[feature] create two separate OLM channels to generate cluster and namespace scoped rbac #1307
Labels
enhancement
New feature or request
feature-request
requests a new feature that currently isn't implemented in the project
help wanted
Extra attention is needed
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
Comments
ctml91
added
bug
|
This is a limitation in OpenShift with OLM. It's been addressed in the V5 release blog: |
I've believe I've seen this been used as a workaround before, submitting two bundles for OLM, one for same namespace and the other for all namespaces. |
Would love to see any work arounds in detail. Do you have a issue/comment link? I'm looking to run Grafana Operator in namespaced mode as well. But don't think it will be possible because of the limitation I linked. |
|
@Stef16Robbe for sure, I've seen for example with the Ansible operator provided by Red Hat they provide both options by having separate channels for the operator which indicate one is for cluster scoped and the other is namespace scoped. Basically they accomplish this by packaging two versions of the OLM manifests where installMode in the CSVs differ and the Available channels, where the cluster-scoped allows for "all namespaces" The namespace scoped channel can only be installed in a single namespace When installing via namespace scoped channel the CSV does not enable the OLM install generates the Rolebindings/ClusterRolebindings. The cluster scoped channel installMode allows for AllNamespaces, and all of the privileges are set under |
NissesSenap
changed the title
NissesSenap
added
enhancement
|
So I rewrote this from being a bug to being a feature requests. This is a known limitation, just as @Stef16Robbe pointed out. First, we will have to solve this in this repo, so we can constantly generate the code to the different channels. We would love PRs and help with this. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Users installing the operator via OLM are presented with two options (older version only supported same namespace and came with appropriate RBAC), the two options are all namespaces, or same namespace for the v5 channel.
The older v4 channel only provided the same namespace option
If installing multiple grafana operators in a cluster for various tenants, the same namespace option may be chosen (or in use due to it being the only supported install mode from v4 and prior). In the later versions of v4 and v5 the operator comes with ClusterRole and ClusterRoleBinding which provide it access to the below resources at ClusterScope. This is obviously not a good situation when you have multiple tenants in the same cluster as it provides them privileges access through the Grafana service.
Version
v4, v5
To Reproduce
Install operator in same namespace mode and login through the SA's token to gain privileged access to the cluster
Expected behavior
Installing the operator in same namespace mode should not include any ClusterRole or ClusterRolebinding.
Suspect component/Location where the bug might be occurring
I'm not sure if it's a limitation of OLM and having both install modes supported simply doesn't provide the option to generate the RBAC based on the install mode? Installing in all namespaces of course will require a CR/CRB to access resources outside of the namespace, I'm not sure if it's a limitation of OLM and having both install modes supported simply doesn't provide the option to generate the RBAC based on the install mode? Installing in all namespaces of course will require a CR/CRB to access resources outside of the namespace.
If there is an OLM limitation, I believe it would be best to either only support all namespace, or provide 2 sets of OLM manifests, one for the all namespace mode and another for same namespace.
Runtime (please complete the following information):
The text was updated successfully, but these errors were encountered: