|
1 | 1 | # Derive minimal ServiceAccount required for ClusterExtension Installation and Management
|
2 | 2 |
|
3 |
| -OLM v1 does not have permission to install extensions on a cluster by default. In order to install a [supported bundle](../project/olmv1_limitations.md), |
| 3 | +OLM v1 does not have permission to install extensions on a cluster by default. In order to install a [supported bundle](../project/olmv1_limitations.md), |
4 | 4 | OLM must be provided a ServiceAccount configured with the appropriate permissions.
|
5 | 5 |
|
6 | 6 | This document serves as a guide for how to derive the RBAC necessary to install a bundle.
|
@@ -31,7 +31,7 @@ Depending on the scope, each permission will need to be added to either a `Clust
|
31 | 31 | ### Example
|
32 | 32 |
|
33 | 33 | The following example illustrates the process of deriving the minimal RBAC required to install the [ArgoCD Operator](https://operatorhub.io/operator/argocd-operator) [v0.6.0](https://operatorhub.io/operator/argocd-operator/alpha/argocd-operator.v0.6.0) provided by [OperatorHub.io](https://operatorhub.io/).
|
34 |
| -The final permission set can be found in the [ClusterExtension sample manifest](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1alpha1_clusterextension.yaml) in the [samples](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1alpha1_clusterextension.yaml) directory. |
| 34 | +The final permission set can be found in the [ClusterExtension sample manifest](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1_clusterextension.yaml) in the [samples](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1_clusterextension.yaml) directory. |
35 | 35 |
|
36 | 36 | The bundle includes the following manifests, which can be found [here](https://github.com/argoproj-labs/argocd-operator/tree/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0):
|
37 | 37 |
|
@@ -99,7 +99,7 @@ The same can be done for `ClusterRoleBindings`.
|
99 | 99 |
|
100 | 100 | ##### Step 2. `CustomResourceDefinition` permissions
|
101 | 101 |
|
102 |
| -The installer service account must be able to create and manage the `CustomResourceDefinition`s for the extension, as well |
| 102 | +The installer service account must be able to create and manage the `CustomResourceDefinition`s for the extension, as well |
103 | 103 | as grant the extension controller's service account the permissions it needs to manage its CRDs.
|
104 | 104 |
|
105 | 105 | ```yaml
|
@@ -302,7 +302,7 @@ Once the installer service account required cluster-scoped and namespace-scoped
|
302 | 302 | 6. Create the `RoleBinding` between the installer service account and its role
|
303 | 303 | 7. Create the `ClusterExtension`
|
304 | 304 |
|
305 |
| -A manifest with the full set of resources can be found [here](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1alpha1_clusterextension.yaml). |
| 305 | +A manifest with the full set of resources can be found [here](https://github.com/operator-framework/operator-controller/blob/main/config/samples/olm_v1_clusterextension.yaml). |
306 | 306 |
|
307 | 307 | ### Alternatives
|
308 | 308 |
|
@@ -348,5 +348,5 @@ kubectl create clusterrolebinding my-cluster-extension-installer-role-binding \
|
348 | 348 |
|
349 | 349 | In the spirit of making this process more tenable until the proper tools are in place, the scripts
|
350 | 350 | in [hack/tools/catalogs](https://github.com/operator-framework/operator-controller/blob/main/hack/tools/catalogs) were created to help the user navigate and search catalogs as well
|
351 |
| -as to generate the minimal RBAC requirements. These tools are offered as is, with no guarantees on their correctness, |
| 351 | +as to generate the minimal RBAC requirements. These tools are offered as is, with no guarantees on their correctness, |
352 | 352 | support, or maintenance. For more information, see [Hack Catalog Tools](https://github.com/operator-framework/operator-controller/blob/main/hack/tools/catalogs/README.md).
|
0 commit comments