Update OLM package for 4.4.0

The only significant change is replacing the wildcard RBAC verb with
all the permissions of roles created by the Operator during RBAC
reconciliation.

See: 78b3975

Author: cbandy

installers/olm/Makefile

@@ -1,4 +1,5 @@
 .DEFAULT_GOAL := help
+.SUFFIXES:
 
 CCP_IMAGE_PREFIX ?= registry.developers.crunchydata.com/crunchydata
 CCP_IMAGE_TAG ?= $(PGO_BASEOS)-$(CCP_PG_FULLVERSION)-$(PGO_VERSION)

installers/olm/install.sh

@@ -117,7 +117,7 @@ registry() (
 	kc create --filename=- <<< "$deployment_json"
 	kc expose deploy "$registry_name" --port=50051
 
-	if ! kc wait --for='condition=available' --timeout='30s' deploy "$registry_name"; then
+	if ! kc wait --for='condition=available' --timeout='90s' deploy "$registry_name"; then
 		kc logs --selector="name=$registry_name" --tail='-1' --previous ||
 		kc logs --selector="name=$registry_name" --tail='-1'
 		exit 1

installers/olm/openshift.description.md

@@ -124,7 +124,7 @@ Create an external service or forward a port locally.
 
 ```
 oc -n "$PGO_OPERATOR_NAMESPACE" expose deployment postgres-operator
-oc -n "$PGO_OPERATOR_NAMESPACE" create route postgres-operator --service=postgres-operator
+oc -n "$PGO_OPERATOR_NAMESPACE" create route passthrough postgres-operator --service=postgres-operator
 
 export PGO_APISERVER_URL="https://$(oc -n "$PGO_OPERATOR_NAMESPACE" get route postgres-operator -o jsonpath="{.spec.host}")"
 ```

installers/olm/postgresoperator.csv.yaml

@@ -66,6 +66,7 @@ spec:
       clusterPermissions:
         - serviceAccountName: postgres-operator
           rules:
+            # dynamic namespace mode
             - apiGroups:
                 - ''
               resources:
@@ -77,6 +78,7 @@ spec:
                 - create
                 - update
                 - delete
+            # reconcile rbac
             - apiGroups:
                 - ''
               resources:
@@ -90,23 +92,75 @@ spec:
                 - rbac.authorization.k8s.io
               resources:
                 - roles
+                - rolebindings
               verbs:
-                - '*' # BUG(cbandy): spec.install.spec.clusterPermissions.rules.verbs in body should be one of [* assign get list watch create update patch put post delete deletecollection initialize use]
-                #- get
-                #- create
-                #- update
-                #- delete
-                #- bind
-                #- escalate
+                - get
+                - create
+                - update
+                - delete
             - apiGroups:
-                - rbac.authorization.k8s.io
+                - ''
               resources:
-                - rolebindings
+                - configmaps
+                - endpoints
+                - pods
+                - pods/exec
+                - pods/log
+                - replicasets
+                - secrets
+                - services
+                - persistentvolumeclaims
               verbs:
                 - get
+                - list
+                - watch
+                - create
+                - patch
+                - update
+                - delete
+                - deletecollection
+            - apiGroups:
+                - apps
+              resources:
+                - deployments
+              verbs:
+                - get
+                - list
+                - watch
+                - create
+                - patch
+                - update
+                - delete
+                - deletecollection
+            - apiGroups:
+                - batch
+              resources:
+                - jobs
+              verbs:
+                - get
+                - list
+                - watch
+                - create
+                - patch
+                - update
+                - delete
+                - deletecollection
+            - apiGroups:
+                - crunchydata.com
+              resources:
+                - pgclusters
+                - pgpolicies
+                - pgreplicas
+                - pgtasks
+              verbs:
+                - get
+                - list
+                - watch
                 - create
+                - patch
                 - update
                 - delete
+                - deletecollection
 
       permissions:
         - serviceAccountName: postgres-operator