Repository: fission/fission
Pull request #2568 (2022-10-12 08:09:25)

Remove unwanted permissions from Fission components
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

<!--  Thanks for sending a pull request! We request you provide detailed description as much as possible. -->

## Description
<!--- Describe your changes in detail. -->
<!-- Typically try to give details of what, why and how of the PR changes. -->

## Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #

## Testing
<!--- Please describe in detail how you tested your changes. -->

## Checklist:
<!-- Please tick following checkboxes as per your understanding. -->
- [ ] I ran tests as well as code linting locally to verify my changes. 
- [ ] I have done manual verification of my changes, changes working as expected.
- [ ] I have added new tests to cover my changes.
- [ ] My changes follow contributing guidelines of Fission.
- [ ] I have signed all of my commits.


codecov[bot]: # [Codecov](https://codecov.io/gh/fission/fission/pull/2568?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fission) Report
> Merging [#2568](https://codecov.io/gh/fission/fission/pull/2568?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fission) (e6a6369) into [main](https://codecov.io/gh/fission/fission/commit/b9513868ed9617e3c3e6e779c37878d4a0030c60?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fission) (b951386) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #2568   +/-   ##
=======================================
  Coverage   19.08%   19.08%           
=======================================
  Files          62       62           
  Lines        6937     6937           
=======================================
  Hits         1324     1324           
  Misses       5509     5509           
  Partials      104      104           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `19.08% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fission#carryforward-flags-in-the-pull-request-comment) to find out more.


:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fission)


Patch:
diff --git a/.github/workflows/push_pr.yaml b/.github/workflows/push_pr.yaml
index 9fdcc590..a0d1777b 100644
--- a/.github/workflows/push_pr.yaml
+++ b/.github/workflows/push_pr.yaml
@@ -82,7 +82,7 @@ jobs:
           skaffold version
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
         with:
           install-only: true
 
@@ -130,7 +130,7 @@ jobs:
 
       - name: Archive fission dump
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
           path: fission-dump/*.zip
@@ -138,7 +138,7 @@ jobs:
 
