Skip to content

Commit 78b22b3

Browse files
adellapeadellape
committed
Consolidate "Installing from OperatorHub" procs & Single vs AllNamespace improvements
1 parent 89c0789 commit 78b22b3

7 files changed

+185
-299
lines changed

‎images/oadp-install-operator-role-arn.png

-168 KB
Binary file not shown.

‎modules/olm-installing-from-operatorhub-using-cli.adoc

Lines changed: 153 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,17 @@ endif::[]
1313

1414
:_mod-docs-content-type: PROCEDURE
1515
[id="olm-installing-operator-from-operatorhub-using-cli_{context}"]
16-
= Installing from OperatorHub using the CLI
16+
= Installing from OperatorHub by using the CLI
1717

1818
Instead of using the {product-title} web console, you can install an Operator from OperatorHub by using the CLI. Use the `oc` command to create or update a `Subscription` object.
1919

20+
For `SingleNamespace` install mode, you must also ensure an appropriate Operator group exists in the related namespace. An Operator group, defined by an `OperatorGroup` object, selects target namespaces in which to generate required RBAC access for all Operators in the same namespace as the Operator group.
21+
22+
[TIP]
23+
====
24+
In most cases, the web console method of this procedure is preferred because it automates tasks in the background, such as handling the creation of `OperatorGroup` and `Subscription` objects automatically when choosing `SingleNamespace` mode.
25+
====
26+
2027
.Prerequisites
2128

2229
ifndef::olm-user[]
@@ -45,22 +52,25 @@ $ oc get packagemanifests -n openshift-marketplace
4552
----
4653
+
4754
.Example output
55+
[%collapsible]
56+
====
4857
[source,terminal]
4958
----
5059
NAME CATALOG AGE
5160
3scale-operator Red Hat Operators 91m
5261
advanced-cluster-management Red Hat Operators 91m
5362
amq7-cert-manager Red Hat Operators 91m
54-
...
63+
# ...
5564
couchbase-enterprise-certified Certified Operators 91m
5665
crunchy-postgres-operator Certified Operators 91m
5766
mongodb-enterprise Certified Operators 91m
58-
...
67+
# ...
5968
etcd Community Operators 91m
6069
jaeger Community Operators 91m
6170
kubefed Community Operators 91m
62-
...
71+
# ...
6372
----
73+
====
6474
+
6575
Note the catalog for your desired Operator.
6676
@@ -70,33 +80,97 @@ Note the catalog for your desired Operator.
7080
----
7181
$ oc describe packagemanifests <operator_name> -n openshift-marketplace
7282
----
83+
+
84+
.Example output
85+
[%collapsible]
86+
====
87+
[source,terminal]
88+
----
89+
# ...
90+
Kind: PackageManifest
91+
# ...
92+
Install Modes: <1>
93+
Supported: true
94+
Type: OwnNamespace
95+
Supported: true
96+
Type: SingleNamespace
97+
Supported: false
98+
Type: MultiNamespace
99+
Supported: true
100+
Type: AllNamespaces
101+
# ...
102+
Entries:
103+
Name: example-operator.v3.7.11
104+
Version: 3.7.11
105+
Name: example-operator.v3.7.10
106+
Version: 3.7.10
107+
Name: stable-3.7 <2>
108+
# ...
109+
Entries:
110+
Name: example-operator.v3.8.5
111+
Version: 3.8.5
112+
Name: example-operator.v3.8.4
113+
Version: 3.8.4
