|
| 1 | +# Derive minimal ServiceAccount required for ClusterExtension Installation and Management |
| 2 | + |
| 3 | +OLM v1 does not have permission to install extensions on a cluster by default. In order to install a [supported bundle](../refs/supported-extensions.md), |
| 4 | +OLM must be provided a ServiceAccount configured with the appropriate permissions. For more information, see the [provided ServiceAccount](./provided-serviceaccount.md) documentation. |
| 5 | + |
| 6 | +This document serves as a guide for how to derive the RBAC necessary to install a bundle. |
| 7 | + |
| 8 | +### Required RBAC |
| 9 | + |
| 10 | +The required permissions for the installation and management of a cluster extension can be determined by examining the contents of its bundle image. |
| 11 | +This bundle image contains all the manifests that make up the extension (e.g. `CustomResourceDefinition`s, `Service`s, `Secret`s, `ConfigMap`s, `Deployment`s etc.) |
| 12 | +as well as a [`ClusterServiceVersion`](https://olm.operatorframework.io/docs/concepts/crds/clusterserviceversion/) (CSV) that describes the extension and its service account's permission requirements. |
| 13 | + |
| 14 | +The service account must have permissions to: |
| 15 | + - create and manage the extension's `CustomResourceDefinition`s |
| 16 | + - create and manage the resources packaged in the bundle |
| 17 | + - grant the extension controller's service account the permissions it requires for its operation |
| 18 | + - create and manage the extension controller's service account |
| 19 | + - create and manage the `Role`s, `RoleBinding`s, `ClusterRole`s, and `ClusterRoleBinding`s associated with the extension controller's service account |
| 20 | + - create and manage the extension controller's deployment |
| 21 | + |
| 22 | +Additionally, for clusters that use the [OwnerReferencesPermissionEnforcement](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement) admission plug-in, the service account must also have permissions to: |
| 23 | + - update finalizers on the ClusterExtension to be able to set blockOwnerDeletion and ownerReferences |
| 24 | + |
| 25 | +It is good security practice to follow the [principle of least privilege(https://en.wikipedia.org/wiki/Principle_of_least_privilege)], and scope permissions to specific resource names, wherever possible. |
| 26 | +Keep in mind, that it is not possible to scope `create`, `list`, and `watch` permissions to specific resource names. |
| 27 | + |
| 28 | +Depending on the scope, each permission will need to be added to either a `ClusterRole` or a `Role` and then bound to the service account with a `ClusterRoleBinding` or a `RoleBinding`. |
| 29 | + |
| 30 | +### Example |
| 31 | + |
| 32 | +The following example illustrates the process of deriving the minimal RBAC required to install the [ArgoCD Operator](https://operatorhub.io/operator/argocd-operator) [v0.6.0](https://operatorhub.io/operator/argocd-operator/alpha/argocd-operator.v0.6.0) provided by [OperatorHub.io](https://operatorhub.io/). |
| 33 | +The final permission set can be found in the [ClusterExtension sample manifest](../../config/samples/olm_v1alpha1_clusterextension.yaml) in the [samples](../../config/samples/olm_v1alpha1_clusterextension.yaml) directory. |
| 34 | + |
| 35 | +The bundle includes the following manifests, which can be found [here](https://github.com/argoproj-labs/argocd-operator/tree/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0): |
| 36 | + |
| 37 | +* `ClusterServiceVersion`: |
| 38 | + - [argocd-operator.v0.6.0.clusterserviceversion.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml) |
| 39 | +* `CustomResourceDefinition`s: |
| 40 | + - [argoproj.io_applicationsets.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argoproj.io_applicationsets.yaml) |
| 41 | + - [argoproj.io_applications.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argoproj.io_applications.yaml) |
| 42 | + - [argoproj.io_appprojects.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argoproj.io_appprojects.yaml) |
| 43 | + - [argoproj.io_argocdexports.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argoproj.io_argocdexports.yaml) |
| 44 | + - [argoproj.io_argocds.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argoproj.io_argocds.yaml) |
