CSV support for ClusterRoles

[darkowlzz]

StrategyDeploymentPermissions in CSV spec.install.spec.permissions supports specifying rules for RBAC Roles only, as per https://github.com/operator-framework/operator-lifecycle-manager/blob/master/pkg/controller/install/deployment.go#L78-L80 .

Is there a way to add ClusterRoles? I've an operator that needs access to node, persistentvolumeclaim and storageclass, which are cluster level access.

While deploying without OLM, for RBAC permissions, I create a ClusterRole and ClusterRoleBinding, and bind the ClusterRole to the ServiceAccount of my operator.

If this support can be added in the future, I can try implementing it and create a PR.

[ecordell]

Hi @darkowlzz, support for creating ClusterRoles is coming very soon (~1wk).

[ecordell]

See #477 for progress here

[ecordell]

Forgot to come back and update this - ClusterRole support is in via the clusterPermissions block on the CSV.

[wongma7]

this isn't working for me, any tips to debug? Added clusterPermissions to my csv, the field gets validated, but no clusterRoles nor clusterRoleBindings get created and installation proceeds then fails since the permissions aren't there. olm logs show nothing interesting: I tried grepping for this line

operator-lifecycle-manager/pkg/controller/operators/olm/requirements.go

Line 75 in f597b7b

log.Infof("CSV %s permission met: %t", csv.GetName(), permissionsMet)

but found nothing

[njhale]

@wongma7 Are you installing your CSV via InstallPlan or by manually creating it? Creation of both permissions and clusterPermissions are now created via InstallPlans. Creating a CSV with permissions manually will only check if listed permissions (or RBAC equivalent permissions) exist.

[wongma7]

@njhale I'm manually creating it. So if I am understanding correctly, the InstallPlan would tell the Catalog Operator to create the clusterrole and clusterrolebinding the same way it can tell the Catalog Operator to create a CRD? will the clusterrole and clsuterrolebinding have a deterministic name so that i can make them required in my CSV?

[wongma7]

NVM about the name, I see now it doesn't change the manifest...asked because I noticed the roles created by OLM have some generated part at the end.