Repository: fission/fission (language: go)

Issue:
Router cannot create resource Ingresses
<!-- Please answer these questions before submitting your issue. Thanks! -->

<!-- Documentation URL: https://fission.io/docs -->
<!-- Troubleshooting guide: https://fission.io/docs/trouble-shooting/ -->

**Fission/Kubernetes version**

<!-- If you tested with other services, for example Istio, please also provide the version of service as well. -->

<pre>
$ fission version
client:
  fission/core:
    BuildDate: "2024-01-14T15:43:35Z"
    GitCommit: 7e8d5dd7
    Version: v1.20.1
server:
  fission/core:
    BuildDate: "2024-01-14T15:43:35Z"
    GitCommit: 7e8d5dd7
    Version: v1.20.1

$ kubectl version
Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.1+k3s2
</pre>

**Kubernetes platform (e.g. Google Kubernetes Engine)**
- Self-hosted k3s

**Describe the bug**
<!--A clear and concise description of what the bug is.-->
```json
{
  "level":"error",
  "ts":"2024-02-17T19:03:27.056Z",
  "logger":"triggerset.http_trigger_set",
  "caller":"router/ingress.go:48",
  "msg":"failed to create ingress",
  "error":"ingresses.networking.k8s.io is forbidden: User \"system:serviceaccount:fission:fission-router\" cannot create resource \"ingresses\" in API group \"networking.k8s.io\" in the namespace \"fission\"","stacktrace":"github.com/fission/fission/pkg/router.createIngress\n\tpkg/router/ingress.go:48"
}
```
fission-router has access to create ingress in default namespace, but it try to create it in fission namespace.
```
k describe role fission-router
Name:         fission-router
Labels:       app.kubernetes.io/managed-by=Helm
Annotations:  meta.helm.sh/release-name: fission
              meta.helm.sh/release-namespace: fission
PolicyRule:
  Resources                                       Non-Resource URLs  Resource Names  Verbs
  ---------                                       -----------------  --------------  -----
  ingresses.networking.k8s.io                     []                 []              [create get list watch update patch delete]
  customresourcedefinitions.apiextensions.k8s.io  []                 []              [get list watch]
```
**To Reproduce**

<!-- Please provide steps for reproducing the error. -->
```sh
fission route create --name hello --url "/hello" --function hello-js --createingress --ingressrule "my.fqdn.com=/hello"
```
**Expected result**
<!--A clear and concise description of what you expected to happen.-->
Ingress in default namespace

**Actual result**

**Screenshots/Dump file**
<!--If applicable, add screenshots/fission dump file to help explain your problem.-->


<pre>
$ fission support dump
</pre>

**Additional context**
<!--Add any other context about the problem here.-->



Discussion / hints:
I'm also seeing this. I was expecting the ingress to be created in the same namespace as the HttpTrigger, but instead it's being added to the fission namespace. Looking at the CRD there seems to be no way of specifying the ingress namespace.

Can the default be changed to match the namespace of the HttpTrigger, and also an option be added to the CRD for overriding?
As a workaround, it seems you can apply the below after helm install, which is just the fission-all/templates/router/role-kubernetes.yaml from the helm chart, with the namespace on each object changed from default to fission.  The ingresses get created in fission namespace but they do work.
```
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: "fission-router"
  namespace: fission
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - create
  - get
  - list
  - watch
  - update
  - patch
  - delete
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
---
# Source: fission-all/templates/router/role-kubernetes.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: "fission-router"
  namespace: fission
subjects:
  - kind: ServiceAccount
    name: "fission-router"
    namespace: fission
roleRef:
  kind: Role
  name: "fission-router"
  apiGroup: rbac.authorization.k8s.io
```

Fix patch:
diff --git a/charts/fission-all/templates/_fission-kubernetes-roles.tpl b/charts/fission-all/templates/_fission-kubernetes-roles.tpl
index 6afebde3d4..4c3a6f4b81 100644
--- a/charts/fission-all/templates/_fission-kubernetes-roles.tpl
+++ b/charts/fission-all/templates/_fission-kubernetes-roles.tpl
@@ -354,6 +354,8 @@ rules:
 # TODO: Kept for future in case preupgrade needs any permissions in the future
 rules: []
 {{- end }}
+# TODO: Currently, router needs ingress related permissions only.
+# In future if router's permissions are modified then check the configured namespace.
 {{- define "router-kuberules" }}
 rules:
 - apiGroups:
diff --git a/charts/fission-all/templates/router/role-kubernetes.yaml b/charts/fission-all/templates/router/role-kubernetes.yaml
index 27a38951cf..5dfeb42f79 100644
--- a/charts/fission-all/templates/router/role-kubernetes.yaml
+++ b/charts/fission-all/templates/router/role-kubernetes.yaml
@@ -1,4 +1,4 @@
-{{- include "kubernetes-role-generator" (merge (dict "namespace" .Values.defaultNamespace "component" "router") .) }}
+{{- include "kubernetes-role-generator" (merge (dict "namespace" .Release.Namespace "component" "router") .) }}
 
 {{- if gt (len .Values.additionalFissionNamespaces) 0 }}
 {{- range $namespace := $.Values.additionalFissionNamespaces }}


Test patch: