Skip to content

Commit 98c3b3b

Browse files
committed
Cluster extension everywhere we had operator ref
Signed-off-by: Brett Tofel <[email protected]>
1 parent 3ff403a commit 98c3b3b

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

docs/concepts/how-to-grant-api-access.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11

22
# Granting Users Access to API Resources in OLM
33

4-
When operators or cluster extensions are managed via OLM, they often provide Custom Resource Definitions (CRDs) that expose new API resources. Typically, cluster administrators hold full management access to these resources by default, whereas non-administrative users may lack sufficient permissions. Such users often need designated permissions to create, view, or edit these Custom Resources.
4+
When cluster extensions are managed via OLM, they often provide Custom Resource Definitions (CRDs) that expose new API resources. Typically, cluster administrators hold full management access to these resources by default, whereas non-administrative users may lack sufficient permissions. Such users often need designated permissions to create, view, or edit these Custom Resources.
55

66
OLM does **not** automatically configure or manage RBAC for users to interact with the APIs provided by installed packages. It is recommended that cluster administrators manage RBAC (Role-Based Access Control) to grant appropriate permissions to non-administrative users. This guide outlines the steps to manually configure RBAC, with a focus on creating ClusterRoles and binding them to specific users or groups.
77

88
---
99

1010
## 1. Finding API Groups and Resources Provided by a ClusterExtension
1111

12-
To create appropriate RBAC policies, you need to know which API groups and resources are exposed by the installed operator. You can inspect the installed CRDs and resources by running:
12+
To create appropriate RBAC policies, you need to know which API groups and resources are exposed by the installed cluster extension. You can inspect the installed CRDs and resources by running:
1313

1414
```bash
1515
kubectl get crds
@@ -31,7 +31,7 @@ kubectl get crds -l 'olm.operatorframework.io/owner-kind=ClusterExtension,olm.op
3131

3232
## 2. Creating Default ClusterRoles for API/CRD Access
3333

34-
Administrators can define standard roles to control access to the API resources provided by installed operators. If the operator does not provide default roles, you can create them yourself.
34+
Administrators can define standard roles to control access to the API resources provided by installed cluster extensions. If the cluster extension does not provide default roles, you can create them yourself.
3535

3636
### Default Roles
3737

@@ -95,7 +95,7 @@ rules:
9595
- '*'
9696
```
9797
**Note**: The `'*'` in verbs allows all actions on the specified resources, including RBAC management actions such as assigning roles and creating role bindings.
98-
In each case, replace `<your-api-group>` and `<your-custom-resources>` with the actual API group and resource names provided by the installed operator.
98+
In each case, replace `<your-api-group>` and `<your-custom-resources>` with the actual API group and resource names provided by the installed cluster extension.
9999

100100
---
101101

@@ -178,4 +178,4 @@ You can create similar ClusterRoles for `edit` and `admin` with appropriate verb
178178
## Notes
179179

180180
- OLM does not handle RBAC for users interacting with CRDs, so it's up to cluster administrators to configure these settings.
181-
- It is not recommended for operator bundles to include RBAC policies granting access via bindings or role aggregation to the operator's APIs because cluster administrators should maintain control over the permissions in their clusters. Operator packages can certainly add Roles that facilitate the functioning of the operator.
181+
- It is not recommended for cluster extension bundles to include RBAC policies granting access via bindings or role aggregation to the cluster extension's APIs because cluster administrators should maintain control over the permissions in their clusters. Cluster extension packages can certainly add Roles that facilitate the functioning of the Cluster Exension.

0 commit comments

Comments
 (0)