114+
Name: stable-3.8 <2>
115+
Default Channel: stable-3.8 <3>
116+
----
117+
<1> Indicates which install modes are supported.
118+
<2> Example channel names.
119+
<3> The channel selected by default if one is not specified.
120+
====
121+
+
122+
[TIP]
123+
====
124+
You can print an Operator's version and channel information in YAML format by running the following command:
73125
74-
. An Operator group, defined by an `OperatorGroup` object, selects target namespaces in which to generate required RBAC access for all Operators in the same namespace as the Operator group.
126+
[source,terminal]
127+
----
128+
$ oc get packagemanifests <operator_name> -n <catalog_namespace> -o yaml
129+
----
130+
====
131+
132+
** If more than one catalog is installed in a namespace, run the following command to look up the available versions and channels of an Operator from a specific catalog:
133+
+
134+
[source,terminal]
135+
----
136+
$ oc get packagemanifest \
137+
--selector=catalog=<catalogsource_name> \
138+
--field-selector metadata.name=<operator_name> \
139+
-n <catalog_namespace> -o yaml
140+
----
75141
+
76-
The namespace to which you subscribe the Operator must have an Operator group that matches the install mode of the Operator, either the `AllNamespaces` or `SingleNamespace` mode. If the Operator you intend to install uses the `AllNamespaces` mode, the `openshift-operators` namespace already has the appropriate `global-operators` Operator group in place.
142+
[IMPORTANT]
143+
====
144+
If you do not specify the Operator's catalog, running the `oc get packagemanifest` and `oc describe packagemanifest` commands might return a package from an unexpected catalog if the following conditions are met:
145+
146+
* Multiple catalogs are installed in the same namespace.
147+
* The catalogs contain the same Operators or Operators with the same name.
148+
====
149+
150+
. If the Operator you intend to install supports the `AllNamespaces` install mode, and you choose to use this mode, skip this step, because the `openshift-operators` namespace already has an appropriate Operator group in place by default, called `global-operators`.
77151
+
78-
However, if the Operator uses the `SingleNamespace` mode and you do not already have an appropriate Operator group in place, you must create one.
152+
If the Operator you intend to install supports the `SingleNamespace` install mode, and you choose to use this mode, you must ensure an appropriate Operator group exists in the related namespace. If one does not exist, you can create create one by following these steps:
79153
+
80-
[NOTE]
154+
[IMPORTANT]
81155
====
82-
* The web console version of this procedure handles the creation of the `OperatorGroup` and `Subscription` objects automatically behind the scenes for you when choosing `SingleNamespace` mode.
83-
* You can only have one Operator group per namespace. For more information, see "Operator groups".
156+
You can only have one Operator group per namespace. For more information, see "Operator groups".
84157
====
85158

