You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<1> Add a `spec.secrets` section and specify any required secrets.
141
+
<2> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
139
142
140
143
. If any Operator or Operand images that are referenced by a subscribed Operator require access to a private registry, you can either provide access to all namespaces in the cluster, or individual target tenant namespaces.
_Pod security admission_ was introduced in {product-title} 4.11 to ensure pod security standards. Catalog sources built using the SQLite-based catalog format and a version of the `opm` CLI tool released before {product-title} 4.11 cannot run under restricted pod security enforcement.
10
+
11
+
In {product-title}{product-version}, namespaces do not have restricted pod security enforcement by default and the default catalog source security mode is set to `legacy`.
12
+
13
+
Default restricted enforcement for all namespaces is planned for inclusion in a future {product-title} release. When restricted enforcement occurs, the security context of the pod specification for catalog source pods must match the restricted pod security standard. If your catalog source image requires a different pod security standard, the pod security admissions label for the namespace must be explicitly set.
14
+
15
+
[NOTE]
16
+
====
17
+
If you do not want to run your SQLite-based catalog source pods as restricted, you do not need to update your catalog source in {product-title} {product-version}.
18
+
19
+
However, it is recommended that you take action now to ensure your catalog sources run under restricted pod security enforcement. If you do not take action to ensure your catalog sources run under restricted pod security enforcement, your catalog sources might not run in future {product-title} releases.
20
+
====
21
+
22
+
As a catalog author, you can enable compatibility with restricted pod security enforcement by completing either of the following actions:
23
+
24
+
* Migrate your catalog to the file-based catalog format.
25
+
* Update your catalog image with a version of the `opm` CLI tool released with {product-title} 4.11 or later.
26
+
27
+
[NOTE]
28
+
====
29
+
The SQLite database catalog format is deprecated, but still supported by Red Hat. In a future release, the SQLite database format will not be supported, and catalogs will need to migrate to the file-based catalog format. As of {product-title} 4.11, the default Red Hat-provided Operator catalog is released in the file-based catalog format. File-based catalogs are compatible with restricted pod security enforcement.
30
+
====
31
+
32
+
If you do not want to update your SQLite database catalog image or migrate your catalog to the file-based catalog format, you can configure your catalog to run with elevated permissions.
@@ -72,8 +74,9 @@ Set the `olm.catalogImageTemplate` annotation to your index image name and use o
72
74
* `grpc` with an `address` field: OLM attempts to contact the gRPC API at the given address. This should not be used in most cases.
73
75
* `configmap`: OLM parses config map data and runs a pod that can serve the gRPC API over it.
74
76
--
75
-
<8> Automatically check for new versions at a given interval to stay up-to-date.
76
-
<9> Last observed state of the catalog connection. For example:
77
+
<8> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
78
+
<9> Automatically check for new versions at a given interval to stay up-to-date.
79
+
<10> Last observed state of the catalog connection. For example:
77
80
+
78
81
--
79
82
* `READY`: A connection is successfully established.
@@ -82,8 +85,8 @@ Set the `olm.catalogImageTemplate` annotation to your index image name and use o
82
85
--
83
86
+
84
87
See link:https://grpc.github.io/grpc/core/md_doc_connectivity-semantics-and-api.html[States of Connectivity] in the gRPC documentation for more details.
85
-
<10> Latest time the container registry storing the catalog image was polled to ensure the image is up-to-date.
86
-
<11> Status information for the catalog's Operator Registry service.
88
+
<11> Latest time the container registry storing the catalog image was polled to ensure the image is up-to-date.
89
+
<12> Status information for the catalog's Operator Registry service.
87
90
====
88
91
89
92
Referencing the `name` of a `CatalogSource` object in a subscription instructs OLM where to search to find a requested Operator:
<1> If you mirrored content to local files before uploading to a registry, remove any backslash (`/`) characters from the `metadata.name` field to avoid an "invalid resource name" error when you create the object.
61
63
<2> If you want the catalog source to be available globally to users in all namespaces, specify the `{namespace}` namespace. Otherwise, you can specify a different namespace for the catalog to be scoped and available only for that namespace.
62
-
<3> Specify your index image.
63
-
<4> Specify your name or an organization name publishing the catalog.
64
-
<5> Catalog sources can automatically check for new versions to keep up to date.
64
+
<3> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
65
+
<4> Specify your index image.
66
+
<5> Specify your name or an organization name publishing the catalog.
67
+
<6> Catalog sources can automatically check for new versions to keep up to date.
<1> If you want the catalog source to be available globally to users in all namespaces, specify the `{namespace}` namespace. Otherwise, you can specify a different namespace for the catalog to be scoped and available only for that namespace.
