Skip to content

Commit 1485e08

Browse files
authored
Merge pull request #82232 from adellape/osdk_sa
OCPBUGS#33927: Add long-lived token/secret step to OLM policy scoping
2 parents 8ab1bd3 + b8d71a2 commit 1485e08

File tree

1 file changed

+59
-13
lines changed

1 file changed

+59
-13
lines changed

modules/olm-policy-scoping-operator-install.adoc

+59-13
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ Using this example, a cluster administrator can confine a set of Operators to a
1919

2020
. Create a new namespace:
2121
+
22+
.Example command that creates a `Namespace` object
23+
[%collapsible]
24+
====
2225
[source,terminal]
2326
----
2427
$ cat <<EOF | oc create -f -
@@ -28,9 +31,15 @@ metadata:
2831
name: scoped
2932
EOF
3033
----
34+
====
3135
32-
. Allocate permissions that you want the Operator(s) to be confined to. This involves creating a new service account, relevant role(s), and role binding(s).
36+
. Allocate permissions that you want the Operator(s) to be confined to. This involves creating a new service account, relevant role(s), and role binding(s) in the newly created, designated namespace:
37+
38+
.. Create a service account by running the following command:
3339
+
40+
.Example command that creates a `ServiceAccount` object
41+
[%collapsible]
42+
====
3443
[source,terminal]
3544
----
3645
$ cat <<EOF | oc create -f -
@@ -41,9 +50,39 @@ metadata:
4150
namespace: scoped
4251
EOF
4352
----
53+
====
54+
55+
.. Create a secret by running the following command:
56+
+
57+
.Example command that creates a long-lived API token `Secret` object
58+
[%collapsible]
59+
====
60+
[source,terminal]
61+
----
62+
$ cat <<EOF | oc create -f -
63+
apiVersion: v1
64+
kind: Secret
65+
type: kubernetes.io/service-account-token <1>
66+
metadata:
67+
name: scoped
68+
namespace: scoped
69+
annotations:
70+
kubernetes.io/service-account.name: scoped
71+
EOF
72+
----
73+
<1> The secret must be a long-lived API token, which is used by the service account.
74+
====
75+
76+
.. Create a role by running the following command.
4477
+
45-
The following example grants the service account permissions to do anything in the designated namespace for simplicity. In a production environment, you should create a more fine-grained set of permissions:
78+
[WARNING]
79+
====
80+
In this example, the role grants the service account permissions to do anything in the designated namespace for demonostration purposes only. In a production environment, you should create a more fine-grained set of permissions. For more information, see "Fine-grained permissions".
81+
====
4682
+
83+
.Example command that creates `Role` and `RoleBinding` objects
84+
[%collapsible]
85+
====
4786
[source,terminal]
4887
----
4988
$ cat <<EOF | oc create -f -
@@ -72,11 +111,13 @@ subjects:
72111
namespace: scoped
73112
EOF
74113
----
114+
====
75115
76-
. Create an `OperatorGroup` object in the designated namespace. This Operator group targets the designated namespace to ensure that its tenancy is confined to it.
77-
+
78-
In addition, Operator groups allow a user to specify a service account. Specify the service account created in the previous step:
116+
. Create an `OperatorGroup` object in the designated namespace by running the following command. This Operator group targets the designated namespace to ensure that its tenancy is confined to it. In addition, Operator groups allow a user to specify a service account.
79117
+
118+
.Example command that creates an `OperatorGroup` object
119+
[%collapsible]
120+
====
80121
[source,terminal]
81122
----
82123
$ cat <<EOF | oc create -f -
@@ -86,32 +127,37 @@ metadata:
86127
name: scoped
87128
namespace: scoped
88129
spec:
89-
serviceAccountName: scoped
130+
serviceAccountName: scoped <1>
90131
targetNamespaces:
91132
- scoped
92133
EOF
93134
----
94-
+
95-
Any Operator installed in the designated namespace is tied to this Operator group and therefore to the service account specified.
135+
<1> Specify the service account created in the previous step. Any Operator installed in the designated namespace is tied to this Operator group and therefore to the service account specified.
136+
====
96137

97138
. Create a `Subscription` object in the designated namespace to install an Operator:
98139
+
140+
.Example command that creates a `Subscription` object
141+
[%collapsible]
142+
====
99143
[source,terminal]
100144
----
101145
$ cat <<EOF | oc create -f -
102146
apiVersion: operators.coreos.com/v1alpha1
103147
kind: Subscription
104148
metadata:
105-
name: etcd
149+
name: openshift-cert-manager-operator
106150
namespace: scoped
107151
spec:
108-
channel: singlenamespace-alpha
109-
name: etcd
152+
channel: stable-v1
153+
name: openshift-cert-manager-operator
110154
source: <catalog_source_name> <1>
111155
sourceNamespace: <catalog_source_namespace> <2>
112156
EOF
113157
----
114-
<1> Specify a catalog source that already exists in the designated namespace or one that is in the global catalog namespace.
115-
<2> Specify a namespace where the catalog source was created.
158+
<1> Specify a catalog source that already exists in the designated namespace or one that is in the global catalog namespace, for example `redhat-operators`.
159+
<2> Specify a namespace where the catalog source was created, for example `openshift-marketplace` for the `redhat-operators` catalog.
160+
====
116161
+
117162
Any Operator tied to this Operator group is confined to the permissions granted to the specified service account. If the Operator requests permissions that are outside the scope of the service account, the installation fails with relevant errors.
163+

0 commit comments

Comments
 (0)