Skip to content

Commit 9a5f3a1

Browse files
michaelryanpetermichaelryanpeter
committed
OSDOCS#1116: OLMv1 Service accounts
1 parent c5b248d commit 9a5f3a1

File tree

4 files changed

+171
-6
lines changed

4 files changed

+171
-6
lines changed

‎extensions/ce/managing-ce.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@ include::modules/olmv1-supported-extensions.adoc[leveloffset=+1]
2626
2727
include::modules/olmv1-finding-operators-to-install.adoc[leveloffset=+1]
2828
include::modules/olmv1-catalog-queries.adoc[leveloffset=+2]
29+
include::modules/olmv1-creating-a-service-account.adoc[leveloffset=+1]
2930
include::modules/olmv1-installing-an-operator.adoc[leveloffset=+1]
3031

3132
[role="_additional-resources"]
3233
.Additional resources
3334
* xref:../../extensions/ce/managing-ce.adoc#olmv1-supported-extensions_managing-ce[Supported extensions]
35+
* xref:../../extensions/ce/managing-ce.adoc#olmv1-creating-a-service-account_managing-ce[Creating a service account]
3436
* xref:../../extensions/ce/upgrade-edges.adoc#olmv1-about-target-versions_upgrade-edges[Example custom resources (CRs) that specify a target version]
3537
* xref:../../extensions/ce/upgrade-edges.adoc#olmv1-version-range-support_upgrade-edges[Support for version ranges]
3638

‎modules/olmv1-creating-a-service-account.adoc

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * extensions/ce/managing-ce.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
7+
[id="olmv1-creating-a-service-account_{context}"]
8+
= Creating a service account to manage cluster extensions
9+
10+
Unlike {olmv0-first}, {olmv1} does not have permissions to install, update, and manage cluster extensions. Cluster administrators must create a service account and assign the role-based access controls (RBAC) required to install, update, and manage cluster extensions.
11+
12+
[IMPORTANT]
13+
====
14+
include::snippets/olmv1-known-issue-service-accounts.adoc[]
15+
====
16+
17+
.Prerequisites
18+
19+
* Access to an {product-title} cluster using an account with `cluster-admin` permissions.
20+
21+
.Procedure
22+
23+
. Create a service account, similar to the following example:
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: v1
28+
kind: ServiceAccount
29+
metadata:
30+
name: <extension>-installer
31+
namespace: <namespace>
32+
----
33+
+
34+
.Example `extension-service-account.yaml` file
35+
[%collapsible]
36+
====
37+
[source,yaml]
38+
----
39+
apiVersion: v1
40+
kind: ServiceAccount
41+
metadata:
42+
name: pipelines-installer
43+
namespace: pipelines
44+
----
45+
====
46+
47+
. Apply the service account by running the following command:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc apply -f extension-service-account.yaml
52+
----
53+
. Create a cluster role and assign RBAC, similar to the following example:
54+
+
55+
[WARNING]
56+
====
57+
The following cluster role does not follow the principle of least privilege. This cluster role is intended for testing purposes only. Do not use it on production clusters.
58+
====
59+
+
60+
[source,yaml]
61+
----
62+
apiVersion: rbac.authorization.k8s.io/v1
63+
kind: ClusterRole
64+
metadata:
65+
name: <extension>-installer-clusterrole
66+
rules:
67+
- apiGroups: ["*"]
68+
resources: ["*"]
69+
verbs: ["*"]
70+
----
71+
+
72+
.Example `pipelines-cluster-role.yaml` file
73+
[%collapsible]
74+
====
75+
[source,yaml]
76+
----
77+
apiVersion: rbac.authorization.k8s.io/v1
78+
kind: ClusterRole
79+
metadata:
80+
name: pipelines-installer-clusterrole
81+
rules:
82+
- apiGroups: ["*"]
83+
resources: ["*"]
84+
verbs: ["*"]
85+
----
86+
====
87+
88+
. Add the cluster role to the cluster by running the following command:
89+
+
90+
[source,terminal]
91+
----
92+
$ oc apply -f pipelines-role.yaml
93+
----
94+
95+
. Bind the permissions granted by the cluster role to the service account by creating a cluster role binding, similar to the following example:
96+
+
97+
[source,yaml]
98+
----
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: ClusterRoleBinding
101+
metadata:
102+
name: <extension>-installer-binding
103+
roleRef:
104+
apiGroup: rbac.authorization.k8s.io
105+
kind: ClusterRole
106+
name: <extension>-installer-clusterrole
107+
subjects:
108+
- kind: ServiceAccount
109+
name: <extension>-installer
110+
namespace: <namespace>
111+
----
112+
+
113+
.Example `pipelines-cluster-role-binding.yaml` file
114+
[%collapsible]
115+
====
116+
[source,yaml]
117+
----
118+
apiVersion: rbac.authorization.k8s.io/v1
119+
kind: ClusterRoleBinding
120+
metadata:
121+
name: pipelines-installer-binding
122+
roleRef:
123+
apiGroup: rbac.authorization.k8s.io
124+
kind: ClusterRole
125+
name: pipelines-installer-clusterrole
126+
subjects:
127+
- kind: ServiceAccount
128+
name: pipelines-installer
129+
namespace: pipelines
130+
----
131+
====
132+
133+
. Apply the cluster role binding by running the following command:
134+
+
135+
[source,terminal]
136+
----
137+
$ oc apply -f pipelines-cluster-role-binding.yaml
138+
----