86-
.. Create an `OperatorGroup` object YAML file, for example `operatorgroup.yaml`:
159+
.. Create an `OperatorGroup` object YAML file, for example `operatorgroup.yaml`, for `SingleNamespace` install mode:
87160
+
88-
.Example `OperatorGroup` object
161+
.Example `OperatorGroup` object for `SingleNamespace` install mode
89162
[source,yaml]
90163
----
91164
apiVersion: operators.coreos.com/v1
92165
kind: OperatorGroup
93166
metadata:
94167
name: <operatorgroup_name>
95-
namespace: <namespace>
168+
namespace: <namespace> <1>
96169
spec:
97170
targetNamespaces:
98-
- <namespace>
171+
- <namespace> <1>
99172
----
173+
<1> For `SingleNamespace` install mode, use the same `<namespace>` value for both the `metadata.namespace` and `spec.targetNamespaces` fields.
100174

101175
.. Create the `OperatorGroup` object:
102176
+
@@ -105,21 +179,30 @@ spec:
105179
$ oc apply -f operatorgroup.yaml
106180
----
107181

108-
. Create a `Subscription` object YAML file to subscribe a namespace to an Operator, for example `sub.yaml`:
182+
. Create a `Subscription` object to subscribe a namespace to an Operator:
183+
184+
.. Create a YAML file for the `Subscription` object, for example `subscription.yaml`:
185+
+
186+
[NOTE]
187+
====
188+
If you want to subscribe to a specific version of an Operator, set the `startingCSV` field to the desired version and set the `installPlanApproval` field to `Manual` to prevent the Operator from automatically upgrading if a later version exists in the catalog. For details, see the following "Example `Subscription` object with a specific starting Operator version".
189+
====
109190
+
110191
.Example `Subscription` object
192+
[%collapsible]
193+
====
111194
[source,yaml]
112195
----
113196
apiVersion: operators.coreos.com/v1alpha1
114197
kind: Subscription
115198
metadata:
116199
name: <subscription_name>
117-
namespace: openshift-operators <1>
200+
namespace: <namespace_per_install_mode> <1>
118201
spec:
119202
channel: <channel_name> <2>
120203
name: <operator_name> <3>
121-
source: redhat-operators <4>
122-
sourceNamespace: openshift-marketplace <5>
204+
source: <catalog_name> <4>
205+
sourceNamespace: <catalog_source_namespace> <5>
123206
config:
124207
env: <6>
125208
- name: ARGS
@@ -146,22 +229,45 @@ spec:
146229
nodeSelector: <12>
147230
foo: bar
148231
----
149-
<1> For default `AllNamespaces` install mode usage, specify the `openshift-operators` namespace. Alternatively, you can specify a custom global namespace, if you have created one. Otherwise, specify the relevant single namespace for `SingleNamespace` install mode usage.
232+
<1> For default `AllNamespaces` install mode usage, specify the `openshift-operators` namespace. Alternatively, you can specify a custom global namespace, if you have created one. For `SingleNamespace` install mode usage, specify the relevant single namespace.
150233
<2> Name of the channel to subscribe to.
151234
<3> Name of the Operator to subscribe to.
152235
<4> Name of the catalog source that provides the Operator.
153236
<5> Namespace of the catalog source. Use `openshift-marketplace` for the default OperatorHub catalog sources.
154-
<6> The `env` parameter defines a list of Environment Variables that must exist in all containers in the pod created by OLM.
155-
<7> The `envFrom` parameter defines a list of sources to populate Environment Variables in the container.
156-
<8> The `volumes` parameter defines a list of Volumes that must exist on the pod created by OLM.
237+
<6> The `env` parameter defines a list of environment variables that must exist in all containers in the pod created by OLM.
238+
<7> The `envFrom` parameter defines a list of sources to populate environment variables in the container.
239+
<8> The `volumes` parameter defines a list of volumes that must exist on the pod created by OLM.
157240
<9> The `volumeMounts` parameter defines a list of volume mounts that must exist in all containers in the pod created by OLM. If a `volumeMount` references a `volume` that does not exist, OLM fails to deploy the Operator.
158-
<10> The `tolerations` parameter defines a list of Tolerations for the pod created by OLM.
241+
<10> The `tolerations` parameter defines a list of tolerations for the pod created by OLM.
159242
<11> The `resources` parameter defines resource constraints for all the containers in the pod created by OLM.
160243
<12> The `nodeSelector` parameter defines a `NodeSelector` for the pod created by OLM.
244+
====
245+
+
246+
.Example `Subscription` object with a specific starting Operator version
247+
[%collapsible]
248+
====
249+
[source,yaml]
250+
----
251+
apiVersion: operators.coreos.com/v1alpha1
252+
kind: Subscription
253+
metadata:
254+
name: example-operator
255+
namespace: example-operator
256+
spec:
257+
channel: stable-3.7
258+
installPlanApproval: Manual <1>
259+
name: example-operator
260+
source: custom-operators
261+
sourceNamespace: openshift-marketplace
262+
startingCSV: example-operator.v3.7.10 <2>
263+
----
264+
<1> Set the approval strategy to `Manual` in case your specified version is superseded by a later version in the catalog. This plan prevents an automatic upgrade to a later version and requires manual approval before the starting CSV can complete the installation.
265+
<2> Set a specific version of an Operator CSV.
266+
====
161267

162-
. For clusters on cloud providers with token authentication enabled:
268+
.. For clusters on cloud providers with token authentication enabled, configure your `Subscription` object by following these steps:
163269

164-
.. Ensure the `Subscription` object is set to manual update approvals:
270+
... Ensure the `Subscription` object is set to manual update approvals:
165271
+
166272
[source,yaml]
167273
----
@@ -172,7 +278,7 @@ spec:
172278
----
173279
<1> Subscriptions with automatic update approvals are not recommended because there might be permission changes to make prior to updating. Subscriptions with manual update approvals ensure that administrators have the opportunity to verify the permissions of the later version and take any necessary steps prior to update.
174280

