrics(ctx, "executor", logger)
-	go api.Serve(ctx, port)
+	mgr.Add(ctx, func(ctx context.Context) {
+		metrics.ServeMetrics(ctx, "executor", logger, mgr)
+	})
+
+	mgr.Add(ctx, func(ctx context.Context) {
+		api.Serve(ctx, mgr, port)
+	})

 	return nil
 }
@@ -51,6 +51,7 @@ import (
 	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/throttler"
 	"github.com/fission/fission/pkg/utils"
+	"github.com/fission/fission/pkg/utils/manager"
 	"github.com/fission/fission/pkg/utils/maps"
 	otelUtils "github.com/fission/fission/pkg/utils/otel"
 )
@@ -87,6 +88,8 @@ type (

 		hpaops                     *hpautils.HpaOperations
 		objectReaperIntervalSecond time.Duration
+
+		enableOwnerReferences bool
 	}
 )

@@ -130,6 +133,8 @@ func MakeContainer(
 		deplListerSynced:           make(map[string]k8sCache.InformerSynced),
 		svcLister:                  make(map[string]corelisters.ServiceLister),
 		svcListerSynced:            make(map[string]k8sCache.InformerSynced),
+
+		enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
 	}

 	for ns, informerFactory := range cnmInformerFactory {
@@ -148,7 +153,7 @@ func MakeContainer(
 }

 // Run start the function along with an object reaper.
-func (caaf *Container) Run(ctx context.Context) {
+func (caaf *Container) Run(ctx context.Context, mgr manager.Interface) {
 	waitSynced := make([]k8sCache.InformerSynced, 0)
 	for _, deplListerSynced := range caaf.deplListerSynced {
 		waitSynced = append(waitSynced, deplListerSynced)
@@ -160,7 +165,9 @@ func (caaf *Container) Run(ctx context.Context) {
 	if ok := k8sCache.WaitForCacheSync(ctx.Done(), waitSynced...); !ok {
 		caaf.logger.Fatal("failed to wait for caches to sync")
 	}
-	go caaf.idleObjectReaper(ctx)
+	mgr.Add(ctx, func(ctx context.Context) {
+		caaf.idleObjectReaper(ctx)
+	})
 }

 // GetTypeName returns the executor type name.
@@ -418,7 +425,7 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache
 		return nil, fmt.Errorf("error creating deployment %s: %w", objName, err)
 	}

-	hpa, err := caaf.hpaops.CreateOrGetHpa(ctx, objName, &fn.Spec.InvokeStrategy.ExecutionStrategy, depl, deployLabels, deployAnnotations)
+	hpa, err := caaf.hpaops.CreateOrGetHpa(ctx, fn, objName, &fn.Spec.InvokeStrategy.ExecutionStrategy, depl, deployLabels, deployAnnotations)
 	if err != nil {
 		caaf.logger.Error("error creating HPA", zap.Error(err), zap.String("hpa", objName))
 		go cleanupFunc(ns, objName)
@@ -427,7 +434,7 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache

 	kubeObjRefs := []apiv1.ObjectReference{
 		{
-			//obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
+			// obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
 			Kind:            "deployment",
 			Name:            depl.ObjectMeta.Name,
 			APIVersion:      depl.TypeMeta.APIVersion,
@@ -27,6 +27,7 @@ import (
 	apiv1 "k8s.io/api/core/v1"
 	k8s_err "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/intstr"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -86,6 +87,7 @@ func (cn *Container) createOrGetDeployment(ctx context.Context, fn *fv1.Function
 	if existingDepl.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL] != cn.instanceID {
 		existingDepl.Annotations = deployment.Annotations
 		existingDepl.Labels = deployment.Labels
+		existingDepl.OwnerReferences = deployment.OwnerReferences
 		existingDepl.Spec.Template.Spec.Containers = deployment.Spec.Template.Spec.Containers
 		existingDepl.Spec.Template.Spec.ServiceAccountName = deployment.Spec.Template.Spec.ServiceAccountName
 		existingDepl.Spec.Template.Spec.TerminationGracePeriodSeconds = deployment.Spec.Template.Spec.TerminationGracePeriodSeconds
@@ -263,11 +265,22 @@ func (cn *Container) getDeploymentSpec(ctx context.Context, fn *fv1.Function, ta

 	pod.Spec = *(util.ApplyImagePullSecret("", pod.Spec))

+	var ownerReferences []metav1.OwnerReference
+	if cn.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        deployName,
-			Labels:      deployLabels,
-			Annotations: deployAnnotations,
+			Name:            deployName,
+			Labels:          deployLabels,
+			Annotations:     deployAnnotations,
+			OwnerReferences: ownerReferences,
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: &replicas,
@@ -24,6 +24,7 @@ import (
 	apiv1 "k8s.io/api/core/v1"
 	k8s_err "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/intstr"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -49,11 +50,23 @@ func (cn *Container) createOrGetSvc(ctx context.Context, fn *fv1.Function, deplo
 		return nil, err
 	}
 	logger := otelUtils.LoggerWithTraceID(ctx, cn.logger)
+	var ownerReferences []metav1.OwnerReference
+	if cn.enableOwnerReferences {
+		ownerReferences = []metav1.OwnerReference{
+			*metav1.NewControllerRef(fn, schema.GroupVersionKind{
+				Group:   "fission.io",
+				Version: "v1",
+				Kind:    "Function",
+			}),
+		}
+	}
+
 	service := &apiv1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:        svcName,
-			Labels:      deployLabels,
-			Annotations: deployAnnotations,
+			Name:            svcName,
+			Labels:          deployLabels,
+			Annotations:     deployAnnotations,
+			OwnerReferences: ownerReferences,
 		},
 		Spec: apiv1.ServiceSpec{
 			Ports: []apiv1.ServicePort{
@@ -74,6 +87,7 @@ func (cn *Container) createOrGetSvc(ctx context.Context, fn *fv1.Function, deplo
 		if existingSvc.Annotations[fv1.EXECUTOR_INSTANCEID_LABEL] != cn.instanceID {
 			existingSvc.Annotations = service.Annotations
 			existingSvc.Labels = service.Labels
+			existingSvc.OwnerReferences = service.OwnerReferences
 			existingSvc.Spec.Ports = service.Spec.Ports
 			existingSvc.Spec.Selector = service.Spec.Selector
 			existingSvc.Spec.Type = service.Spec.Type
@@ -25,11 +25,12 @@ import (

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/executor/fscache"
+	"github.com/fission/fission/pkg/utils/manager"
 )

 type ExecutorType interface {
 	// Run runs background job.
-	Run(context.Context)
+	Run(context.Context, manager.Interface)

 	// GetTypeName returns the name of executor type
 	GetTypeName(context.Context) fv1.ExecutorType
--- a/Show More
+++ b/Show More