| 45 | +* Additional resources: |
| 46 | + - [argocd-operator-controller-manager-metrics-service_v1_service.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator-controller-manager-metrics-service_v1_service.yaml) |
| 47 | + - [argocd-operator-manager-config_v1_configmap.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator-manager-config_v1_configmap.yaml) |
| 48 | + - [argocd-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml) |
| 49 | + |
| 50 | +The `ClusterServiceVersion` defines a single `Deployment` in `spec.install.deployments` named `argocd-operator-controller-manager` with a `ServiceAccount` of the same name. |
| 51 | +It declares the following cluster-scoped permissions in `spec.install.clusterPermissions`, and its namespace-scoped permissions in `spec.install.permissions`. |
| 52 | + |
| 53 | +#### Derive permissions for the installer service account `ClusterRole` |
| 54 | + |
| 55 | +##### Step 1. RBAC creation and management permissions |
| 56 | + |
| 57 | +The installer service account must create and manage the `ClusterRole`s and `ClusterRoleBinding`s for the extension controller(s). |
| 58 | +Therefore, it must have the following permissions: |
| 59 | + |
| 60 | +```yaml |
| 61 | +- apiGroups: [rbac.authorization.k8s.io] |
| 62 | + resources: [clusterroles] |
| 63 | + verbs: [create, list, watch] |
| 64 | +- apiGroups: [rbac.authorization.k8s.io] |
| 65 | + resources: [clusterroles] |
| 66 | + verbs: [get, update, patch, delete] |
| 67 | + resourceNames: [<controller cluster role name 1>, ...] |
| 68 | +- apiGroups: [rbac.authorization.k8s.io] |
| 69 | + resources: [clusterrolebindings] |
| 70 | + verbs: [create, list, watch] |
| 71 | +- apiGroups: [rbac.authorization.k8s.io] |
| 72 | + resources: [clusterrolebindings] |
| 73 | + verbs: [get, update, patch, delete] |
| 74 | + resourceNames: [<controller cluster rolebinding name 1>, ...] |
| 75 | +``` |
| 76 | +
|
| 77 | +Note: The `resourceNames` field should be populated with the names of the `ClusterRole`s and `ClusterRoleBinding`s created by OLM v1. |
| 78 | +These names are generated with the following format: `<packageName>.<hash>`. Since it is not a trivial task |
| 79 | +to generate these names ahead of time, it is recommended to use a wildcard `*` in the `resourceNames` field for the installation. |
| 80 | +Then, update the `resourceNames` fields by inspecting the cluster for the generated resource names. For instance, for `ClusterRole`s: |
| 81 | + |
| 82 | +```terminal |
| 83 | +kubectl get clusterroles | grep argocd |
| 84 | +``` |
| 85 | + |
| 86 | +Example output: |
| 87 | + |
| 88 | +```terminal |
| 89 | +argocd-installer-clusterrole 2024-09-30T08:02:09Z |
| 90 | +argocd-installer-rbac-clusterrole 2024-09-30T08:02:09Z |
| 91 | +argocd-operator-metrics-reader 2024-09-30T08:02:12Z |
| 92 | +# The following are the generated ClusterRoles |
| 93 | +argocd-operator.v0-1dhiybrldl1gyksid1dk2dqjsc72psdybc7iyvse5gpx 2024-09-30T08:02:12Z |
| 94 | +argocd-operator.v0-22gmilmgp91wu25is5i2ec598hni8owq3l71bbkl7iz3 2024-09-30T08:02:12Z |
| 95 | +``` |
| 96 | + |
| 97 | +The same can be done for `ClusterRoleBindings`. |
| 98 | + |
| 99 | +##### Step 2. `CustomResourceDefinition` permissions |
| 100 | + |
| 101 | +The installer service account must be able to create and manage the `CustomResourceDefinition`s for the extension, as well |
| 102 | +as grant the extension controller's service account the permissions it needs to manage its CRDs. |
| 103 | + |
| 104 | +```yaml |
| 105 | +- apiGroups: [apiextensions.k8s.io] |
| 106 | + resources: [customresourcedefinitions] |
| 107 | + verbs: [create, list, watch] |
| 108 | +- apiGroups: [apiextensions.k8s.io] |
| 109 | + resources: [customresourcedefinitions] |
| 110 | + verbs: [get, update, patch, delete] |
| 111 | + # Scoped to the CRDs in the bundle |
| 112 | + resourceNames: [applications.argoproj.io, appprojects.argoproj.io, argocds.argoproj.io, argocdexports.argoproj.io, applicationsets.argoproj.io] |
| 113 | +``` |
| 114 | + |
| 115 | +##### Step 3. `OwnerReferencesPermissionEnforcement` permissions |
| 116 | + |