‎modules/olmv1-installing-an-operator.adoc

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ include::snippets/olmv1-known-issue-private-registries.adoc[]
2020
* You have added a catalog to your cluster.
2121
* You have downloaded a local copy of the catalog file.
2222
* You have installed the `jq` CLI tool.
23+
* You have created a service account and assigned enough role-based access controls (RBAC) to install, update, and manage the extension you want to install. For more information, see _Creating a service account_.
2324

2425
.Procedure
2526

@@ -120,13 +121,16 @@ metadata:
120121
spec:
121122
packageName: openshift-pipelines-operator-rh
122123
installNamespace: <namespace>
124+
serviceAccount:
125+
name: <service_account>
123126
channel: <channel>
124127
version: "<version>"
125128
----
126129
+
127130
where:
128131
+
129-
`<namespace>`:: Specifies the namespace where you want the bundle installed, such as `openshift-operators` or `my-extension`. Extensions are still cluster-scoped and might contain resources that are installed in different namespaces.
132+
`<namespace>`:: Specifies the namespace where you want the bundle installed, such as `pipelines` or `my-extension`. Extensions are still cluster-scoped and might contain resources that are installed in different namespaces.
133+
`<service_account>`:: Specifies the name of the service account you created to install, update, and manage your extension.
130134
`<channel>`:: Optional: Specifies the channel, such as `pipelines-1.11` or `latest`, for the package you want to install or update.
131135
`<version>`:: Optional: Specifies the version or version range, such as `1.11.1`, `1.12.x`, or `>=1.12.1`, of the package you want to install or update. For more information, see "Example custom resources (CRs) that specify a target version" and "Support for version ranges".
132136
+
@@ -168,16 +172,20 @@ items:
168172
metadata:
169173
annotations:
170174
kubectl.kubernetes.io/last-applied-configuration: |
171-
{"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m"}}
175+
{"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"pipelines","packageName":"openshift-pipelines-operator-rh","serviceAccount":{"name":"pipelines-installer"},"pollInterval":"30m"}}
172176
creationTimestamp: "2024-06-10T17:50:51Z"
177+
finalizers:
178+
- olm.operatorframework.io/cleanup-unpack-cache
173179
generation: 1
174180
name: pipelines-operator
175181
resourceVersion: "53324"
176182
uid: c54237be-cde4-46d4-9b31-d0ec6acc19bf
177183
spec:
178184
channel: latest
179-
installNamespace: openshift-operators
185+
installNamespace: pipelines
180186
packageName: openshift-pipelines-operator-rh
187+
serviceAccount:
188+
name: pipelines-installer
181189
upgradeConstraintPolicy: Enforce
182190
status:
183191
conditions:
@@ -217,15 +225,18 @@ items:
217225
reason: Deprecated
218226
status: "False"
219227
type: BundleDeprecated
228+
- lastTransitionTime: "2024-06-10T17:50:58Z"
229+
message: 'unpack successful:
230+
observedGeneration: 1
231+
reason: UnpackSuccess
232+
status: "True"
233+
type: Unpacked
220234
installedBundle:
221235
name: openshift-pipelines-operator-rh.v1.14.4
222236
version: 1.14.4
223237
resolvedBundle:
224238
name: openshift-pipelines-operator-rh.v1.14.4
225239
version: 1.14.4
226-
kind: List
227-
metadata:
228-
resourceVersion: ""
229240
----
230241
where:
231242

‎snippets/olmv1-known-issue-service-accounts.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Text snippet included in the following modules:
2+
//
3+
// * modules/olmv1-installing-an-operator.adoc
4+
// * release_notes/ocp-4-17-release-notes.adoc (enterprise-4.17 branch only)
5+
6+
:_mod-docs-content-type: SNIPPET
7+
8+
There is a known issue in {olmv1}. If you do not assign the correct role-based access controls (RBAC) to an extension's service account, {olmv1} gets stuck and reconciliation stops.
9+
10+
Currently, {olmv1} does not have tools to help extension administrators find the correct RBAC for a service account.
11+
12+
Because {olmv1} is a Technology Preview feature and must not be used on production clusters, you can avoid this issue by using the more permissive RBAC included in the documentation.
13+
14+
This RBAC is intended for testing purposes only. Do not use it on production clusters.

0 commit comments

Comments
 (0)