175-
.. Include the relevant cloud provider-specific fields in the `Subscription` object's `config` section:
281+
... Include the relevant cloud provider-specific fields in the `Subscription` object's `config` section:
176282
+
177283
--
178284
* If the cluster is in AWS STS mode, include the following fields:
@@ -210,15 +316,33 @@ spec:
210316
<3> Include the subscription ID.
211317
--
212318
213-
. Create the `Subscription` object:
319+
.. Create the `Subscription` object by running the following command:
214320
+
215321
[source,terminal]
216322
----
217-
$ oc apply -f sub.yaml
323+
$ oc apply -f subscription.yaml
218324
----
219-
+
325+
326+
. If you set the `installPlanApproval` field to `Manual`, manually approve the pending install plan to complete the Operator installation. For more information, see "Manually approving a pending Operator update".
327+
220328
At this point, OLM is now aware of the selected Operator. A cluster service version (CSV) for the Operator should appear in the target namespace, and APIs provided by the Operator should be available for creation.
221329

330+
.Verification
331+
332+
. Check the status of the `Subscription` object for your installed Operator by running the following command:
333+
+
334+
[source,terminal]
335+
----
336+
$ oc describe subscription <subscription_name> -n <namespace>
337+
----
338+
339+
. If you created an Operator group for `SingleNamespace` install mode, check the status of the `OperatorGroup` object by running the following command:
340+
+
341+
[source,terminal]
342+
----
343+
$ oc describe operatorgroup <operatorgroup_name> -n <namespace>
344+
----
345+
222346
ifeval::["{context}" == "olm-installing-operators-in-namespace"]
223347
:!olm-user:
224348
endif::[]

‎modules/olm-installing-from-operatorhub-using-web-console.adoc

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ endif::[]
3030

3131
:_mod-docs-content-type: PROCEDURE
3232
[id="olm-installing-from-operatorhub-using-web-console_{context}"]
33-
= Installing from OperatorHub using the web console
33+
= Installing from OperatorHub by using the web console
3434

3535
You can install and subscribe to an Operator from OperatorHub by using the {product-title} web console.
3636

@@ -67,10 +67,19 @@ Choosing a Community Operator warns that Red Hat does not certify Community Oper
6767

6868
. Read the information about the Operator and click *Install*.
6969

70-
. On the *Install Operator* page:
70+
. On the *Install Operator* page, configure your Operator installation:
71+
72+
.. If you want to install a specific version of an Operator, select an *Update channel* and *Version* from the lists. You can browse the various versions of an Operator across any channels it might have, view the metadata for that channel and version, and select the exact version you want to install.
73+
+
74+
[NOTE]
75+
====
76+
The version selection defaults to the latest version for the channel selected. If the latest version for the channel is selected, the *Automatic* approval strategy is enabled by default. Otherwise, *Manual* approval is required when not installing the latest version for the selected channel.
77+
78+
Installing an Operator with *Manual* approval causes all Operators installed within the namespace to function with the *Manual* approval strategy and all Operators are updated together. If you want to update Operators independently, install Operators into separate namespaces.
79+
====
7180