| 117 | +For clusters that use `OwnerReferencesPermissionEnforcement`, the installer service account must be able to update finalizers on the ClusterExtension to be able to set blockOwnerDeletion and ownerReferences for clusters that use `OwnerReferencesPermissionEnforcement`. |
| 118 | +This is only a requirement for clusters that use the [OwnerReferencesPermissionEnforcement](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement) admission plug-in. |
| 119 | + |
| 120 | +```yaml |
| 121 | +- apiGroups: [olm.operatorframework.io] |
| 122 | + resources: [clusterextensions/finalizers] |
| 123 | + verbs: [update] |
| 124 | + # Scoped to the name of the ClusterExtension |
| 125 | + resourceNames: [argocd-operator.v0.6.0] |
| 126 | +``` |
| 127 | + |
| 128 | +##### Step 4. Bundled cluster-scoped resource permissions |
| 129 | + |
| 130 | +Permissions must be added for the creation and management of any cluster-scoped resources included in the bundle. |
| 131 | +In this example, the ArgoCD bundle contains a `ClusterRole` called `argocd-operator-metrics-reader`. Given that |
| 132 | +`ClusterRole` permissions have already been created in [Step 1](#step-1-rbac-creation-and-management-permissions), it |
| 133 | +is sufficient to add the `argocd-operator-metrics-reader`resource name to the `resourceName` list of the pre-existing rule: |
| 134 | + |
| 135 | +```yaml |
| 136 | +- apiGroups: [rbac.authorization.k8s.io] |
| 137 | + resources: [clusterroles] |
| 138 | + verbs: [get, update, patch, delete] |
| 139 | + resourceNames: [<controller cluster role name 1>, ..., argocd-operator-metrics-reader] |
| 140 | +``` |
| 141 | + |
| 142 | +##### Step 5. Operator permissions declared in the ClusterServiceVersion |
| 143 | + |
| 144 | +Include all permissions defined in the `.spec.install.permissions` ([reference](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml#L1091)) and `.spec.install.clusterPermissions` ([reference](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml#L872)) stanzas in the bundle's `ClusterServiceVersion`. |
| 145 | +These permissions are required by the extension controller, and therefore the installer service account must be able to grant them. |
| 146 | + |
| 147 | +Note: there may be overlap between the rules defined in each stanza. Overlapping rules needn't be added twice. |
| 148 | + |
| 149 | +```yaml |
| 150 | +# from .spec.install.clusterPermissions |
| 151 | +- apiGroups: [""] |
| 152 | + resources: ["configmaps", "endpoints", "events", "namespaces", "persistentvolumeclaims", "pods", "secrets", "serviceaccounts", "services", "services/finalizers"] |
| 153 | + verbs: ["*"] |
| 154 | +- apiGroups: [""] |
| 155 | + resources: ["pods", "pods/log"] |
| 156 | + verbs: ["get"] |
| 157 | +- apiGroups: ["apps"] |
| 158 | + resources: ["daemonsets", "deployments", "replicasets", "statefulsets"] |
| 159 | + verbs: ["*"] |
| 160 | +- apiGroups: ["apps"] |
| 161 | + resourceNames: ["argocd-operator"] |
| 162 | + resources: ["deployments/finalizers"] |
| 163 | + verbs: ["update"] |
| 164 | +- apiGroups: ["apps.openshift.io"] |
| 165 | + resources: ["deploymentconfigs"] |
| 166 | + verbs: ["*"] |
| 167 | +- apiGroups: ["argoproj.io"] |
| 168 | + resources: ["applications", "appprojects"] |
| 169 | + verbs: ["*"] |
| 170 | +- apiGroups: ["argoproj.io"] |
| 171 | + resources: ["argocdexports", "argocdexports/finalizers", "argocdexports/status"] |
| 172 | + verbs: ["*"] |
| 173 | +- apiGroups: ["argoproj.io"] |
| 174 | + resources: ["argocds", "argocds/finalizers", "argocds/status"] |
| 175 | + verbs: ["*"] |
| 176 | +- apiGroups: ["autoscaling"] |
| 177 | + resources: ["horizontalpodautoscalers"] |
| 178 | + verbs: ["*"] |
| 179 | +- apiGroups: ["batch"] |
| 180 | + resources: ["cronjobs", "jobs"] |
| 181 | + verbs: ["*"] |
| 182 | +- apiGroups: ["config.openshift.io"] |
| 183 | + resources: ["clusterversions"] |
| 184 | + verbs: ["get", "list", "watch"] |
| 185 | +- apiGroups: ["monitoring.coreos.com"] |
| 186 | + resources: ["prometheuses", "servicemonitors"] |
| 187 | + verbs: ["*"] |
| 188 | +- apiGroups: ["networking.k8s.io"] |
| 189 | + resources: ["ingresses"] |
| 190 | + verbs: ["*"] |
| 191 | +- apiGroups: ["oauth.openshift.io"] |
| 192 | + resources: ["oauthclients"] |
| 193 | + verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] |
