v0.23.0 break operators installation

[cedvan]

Bug Report

Environment

• operator-lifecycle-manager version: v0.23.0
• Cluster type : k3s (from truenas scale)
• Kubernetes version information: v1.25.3+k3s-9afcd6b9-dirty

Problem

Just install a fresh operator lifecycle manager to new truenas scale server.

• Install Operator SDK CLI
• Install OLM : operator-sdk olm install (default last, so v0.23.0)
• Create cert-manager operator : kubectl create -f https://operatorhub.io/install/cert-manager.yaml => create successfull
• My cert manager operator never up and result command kubectl get csv -n operators stay empty. operators namespace stay as no resources.

Temporary solution

Uninstall v0.23.0 and force install v0.22.0 with --version v0.22.0. Recreate cert-manager operator, and my cert manager up :)

Conclusion

Version v0.23.0 break operator installation

[awgreene]

Ah, this is happening because the community catalogSource isn't being ran in restricted mode, which is fixed in this PR. I'll cut a new release once the PR is merged.

[debovema]

Same here.
Thank you for the fix, which can be applied directly:

kubectl patch catalogsources.operators.coreos.com -n olm operatorhubio-catalog --type merge --patch '{"spec":{"grpcPodConfig":{"securityContextConfig":"restricted"}}}'

[awgreene]

The v0.23.1 release fixes this issue. I've marked the v0.23.0 release with a warning.

[leochr]

@awgreene We are trying to understand the root cause of this problem because this is also affecting our CatalogSource. Is patching of the catalog sources a temporary workaround? Would OLM be updated to handle the CatalogSource (without the restricted mode) differently in the future so it doesn't fail? FYI @git4rk @pbaity

[leochr]

@awgreene We are trying to understand the root cause of this problem because this is also affecting our CatalogSource. Is patching of the catalog sources a temporary workaround? Would OLM be updated to handle the CatalogSource (without the restricted mode) differently in the future so it doesn't fail? FYI @git4rk @pbaity

@awgreene Please see our questions above. We are trying to understand how best to resolve this issue for our catalog. Should we specify the 'restricted' mode in the CatalogSource? Should the catalog image be rebuilt with a later opm version? How can we make it work consistently across environments (now and later)?