7281
ifdef::olm-admin[]
73-
.. Select one of the following:
82+
.. Confirm the installation mode for the Operator:
7483
*** *All namespaces on the cluster (default)* installs the Operator in the default `openshift-operators` namespace to watch and be made available to all namespaces in the cluster. This option is not always available.
7584
*** *A specific namespace on the cluster* allows you to choose a specific, single namespace in which to install the Operator. The Operator will only watch and be made available for use in this single namespace.
7685
endif::[]
@@ -81,17 +90,12 @@ endif::[]
8190
.. For clusters on cloud providers with token authentication enabled:
8291
+
8392
--
84-
* If the cluster uses {aws-short} {sts-short} (*STS Mode* in the web console), enter the Amazon Resource Name (ARN) of the AWS IAM role of your service account in the *role ARN* field.
85-
+
86-
image::oadp-install-operator-role-arn.png[Entering the ARN]
87-
To create the role's ARN, follow the procedure described in link:https://access.redhat.com/documentation/en-us/red_hat_openshift_service_on_aws/4/html/tutorials/cloud-experts-deploy-api-data-protection#prepare-aws-account_cloud-experts-deploy-api-data-protection[Preparing AWS account].
93+
* If the cluster uses {aws-short} {sts-short} (*STS Mode* in the web console), enter the Amazon Resource Name (ARN) of the AWS IAM role of your service account in the *role ARN* field. To create the role's ARN, follow the procedure described in link:https://access.redhat.com/documentation/en-us/red_hat_openshift_service_on_aws/4/html/tutorials/cloud-experts-deploy-api-data-protection#prepare-aws-account_cloud-experts-deploy-api-data-protection[Preparing AWS account].
8894

8995
* If the cluster uses {entra-first} (*Workload Identity / Federated Identity Mode* in the web console), add the client ID, tenant ID, and subscription ID in the appropriate field.
9096
--
9197
92-
.. If more than one update channel is available, select an *Update channel*.
93-
94-
.. Select *Automatic* or *Manual* approval strategy, as described earlier.
98+
.. For *Update approval*, select either the *Automatic* or *Manual* approval strategy.
9599
+
96100
[IMPORTANT]
97101
====
@@ -100,21 +104,30 @@ If the web console shows that the cluster uses {aws-short} {sts-short} or {entra
100104
Subscriptions with automatic update approvals are not recommended because there might be permission changes to make prior to updating. Subscriptions with manual update approvals ensure that administrators have the opportunity to verify the permissions of the later version and take any necessary steps prior to update.
101105
====
102106

103-
. Click *Install* to make the Operator available to the selected namespaces on this {product-title} cluster.
107+
. Click *Install* to make the Operator available to the selected namespaces on this {product-title} cluster:
104108

105109
.. If you selected a *Manual* approval strategy, the upgrade status of the subscription remains *Upgrading* until you review and approve the install plan.
106110
+
107111
After approving on the *Install Plan* page, the subscription upgrade status moves to *Up to date*.
108112

109113
.. If you selected an *Automatic* approval strategy, the upgrade status should resolve to *Up to date* without intervention.
110114

111-
. After the upgrade status of the subscription is *Up to date*, select *Operators → Installed Operators* to verify that the cluster service version (CSV) of the installed Operator eventually shows up. The *Status* should ultimately resolve to *InstallSucceeded* in the relevant namespace.
115+
.Verification
116+
117+
* After the upgrade status of the subscription is *Up to date*, select *Operators* -> *Installed Operators* to verify that the cluster service version (CSV) of the installed Operator eventually shows up. The *Status* should eventually resolve to *Succeeded* in the relevant namespace.
112118
+
113119
[NOTE]
114120
====
115-
For the *All namespaces...* installation mode, the status resolves to *InstallSucceeded* in the `openshift-operators` namespace, but the status is *Copied* if you check in other namespaces.
121+
For the *All namespaces...* installation mode, the status resolves to *Succeeded* in the `openshift-operators` namespace, but the status is *Copied* if you check in other namespaces.
116122
====
117123
+
118124
If it does not:
119125
120-
.. Check the logs in any pods in the `openshift-operators` project (or other relevant namespace if *A specific namespace...* installation mode was selected) on the *Workloads → Pods* page that are reporting issues to troubleshoot further.
126+
** Check the logs in any pods in the `openshift-operators` project (or other relevant namespace if *A specific namespace...* installation mode was selected) on the *Workloads* -> *Pods* page that are reporting issues to troubleshoot further.
127+
128+
* When the Operator is installed, the metadata indicates which channel and version are installed.
129+
+
130+
[NOTE]
131+
====
132+
The *Channel* and *Version* dropdown menus are still available for viewing other version metadata in this catalog context.
133+
====

0 commit comments

Comments
 (0)