| 194 | +- apiGroups: ["rbac.authorization.k8s.io"] |
| 195 | + resources: ["*"] |
| 196 | + verbs: ["*"] |
| 197 | +- apiGroups: ["rbac.authorization.k8s.io"] |
| 198 | + resources: ["clusterrolebindings", "clusterroles"] |
| 199 | + verbs: ["*"] |
| 200 | +- apiGroups: ["route.openshift.io"] |
| 201 | + resources: ["routes", "routes/custom-host"] |
| 202 | + verbs: ["*"] |
| 203 | +- apiGroups: ["template.openshift.io"] |
| 204 | + resources: ["templateconfigs", "templateinstances", "templates"] |
| 205 | + verbs: ["*"] |
| 206 | +- apiGroups: ["authentication.k8s.io"] |
| 207 | + resources: ["tokenreviews"] |
| 208 | + verbs: ["create"] |
| 209 | +- apiGroups: ["authorization.k8s.io"] |
| 210 | + resources: ["subjectaccessreviews"] |
| 211 | + verbs: ["create"] |
| 212 | +
|
| 213 | +# copied from .spec.install.permissions |
| 214 | +- apiGroups: ["coordination.k8s.io"] |
| 215 | + resources: ["leases"] |
| 216 | + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] |
| 217 | +# overlapping permissions: |
| 218 | +# - apiGroups: [""] |
| 219 | +# resources: ["configmaps"] |
| 220 | +# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] |
| 221 | +# - apiGroups: [""] |
| 222 | +# resources: ["events"] |
| 223 | +# verbs: ["create", "patch"] |
| 224 | +``` |
| 225 | + |
| 226 | +#### Derive permissions for the installer service account `Role` |
| 227 | + |
| 228 | +The following steps detail how to define the namespace-scoped permissions needed by the installer service account's `Role`. |
| 229 | +The installer service account must create and manage the `RoleBinding`s for the extension controller(s). |
| 230 | + |
| 231 | +##### Step 1. `Deployment` permissions |
| 232 | + |
| 233 | +The installer service account must be able to create and manage the `Deployment`s for the extension controller(s). |
| 234 | +The `Deployment` name(s) can be found in the `ClusterServiceVersion` resource packed in the bundle under `.spec.install.deployments` ([reference](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml#L1029)). |
| 235 | +This example's `ClusterServiceVersion` can be found [here](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml). |
| 236 | + |
| 237 | +```yaml |
| 238 | +- apiGroups: [apps] |
| 239 | + resources: [deployments] |
| 240 | + verbs: [create] |
| 241 | +- apiGroups: [apps] |
| 242 | + resources: [deployments] |
| 243 | + verbs: [get, list, watch, update, patch, delete] |
| 244 | + # scoped to the extension controller deployment name |
| 245 | + resourceNames: [argocd-operator-controller-manager] |
| 246 | +``` |
| 247 | + |
| 248 | +##### Step 2: `ServiceAccount` permissions |
| 249 | + |
| 250 | +The installer service account must be able to create and manage the `ServiceAccount`(s) for the extension controller(s). |
| 251 | +The `ServiceAccount` name(s) can be found in deployment template in the `ClusterServiceVersion` resource packed in the bundle under `.spec.install.deployments`. |
| 252 | +This example's `ClusterServiceVersion` can be found [here](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator.v0.6.0.clusterserviceversion.yaml). |
| 253 | + |
| 254 | +```yaml |
| 255 | +- apiGroups: [""] |
| 256 | + resources: [serviceaccounts] |
| 257 | + verbs: [create, list, watch] |
| 258 | +- apiGroups: [""] |
| 259 | + resources: [serviceaccounts] |
| 260 | + verbs: [get, update, patch, delete] |
| 261 | + # scoped to the extension controller's deployment service account |
| 262 | + resourceNames: [argocd-operator-controller-manager] |
| 263 | +``` |
| 264 | + |
| 265 | +##### Step 3. Bundled namespace-scoped resource permissions |
| 266 | + |
| 267 | +The installer service account must also create and manage other namespace-scoped resources included in the bundle. |
| 268 | +In this example, the bundle also includes two additional namespace-scoped resources: |
| 269 | + * the [argocd-operator-controller-manager-metrics-service](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator-controller-manager-metrics-service_v1_service.yaml) `Service`, and |
| 270 | + * the [argocd-operator-manager-config](https://github.com/argoproj-labs/argocd-operator/blob/da6b8a7e68f71920de9545152714b9066990fc4b/deploy/olm-catalog/argocd-operator/0.6.0/argocd-operator-manager-config_v1_configmap.yaml) `ConfigMap` |