87
92
<2> Optional: Set the `olm.catalogImageTemplate` annotation to your index image name and use one or more of the Kubernetes cluster version variables as shown when constructing the template for the image tag.
88
-
<3> Specify your index image.
89
-
<4> Specify your name or an organization name publishing the catalog.
90
-
<5> Catalog sources can automatically check for new versions to keep up to date.
93
+
<3> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
94
+
<4> Specify your index image.
95
+
<5> Specify your name or an organization name publishing the catalog.
96
+
<6> Catalog sources can automatically check for new versions to keep up to date.
91
97
endif::[]
92
98
93
99
.. Use the file to create the `CatalogSource` object:
Copy file name to clipboardExpand all lines: modules/olm-dependency-resolution-preferences.adoc
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,10 +22,13 @@ metadata:
22
22
namespace: "operators"
23
23
spec:
24
24
sourceType: grpc
25
+
grpcPodConfig:
26
+
securityContextConfig: <security_mode> <1>
25
27
image: example.com/my/operator-index:v1
26
28
displayName: "My Operators"
27
29
priority: 100
28
30
----
31
+
<1> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
29
32
30
33
A `CatalogSource` object has a `priority` field, which is used by the resolver to know how to prefer options for a dependency.
= Configuring catalogs to run with elevated permissions
8
+
9
+
If you do not want to update your SQLite database catalog image or migrate your catalog to the file-based catalog format, you can perform the following actions to ensure your catalog source runs when the default pod security enforcement changes to restricted:
10
+
11
+
* Manually set the catalog security mode to legacy in your catalog source definition. This action ensures your catalog runs with legacy permissions even if the default catalog security mode changes to restricted.
12
+
* Label the catalog source namespace for baseline or privileged pod security enforcement.
13
+
14
+
[NOTE]
15
+
====
16
+
The SQLite database catalog format is deprecated, but still supported by Red Hat. In a future release, the SQLite database format will not be supported, and catalogs will need to migrate to the file-based catalog format. File-based catalogs are compatible with restricted pod security enforcement.
17
+
====
18
+
19
+
.Prerequisites
20
+
21
+
* SQLite database catalog source
22
+
* Cluster administrator permissions
23
+
* Target namespace that supports running pods with the elevated pod security admission standard of `baseline` or `privileged`
24
+
25
+
.Procedure
26
+
27
+
. Edit the `CatalogSource` definition by setting the `spec.grpcPodConfig.securityContextConfig` label to `legacy`, as shown in the following example:
28
+
+
29
+
.Example `CatalogSource` definition
30
+
[source,yaml]
31
+
----
32
+
apiVersion: operators.coreos.com/v1alpha1
33
+
kind: CatalogSource
34
+
metadata:
35
+
name: my-catsrc
36
+
namespace: my-ns
37
+
spec:
38
+
sourceType: grpc
39
+
grpcPodConfig:
40
+
securityContextConfig: legacy
41
+
image: my-image:latest
42
+
----
43
+
+
44
+
[TIP]
45
+
====
46
+
In {product-title} {product-version}, the `spec.grpcPodConfig.securityContextConfig` field is set to `legacy` by default. In a future release of {product-title}, it is planned that the default setting will change to `restricted`. If your catalog cannot run under restricted enforcement, it is recommended that you manually set this field to `legacy`.
47
+
====
48
+
49
+
. Edit your `<namespace>.yaml` file to add elevated pod security admission standards to your catalog source namespace, as shown in the following example:
<1> Turn off pod security label synchronization by adding the `security.openshift.io/scc.podSecurityLabelSync=false` label to the namespace.
65
+
<2> Apply the pod security admission `pod-security.kubernetes.io/enforce` label. Set the label to `baseline` or `privileged`. Use the `baseline` pod security profile unless other workloads in the namespace require a `privileged` profile.
You can rebuild your SQLite database catalog image with the latest version of the `opm` CLI tool that is released with your version of {product-title}.
10
+
11
+
.Prerequisites
12
+
13
+
* SQLite database catalog source
14
+
* Cluster administrator permissions
15
+
* Latest version of the `opm` CLI tool released with {product-title}{product-version} on workstation
16
+
17
+
.Procedure
18
+
19
+
* Run the following command to rebuild your catalog with a more recent version of the `opm` CLI tool:
<1> Set `image` to the image pull spec you used previously with the `CATALOG_IMG` argument.
88
+
<1> Specify the value of `legacy` or `restricted`. If the field is not set, the default value is `legacy`. In a future {product-title} release, it is planned that the default value will be `restricted`. If your catalog cannot run with `restricted` permissions, it is recommended that you manually set this field to `legacy`.
89
+
<2> Set `image` to the image pull spec you used previously with the `CATALOG_IMG` argument.
0 commit comments