Files
fission-src/charts/fission-core/templates/deployment.yaml
T
Soam VasaniandGitHub 00c2883235 Helm chart updates (#273)
Remove hardcoded "fission" namespace in various places.

Remove etcd deployment and service, since we use K8s APIs now.

Add ClusterRoleBinding for the fission service account, to allow fission components to access TPRs. We currently make the service account a cluster admin. This is more permissive than it should be; we should define a specific role for just fission resources.
2017-08-09 23:52:13 -07:00

257 lines
4.8 KiB
YAML

{{ if .Values.openshift }}
# For openshift
---
apiVersion: v1
kind: ProjectRequest
metadata:
name: fission
labels:
name: fission
---
apiVersion: v1
kind: ProjectRequest
metadata:
name: {{ .Values.functionNamespace }}
labels:
name: fission-function
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-admin
namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: ClusterRole
metadata:
name: fission:fission-admin
rules:
- apiGroups:
- extensions
attributeRestrictions: null
resources:
- deployments
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- ""
attributeRestrictions: null
resources:
- pods
verbs:
- get
- list
- update
---
apiVersion: v1
groupNames: null
kind: RoleBinding
metadata:
name: fission:fission-admin
namespace: {{ .Values.functionNamespace }}
roleRef:
name: fission:fission-admin
subjects:
- kind: ServiceAccount
name: fission-admin
namespace: {{ .Release.Namespace }}
userNames:
- system:serviceaccount:fission:fission-admin
{{ else }}
# For all environments except openshift
---
apiVersion: v1
kind: Namespace
metadata:
name: {{ .Values.functionNamespace }}
labels:
name: fission-function
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: fission-svc
namespace: {{ .Release.Namespace }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: fission-admin
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: fission-svc
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: admin
apiGroup: rbac.authorization.k8s.io
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: fission-function-admin
namespace: {{ .Values.functionNamespace }}
subjects:
- kind: ServiceAccount
name: fission-svc
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: admin
apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: fission-tpr
subjects:
- kind: ServiceAccount
name: fission-svc
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
{{ end }}
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: controller
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
replicas: 1
template:
metadata:
labels:
svc: controller
spec:
containers:
- name: controller
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
command: ["/fission-bundle"]
args: ["--controllerPort", "8888"]
serviceAccount: fission-svc
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: router
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
replicas: 1
template:
metadata:
labels:
svc: router
spec:
containers:
- name: router
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
command: ["/fission-bundle"]
args: ["--routerPort", "8888"]
serviceAccount: fission-svc
---
apiVersion: v1
kind: Service
metadata:
name: poolmgr
labels:
svc: poolmgr
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
type: ClusterIP
ports:
- port: 80
targetPort: 8888
selector:
svc: poolmgr
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: poolmgr
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
replicas: 1
template:
metadata:
labels:
svc: poolmgr
spec:
containers:
- name: poolmgr
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
command: ["/fission-bundle"]
args: ["--poolmgrPort", "8888", "--namespace", "{{ .Values.functionNamespace }}", "--fission-namespace", "{{ .Release.Namespace }}"]
serviceAccount: fission-svc
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: kubewatcher
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
replicas: 1
template:
metadata:
labels:
svc: kubewatcher
spec:
containers:
- name: kubewatcher
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
command: ["/fission-bundle"]
args: ["--kubewatcher"]
serviceAccount: fission-svc
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: timer
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
spec:
replicas: 1
template:
metadata:
labels:
svc: timer
spec:
containers:
- name: timer
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
command: ["/fission-bundle"]
args: ["--timer"]
serviceAccount: fission-svc