       - name: Archive kind logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
diff --git a/charts/fission-all/templates/buildermgr/clusterrole.yaml b/charts/fission-all/templates/buildermgr/clusterrole.yaml
index b95af5cb..11606aba 100644
--- a/charts/fission-all/templates/buildermgr/clusterrole.yaml
+++ b/charts/fission-all/templates/buildermgr/clusterrole.yaml
@@ -8,12 +8,8 @@ rules:
   resources:
   - configmaps
   - pods
-  - secrets
   - services
   - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
   - create
   - delete
@@ -25,39 +21,24 @@ rules:
   - apps
   resources:
   - deployments
-  - deployments/scale
-  - replicasets
   verbs:
-  - create
-  - get
   - list
-  - watch
-  - update
-  - patch
+  - create
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - packages
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/controller/clusterrole.yaml b/charts/fission-all/templates/controller/clusterrole.yaml
index 05514696..b005e10f 100644
--- a/charts/fission-all/templates/controller/clusterrole.yaml
+++ b/charts/fission-all/templates/controller/clusterrole.yaml
@@ -3,44 +3,42 @@ kind: ClusterRole
 metadata:
   name: {{ .Release.Name }}-fission-cr-controller
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
 - apiGroups:
   - ""
   resources:
   - configmaps
-  - pods
   - secrets
-  - services
-  - serviceaccounts
-  - replicationcontrollers
-  - namespaces
-  - events
   verbs:
-  - create
-  - delete
   - get
-  - list
-  - watch
-  - patch
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
-  - deployments/scale
-  - replicasets
+  - namespaces
   verbs:
+  - get
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
@@ -60,21 +58,3 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
-  verbs:
-  - bind
diff --git a/charts/fission-all/templates/executor/clusterrole.yaml b/charts/fission-all/templates/executor/clusterrole.yaml
index 75df2ff7..0ad0d383 100644
--- a/charts/fission-all/templates/executor/clusterrole.yaml
+++ b/charts/fission-all/templates/executor/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -35,17 +34,20 @@ rules:
   - update
   - patch
   - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/kubewatcher/clusterrole.yaml b/charts/fission-all/templates/kubewatcher/clusterrole.yaml
index 5f44393e..0b2b0cb3 100644
--- a/charts/fission-all/templates/kubewatcher/clusterrole.yaml
+++ b/charts/fission-all/templates/kubewatcher/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -22,23 +21,17 @@ rules:
   - watch
   - patch
 - apiGroups:
-  - apps
+  - batch
   resources:
-  - deployments
-  - deployments/scale
-  - replicasets
+  - jobs
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - batch
+  - apiextensions.k8s.io
   resources:
-  - jobs
+  - customresourcedefinitions
   verbs:
   - get
   - list
@@ -46,26 +39,10 @@ rules:
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
   - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/misc-functions/role.yaml b/charts/fission-all/templates/misc-functions/role.yaml
index a0c5efbc..fe35e30b 100644
--- a/charts/fission-all/templates/misc-functions/role.yaml
+++ b/charts/fission-all/templates/misc-functions/role.yaml
@@ -4,67 +4,60 @@ metadata:
   name: {{ .Release.Name }}-fission-fetcher
   namespace: {{ .Values.defaultNamespace }}
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - "*"
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - list
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
+  namespace: {{ .Values.functionNamespace }}
+  name: {{ .Release.Name }}-event-fetcher
 rules:
-  - apiGroups:
-      - fission.io
-    resources:
-      - canaryconfigs
-      - environments
-      - functions
-      - httptriggers
-      - kuberneteswatchtriggers
-      - messagequeuetriggers
-      - packages
-      - timetriggers
-    verbs:
-      - "*"
-
+- apiGroups:
+  - ""
+  resources:
+  - "events"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+  - "create"
+  - "update"
+  - "patch"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  namespace: {{ .Values.functionNamespace }}
-  name: {{ .Release.Name }}-event-fetcher
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
 rules:
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["pods"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: [""] # "" indicates the core API group
-    resources: ["events"]
-    verbs: ["*"]
+- apiGroups:
+  - fission.io
+  resources:
+  - packages
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
diff --git a/charts/fission-all/templates/misc-functions/rolebinding.yaml b/charts/fission-all/templates/misc-functions/rolebinding.yaml
index c80af74c..0f756f16 100644
--- a/charts/fission-all/templates/misc-functions/rolebinding.yaml
+++ b/charts/fission-all/templates/misc-functions/rolebinding.yaml
@@ -11,33 +11,31 @@ subjects:
   - kind: ServiceAccount
     name: fission-fetcher
     namespace: {{ .Values.functionNamespace }}
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ .Release.Name }}-fission-builder
-  namespace: {{ .Values.defaultNamespace }}
+  name: {{ .Release.Name }}-fission-fetcher-pod-reader
+  namespace: {{ .Values.functionNamespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ .Release.Name }}-fission-builder