| 271 | + |
| 272 | +Therefore, the following permissions must be given to the installer service account: |
| 273 | + |
| 274 | +```yaml |
| 275 | +- apiGroups: [""] |
| 276 | + resources: [services] |
| 277 | + verbs: [create] |
| 278 | +- apiGroups: [""] |
| 279 | + resources: [services] |
| 280 | + verbs: [get, list, watch, update, patch, delete] |
| 281 | + # scoped to the service name |
| 282 | + resourceNames: [argocd-operator-controller-manager-metrics-service] |
| 283 | +- apiGroups: [""] |
| 284 | + resources: [configmaps] |
| 285 | + verbs: [create] |
| 286 | +- apiGroups: [""] |
| 287 | + resources: [configmaps] |
| 288 | + verbs: [get, list, watch, update, patch, delete] |
| 289 | + # scoped to the configmap name |
| 290 | + resourceNames: [argocd-operator-manager-config] |
| 291 | +``` |
| 292 | + |
| 293 | +#### Putting it all together |
| 294 | + |
| 295 | +Once the installer service account required cluster-scoped and namespace-scoped permissions have been collected: |
| 296 | +1. Create the installation namespace |
| 297 | +2. Create the installer `ServiceAccount` |
| 298 | +3. Create the installer `ClusterRole` |
| 299 | +4. Create the `ClusterRoleBinding` between the installer service account and its cluster role |
| 300 | +5. Create the installer `Role` |
| 301 | +6. Create the `RoleBinding` between the installer service account and its role |
| 302 | +7. Create the `ClusterExtension` |
| 303 | + |
| 304 | +A manifest with the full set of resources can be found [here](../../config/samples/olm_v1alpha1_clusterextension.yaml). |
| 305 | + |
| 306 | +### Alternatives |
| 307 | + |
| 308 | +We understand that manually determining the minimum RBAC required for installation/upgrade of a `ClusterExtension` quite complex and protracted. |
| 309 | +In the near future, OLM v1 will provide tools and automation in order to simplify this process while maintaining our security posture. |
| 310 | +For users wishing to test out OLM v1 in a non-production settings, we offer the following alternatives: |
| 311 | + |
| 312 | +#### Give the installer service account admin privileges |
| 313 | + |
| 314 | +The `cluster-admin` `ClusterRole` can be bound to the installer service account giving it full permissions to the cluster. |
| 315 | +While this obviates the need to determine the minimal RBAC required for installation, it is also dangerous. It is highly recommended |
| 316 | +that this alternative only be used in test clusters. Never in production. |
| 317 | + |
| 318 | +Below is an example ClusterRoleBinding using the cluster-admin ClusterRole: |
| 319 | + |
| 320 | +```terminal |
| 321 | +# Create ClusterRole |
| 322 | +kubectl apply -f - <<EOF |
| 323 | +apiVersion: rbac.authorization.k8s.io/v1 |
| 324 | +kind: ClusterRoleBinding |
| 325 | +metadata: |
| 326 | + name: my-cluster-extension-installer-role-binding |
| 327 | +roleRef: |
| 328 | + apiGroup: rbac.authorization.k8s.io |
| 329 | + kind: ClusterRole |
| 330 | + name: cluster-admin |
| 331 | +subjects: |
| 332 | +- kind: ServiceAccount |
| 333 | + name: my-cluster-extension-service-account |
| 334 | + namespace: my-cluster-extension-namespace |
| 335 | +EOF |
| 336 | +``` |
| 337 | + |
| 338 | +Use the below on a Kind cluster to assign cluster-admin privileges to your cluster extension |
| 339 | + |
| 340 | +```sh |
| 341 | +kubectl create clusterrolebinding my-cluster-extension-installer-role-binding \ |
| 342 | + --clusterrole=cluster-admin \ |
| 343 | + --serviceaccount=my-cluster-extension-namespace:my-cluster-installer-service-account |
| 344 | +``` |
| 345 | + |
| 346 | +#### hack/tools/catalog |
| 347 | + |
| 348 | +In the spirit of making this process more tenable until the proper tools are in place, the scripts |
| 349 | +in [hack/tools/catalogs](../../hack/tools/catalogs) were created to help the user navigate and search catalogs as well |
| 350 | +as to generate the minimal RBAC requirements. These tools are offered as is, with no guarantees on their correctness, |
| 351 | +support, or maintenance. For more information, see [Hack Catalog Tools](https://github.com/operator-framework/operator-controller/blob/main/hack/tools/catalogs/README.md). |
0 commit comments