Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refine cluster-admin OLM workflow #482

Merged
merged 3 commits into from
Sep 27, 2018
Merged

refine cluster-admin OLM workflow #482

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3e9a5f3
refine cluster-admin OLM workflow
madorn Sep 25, 2018
d55b627
Merge branch 'master' into patch-2
ecordell Sep 27, 2018
6c952b3
Merge branch 'master' into patch-2
ecordell Sep 27, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 4 additions & 9 deletions Documentation/design/access-control.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,17 +27,12 @@ As you can see, no cluster permissions are needed.

## Cluster Admins

Cluster admins have the ability to provide a selection of Operators for use on the cluster. These Operators are described in a Cluster Service Version (CSV) file. Upon installation, the OLM software parses the CSV to create the cluster wide resources needed for safe operation:
Cluster admins have the ability to provide a selection of Operators for use on the cluster. These Operators are described in a Cluster Service Version (CSV) file which resides in a CatalogSource (along with the Operator's CRD and package manifests). The cluster admin can now select the teams and namespaces that can use this particular Operator, by creating a Subscription object, which will trigger the creation of an InstallPlan that points to a specific CatalogSource. Once the InstallPlan is approved, the OLM software is responsible for parsing the CatalogSource and performing the following:

1. Create Role contained in the CSV
1. Create the Custom Resource Definition contained in the CSV

The cluster admin can now select the teams and namespaces that can use this particular Operator, by creating a Subscription object, which will trigger the installation of the Operator:

1. Create Service Account for Operator
1. Create minimal Role for the Operator
1. Create Role Binding for Role and Service Account
1. Create the Custom Resource Definition
1. Create Service Account for Operator
1. Create minimal Role or ClusterRole for the Operator
1. Create Role or ClusterRoleBinding for Role or ClusterRole and Service Account
1. Create Operator Deployment, referencing the Service Account

Once a namespace is created, the end-users now have the ability to create instances of the Custom Resource in a self-service manner (see above). OLM also has the ability to control automatic updates of the Operators running in namespaces. See the [architecture][arch] for more details.
Expand Down