+  name: {{ .Release.Name }}-event-fetcher
 subjects:
   - kind: ServiceAccount
-    name: fission-builder
-    namespace: {{ .Values.builderNamespace }}
-
+    name: fission-fetcher
+    namespace: {{ .Values.functionNamespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ .Release.Name }}-fission-fetcher-pod-reader
-  namespace: {{ .Values.functionNamespace }}
+  name: {{ .Release.Name }}-fission-builder
+  namespace: {{ .Values.defaultNamespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ .Release.Name }}-event-fetcher
+  name: {{ .Release.Name }}-fission-builder
 subjects:
   - kind: ServiceAccount
-    name: fission-fetcher
-    namespace: {{ .Values.functionNamespace }}
+    name: fission-builder
+    namespace: {{ .Values.builderNamespace }}
diff --git a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml
index 98409356..6c02b299 100644
--- a/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml
+++ b/charts/fission-all/templates/mqt-fission-kafka/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/mqt-keda/clusterrole.yaml b/charts/fission-all/templates/mqt-keda/clusterrole.yaml
index f097005b..abebfbc3 100644
--- a/charts/fission-all/templates/mqt-keda/clusterrole.yaml
+++ b/charts/fission-all/templates/mqt-keda/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -36,28 +35,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - fission.io
+  - apiextensions.k8s.io
   resources:
-  - canaryconfigs
-  - environments
-  - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
-  - packages
-  - timetriggers
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
-  - autoscaling
+  - fission.io
   resources:
-  - horizontalpodautoscalers
+  - environments
+  - functions
+  - messagequeuetriggers
+  - packages
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml
index 3ce069c3..66f213c3 100644
--- a/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml
+++ b/charts/fission-all/templates/pre-upgrade-checks/clusterrole.yaml
@@ -13,6 +13,8 @@ rules:
   - customresourcedefinitions
   verbs:
   - get
+  - list
+  - watch
 - apiGroups:
   - fission.io
   resources:
diff --git a/charts/fission-all/templates/router/clusterrole.yaml b/charts/fission-all/templates/router/clusterrole.yaml
index 4eb3c7aa..1a9ee74a 100644
--- a/charts/fission-all/templates/router/clusterrole.yaml
+++ b/charts/fission-all/templates/router/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -22,11 +21,9 @@ rules:
   - watch
   - patch
 - apiGroups:
-  - apps
+  - networking.k8s.io
   resources:
-  - deployments
-  - deployments/scale
-  - replicasets
+  - ingresses
   verbs:
   - create
   - get
@@ -36,40 +33,20 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - networking.k8s.io
+  - apiextensions.k8s.io
   resources:
-  - ingresses
+  - customresourcedefinitions
   verbs:
-  - create
   - get
   - list
   - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
   - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
-  - timetriggers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
   verbs:
   - create
   - get
diff --git a/charts/fission-all/templates/timer/clusterrole.yaml b/charts/fission-all/templates/timer/clusterrole.yaml
index 29bb134b..cf6fdc30 100644
--- a/charts/fission-all/templates/timer/clusterrole.yaml
+++ b/charts/fission-all/templates/timer/clusterrole.yaml
@@ -12,7 +12,6 @@ rules:
   - services
   - serviceaccounts
   - replicationcontrollers
-  - namespaces
   - events
   verbs:
   - create
@@ -21,29 +20,11 @@ rules:
   - list
   - watch
   - patch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - deployments/scale
-  - replicasets
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - fission.io
   resources:
-  - canaryconfigs
   - environments
   - functions
-  - httptriggers
-  - kuberneteswatchtriggers
-  - messagequeuetriggers
   - packages
   - timetriggers
   verbs:
@@ -54,18 +35,6 @@ rules:
   - update
   - patch
   - delete
-- apiGroups:
-  - autoscaling
-  resources:
-  - horizontalpodautoscalers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -84,3 +53,11 @@ rules:
   - clusterroles
   verbs:
   - bind
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
\ No newline at end of file
diff --git a/cmd/fission-bundle/mqtrigger/mqtrigger.go b/cmd/fission-bundle/mqtrigger/mqtrigger.go
index 0ea06c66..7448eac0 100644
--- a/cmd/fission-bundle/mqtrigger/mqtrigger.go
+++ b/cmd/fission-bundle/mqtrigger/mqtrigger.go
@@ -41,7 +41,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
diff --git a/pkg/buildermgr/buildermgr.go b/pkg/buildermgr/buildermgr.go
index b94cbbd6..ecccafda 100644
--- a/pkg/buildermgr/buildermgr.go
+++ b/pkg/buildermgr/buildermgr.go
@@ -42,7 +42,7 @@ func Start(ctx context.Context, logger *zap.Logger, storageSvcUrl string, envBui
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
diff --git a/pkg/buildermgr/envwatcher.go b/pkg/buildermgr/envwatcher.go
index 7925316a..b4046b0b 100644
--- a/pkg/buildermgr/envwatcher.go
+++ b/pkg/buildermgr/envwatcher.go
@@ -505,7 +505,7 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
 		},
 		Spec: apiv1.PodSpec{
 			Containers:         []apiv1.Container{*container},
-			ServiceAccountName: "fission-builder",
+			ServiceAccountName: fv1.FissionBuilderSA,
 		},
 	}
 
diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go
index 9dd3ac0c..d34ddb1d 100644
--- a/pkg/controller/controller.go
+++ b/pkg/controller/controller.go
@@ -37,7 +37,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, unitTestFlag bool)
 		cLogger.Fatal("failed to find fission CRDs", zap.Error(err))
 	}
 
-	err = crd.WaitForCRDs(ctx, fc)
+	err = crd.WaitForCRDs(ctx, logger, fc)
 	if err != nil {
 		cLogger.Fatal("error waiting for CRDs", zap.Error(err))
 	}
diff --git a/pkg/crd/client.go b/pkg/crd/client.go
index 76a2890c..e77e33b3 100644
--- a/pkg/crd/client.go
+++ b/pkg/crd/client.go
@@ -22,6 +22,7 @@ import (
 	"os"
 	"time"
 
+	"go.uber.org/zap"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/dynamic"
@@ -88,7 +89,8 @@ func MakeFissionClient() (versioned.Interface, kubernetes.Interface, apiextensio
 }
 
 // WaitForCRDs does a timeout to check if CRDs have been installed
-func WaitForCRDs(ctx context.Context, fissionClient versioned.Interface) error {
+func WaitForCRDs(ctx context.Context, logger *zap.Logger, fissionClient versioned.Interface) error {
+	logger.Info("Waiting for CRDs to be installed")
 	start := time.Now()
 	for {
 		fi := fissionClient.CoreV1().Functions(metav1.NamespaceDefault)
diff --git a/pkg/executor/executor.go b/pkg/executor/executor.go
index 59f02300..f3ec9741 100644
--- a/pkg/executor/executor.go
+++ b/pkg/executor/executor.go
@@ -259,7 +259,7 @@ func StartExecutor(ctx context.Context, logger *zap.Logger, functionNamespace st
 		return errors.Wrap(err, "failed to get kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
diff --git a/pkg/executor/executortype/newdeploy/newdeploy.go b/pkg/executor/executortype/newdeploy/newdeploy.go
index 069de80c..c4f0f9e6 100644
--- a/pkg/executor/executortype/newdeploy/newdeploy.go
+++ b/pkg/executor/executortype/newdeploy/newdeploy.go
@@ -273,7 +273,7 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
 		},
 		Spec: apiv1.PodSpec{
 			Containers:                    []apiv1.Container{*container},
-			ServiceAccountName:            "fission-fetcher",
+			ServiceAccountName:            fv1.FissionFetcherSA,
 			TerminationGracePeriodSeconds: &gracePeriodSeconds,
 		},
 	}
diff --git a/pkg/executor/executortype/poolmgr/gp_deployment.go b/pkg/executor/executortype/poolmgr/gp_deployment.go
index a1f68cea..2ec24b4c 100644
--- a/pkg/executor/executortype/poolmgr/gp_deployment.go
+++ b/pkg/executor/executortype/poolmgr/gp_deployment.go
@@ -142,7 +142,7 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme
 		},
 		Spec: apiv1.PodSpec{
 			Containers:         []apiv1.Container{*container},
-			ServiceAccountName: "fission-fetcher",
+			ServiceAccountName: fv1.FissionFetcherSA,
 			// TerminationGracePeriodSeconds should be equal to the
 			// sleep time of preStop to make sure that SIGTERM is sent
 			// to pod after 6 mins.
diff --git a/pkg/kubewatcher/main.go b/pkg/kubewatcher/main.go
index f0249fad..6dc3afa4 100644
--- a/pkg/kubewatcher/main.go
+++ b/pkg/kubewatcher/main.go
@@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
diff --git a/pkg/mqtrigger/scalermanager.go b/pkg/mqtrigger/scalermanager.go
index 80068c6b..e40e7dbd 100644
--- a/pkg/mqtrigger/scalermanager.go
+++ b/pkg/mqtrigger/scalermanager.go
@@ -154,7 +154,7 @@ func StartScalerManager(ctx context.Context, logger *zap.Logger, routerURL strin
 	if err != nil {
 		return err
 	}
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}
diff --git a/pkg/router/router.go b/pkg/router/router.go
index 2f9bd6be..55608977 100644
--- a/pkg/router/router.go
+++ b/pkg/router/router.go
@@ -95,7 +95,7 @@ func Start(ctx context.Context, logger *zap.Logger, port int, executorURL string
 		logger.Fatal("error connecting to kubernetes API", zap.Error(err))
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		logger.Fatal("error waiting for CRDs", zap.Error(err))
 	}
diff --git a/pkg/timer/main.go b/pkg/timer/main.go
index ecae3784..75a6132f 100644
--- a/pkg/timer/main.go
+++ b/pkg/timer/main.go
@@ -32,7 +32,7 @@ func Start(ctx context.Context, logger *zap.Logger, routerUrl string) error {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		return errors.Wrap(err, "error waiting for CRDs")
 	}


Test patch:
diff --git a/.github/workflows/upgrade_test.yaml b/.github/workflows/upgrade_test.yaml
index b16f4e46..7eebc5b8 100644
--- a/.github/workflows/upgrade_test.yaml
+++ b/.github/workflows/upgrade_test.yaml
@@ -55,7 +55,7 @@ jobs:
           version: ${{ env.KIND_VERSION }}
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
         with:
           install-only: true
 
@@ -101,7 +101,7 @@ jobs:
 
       - name: Archive fission dump
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: fission-dump
           path: fission-dump/*.zip
@@ -109,7 +109,7 @@ jobs:
 
       - name: Archive kind logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
           path: kind-logs/*
diff --git a/pkg/executor/executor_test.go b/pkg/executor/executor_test.go
index 7a3a43ac..69479338 100644
--- a/pkg/executor/executor_test.go
+++ b/pkg/executor/executor_test.go
@@ -149,7 +149,7 @@ func TestExecutor(t *testing.T) {
 		log.Panicf("failed to ensure crds: %v", err)
 	}
 
-	err = crd.WaitForCRDs(ctx, fissionClient)
+	err = crd.WaitForCRDs(ctx, logger, fissionClient)
 	if err != nil {
 		log.Panicf("failed to wait crds: %v", err)
 	}
diff --git a/test/kind_CI.sh b/test/kind_CI.sh
index 92199bf0..798159dd 100755
--- a/test/kind_CI.sh
+++ b/test/kind_CI.sh
@@ -53,7 +53,7 @@ echo "Successfully pull env and builder images"
 export FAILURES=0
 main() {
     set +e
-    export TIMEOUT=1200  # 20 minutes per test
+    export TIMEOUT=900  # 15 minutes per test
     # run tests without newdeploy in parallel.
     export JOBS=6
     source $ROOT/test/run_test.sh \