Skip to content
14 changes: 8 additions & 6 deletions modules/olmv1-creating-a-cluster-role.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -66,9 +66,9 @@ rules:
- update
# Scoped to the name of the ClusterExtension
resourceNames:
- <metadata_name> # <1>
- <metadata_name>
----
<1> Specifies the value from the `metadata.name` field from the custom resource (CR) of the extension.
The `<metadata_name>` specifies the value from the `metadata.name` field from the custom resource (CR) of the extension.

. Search for the `clusterrole` and `clusterrolebindings` values in the `rules.resources` field in the extension's CSV file.

Expand All @@ -89,7 +89,7 @@ rules:
resources:
- clusterroles
verbs:
- create # <1>
- create
- list
- watch
- apiGroups:
Expand All @@ -101,7 +101,7 @@ rules:
- update
- patch
- delete
resourceNames: # <2>
resourceNames:
- "*"
- apiGroups:
- rbac.authorization.k8s.io
Expand All @@ -124,8 +124,10 @@ rules:
- "*"
# ...
----
<1> You cannot scope `create`, `list`, and `watch` permissions to specific resource names (the `resourceNames` field). You must scope these permissions to their resources (the `resources` field).
<2> Some resource names are generated by using the following format: `<package_name>.<hash>`. After you install the extension, look up the resource names for the cluster roles and cluster role bindings for the controller of the extension. Replace the wildcard characters in this example with the generated names and follow the principle of least privilege.
where:

`create`, `list`, and `watch`:: Specifies permissions that cannot be scoped to specific resource names (the `resourceNames` field). You must scope these permissions to their resources (the `resources` field).
`resourceNames`:: Specifies some resource names that are generated by using the following format: `<package_name>.<hash>`. After you install the extension, look up the resource names for the cluster roles and cluster role bindings for the controller of the extension. Replace the wildcard characters in this example with the generated names and follow the principle of least privilege.

. Search for the `customresourcedefinitions` value in the `rules.resources` field in the extension's CSV file.

Expand Down
22 changes: 12 additions & 10 deletions modules/olmv1-installing-an-operator.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -26,23 +26,25 @@ apiVersion: olm.operatorframework.io/v1
metadata:
name: <clusterextension_name>
spec:
namespace: <installed_namespace> <1>
namespace: <installed_namespace>
serviceAccount:
name: <service_account_installer_name> <2>
name: <service_account_installer_name>
source:
sourceType: Catalog
catalog:
packageName: <package_name>
channels:
- <channel_name> <3>
version: <version_or_version_range> <4>
upgradeConstraintPolicy: CatalogProvided <5>
- <channel_name>
version: <version_or_version_range>
upgradeConstraintPolicy: CatalogProvided
----
<1> Specifies the namespace where you want the bundle installed, such as `pipelines` or `my-extension`. Extensions are still cluster-scoped and might contain resources that are installed in different namespaces.
<2> Specifies the name of the service account you created to install, update, and manage your extension.
<3> Optional: Specifies channel names as an array, such as `pipelines-1.14` or `latest`.
<4> Optional: Specifies the version or version range, such as `1.14.0`, `1.14.x`, or `>=1.16`, of the package you want to install or update. For more information, see "Example custom resources (CRs) that specify a target version" and "Support for version ranges".
<5> Optional: Specifies the upgrade constraint policy. If unspecified, the default setting is `CatalogProvided`. The `CatalogProvided` setting only updates if the new version satisfies the upgrade constraints set by the package author. To force an update or rollback, set the field to `SelfCertified`. For more information, see "Forcing an update or rollback".
where:

`<installed_namespace>`:: Specifies the namespace where you want the bundle installed, such as `pipelines` or `my-extension`. Extensions are still cluster-scoped and might contain resources that are installed in different namespaces.
`<service_account_installer_name>`:: Specifies the name of the service account you created to install, update, and manage your extension.
`<channel_name>`:: Optional: Specifies channel names as an array, such as `pipelines-1.14` or `latest`.
`<version_or_version_range>`:: Optional: Specifies the version or version range, such as `1.14.0`, `1.14.x`, or `>=1.16`, of the package you want to install or update. For more information, see "Example custom resources (CRs) that specify a target version" and "Support for version ranges".
`CatalogProvided`:: Optional: Specifies the upgrade constraint policy. If unspecified, the default setting is `CatalogProvided`. The `CatalogProvided` setting only updates if the new version satisfies the upgrade constraints set by the package author. To force an update or rollback, set the field to `SelfCertified`. For more information, see "Forcing an update or rollback".

.Example `pipelines-operator.yaml` CR
[source,yaml]
Expand Down
12 changes: 6 additions & 6 deletions modules/olmv1-updating-an-operator.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -199,9 +199,9 @@ spec:
sourceType: Catalog
catalog:
packageName: openshift-pipelines-operator-rh
version: "1.15.0" <1>
version: "1.15.0"
----
<1> Update the version from `1.14.x` to `1.15.0`
Update the version from `1.14.x` to `1.15.0`.

** If you want to define a range of acceptable update versions, edit your CR similar to the following example:
+
Expand All @@ -220,9 +220,9 @@ spec:
sourceType: Catalog
catalog:
packageName: openshift-pipelines-operator-rh
version: ">1.15, <1.17" <1>
version: ">1.15, <1.17"
----
<1> Specifies that the desired version range is greater than version `1.15` and less than `1.17`. For more information, see "Support for version ranges" and "Version comparison strings".
The version range specifies that the desired version is greater than version `1.15` and less than `1.17`. For more information, see "Support for version ranges" and "Version comparison strings".

** If you want to update to the latest version that can be resolved from a channel, edit your CR similar to the following example:
+
Expand All @@ -242,9 +242,9 @@ spec:
catalog:
packageName: openshift-pipelines-operator-rh
channels:
- latest <1>
- latest
----
<1> Installs the latest release that can be resolved from the specified channel. Updates to the channel are automatically installed. Enter values as an array.
The `latest` channel installs the latest release that can be resolved from the specified channel. Updates to the channel are automatically installed. Enter values as an array.

** If you want to specify a channel and version or version range, edit your CR similar to the following example:
+
Expand Down
Loading