RHIDP-14790: Add OLM v1 code path to install-rhdh-catalog-source.sh#3047
Open
Fortune-Ndlovu wants to merge 2 commits into
Conversation
Add --olm-version v0|v1|auto flag (default: auto) with CRD-based detection of OLM v1. When OLM v1 is detected, creates ClusterCatalog, ServiceAccount, ClusterRoleBinding, and ClusterExtension instead of OLM v0 CatalogSource, OperatorGroup, and Subscription. The IIB rendering/rebuild phase is shared by both paths. OLM v0 behavior is fully preserved for backward compatibility. Signed-off-by: Fortune-Ndlovu <fndlovu@redhat.com> Assisted-by: Claude (claude-opus-4-6)
PR Summary by QodoAdd OLM v1 support to install-rhdh-catalog-source.sh Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
1. Cluster-admin installer binding
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
+937
to
+951
| # ClusterRoleBinding granting cluster-admin to the installer SA | ||
| CRB_NAME="${OPERATOR_NAME_TO_INSTALL}-installer-binding" | ||
| echo "apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: ${CRB_NAME} | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-admin | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: ${SA_NAME} | ||
| namespace: ${NAMESPACE_SUBSCRIPTION} | ||
| " > "$TMPDIR"/ClusterRoleBinding.yml && invoke_cluster_cli apply -f "$TMPDIR"/ClusterRoleBinding.yml |
There was a problem hiding this comment.
1. Cluster-admin installer binding 🐞 Bug ⛨ Security
In the OLM v1 path, the script creates a ClusterRoleBinding that grants the installer ServiceAccount the built-in cluster-admin ClusterRole, giving it full cluster-wide privileges. This leaves a highly privileged credential in-cluster and substantially increases impact if the ServiceAccount token is leaked or the namespace is compromised.
Agent Prompt
### Issue description
The OLM v1 install flow creates a `ClusterRoleBinding` to `cluster-admin` for the `${OPERATOR_NAME_TO_INSTALL}-installer` ServiceAccount. This grants broad, persistent cluster-admin privileges, which is an unnecessary security risk for a script-driven install path.
### Issue Context
The new OLM v1 code path creates a ServiceAccount and binds it to `cluster-admin` before creating the `ClusterExtension`.
### Fix Focus Areas
- Replace the `cluster-admin` ClusterRoleBinding with least-privilege permissions required by the OLM v1 ClusterExtension installer (use an existing purpose-built ClusterRole if available, otherwise define a custom ClusterRole with only needed verbs/resources).
- If elevated privileges are truly required, gate them behind an explicit flag (e.g. `--grant-cluster-admin`) and/or clean them up after installation completes (delete the ClusterRoleBinding/ServiceAccount once the ClusterExtension is installed).
- .rhdh/scripts/install-rhdh-catalog-source.sh[928-951]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
rhdh-qodo-merge
Bot
added
documentation
Member
Author
|
/agentic-review |
… the operator-controller namespace and granting image-puller access to necessary service accounts. Update ClusterCatalog and ClusterRoleBinding creation to align with OLM v1 specifications.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| debugf "Using operator-controller namespace: ${NAMESPACE_OLM_CONTROLLER}" | ||
|
|
||
| # Grant image-puller access to OLM v1 controller SAs so they can pull images from the internal registry | ||
| oc policy add-role-to-user system:image-puller system:serviceaccount:${NAMESPACE_CATALOGD}:catalogd-controller-manager -n rhdh || true |
|
|
||
| # Grant image-puller access to OLM v1 controller SAs so they can pull images from the internal registry | ||
| oc policy add-role-to-user system:image-puller system:serviceaccount:${NAMESPACE_CATALOGD}:catalogd-controller-manager -n rhdh || true | ||
| oc policy add-role-to-user system:image-puller system:serviceaccount:${NAMESPACE_OLM_CONTROLLER}:operator-controller-controller-manager -n rhdh || true |
| " > "$TMPDIR"/ClusterRoleBinding.yml && invoke_cluster_cli apply -f "$TMPDIR"/ClusterRoleBinding.yml | ||
|
|
||
| # Grant installer SA image-puller access so it can pull operator images from the internal registry | ||
| oc policy add-role-to-user system:image-puller system:serviceaccount:${NAMESPACE_SUBSCRIPTION}:${SA_NAME} -n rhdh || true |
|
Member
Author
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"olm.operatorframework.io/v1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"rhdh"},"spec":{"install":{"preflight":{"crdUpgradeSafety":{"enforcement":"None"}}},"namespace":"rhdh-operator","serviceAccount":{"name":"rhdh-installer"},"source":{"catalog":{"channels":["fast"],"packageName":"rhdh","selector":{"matchLabels":{"olm.operatorframework.io/metadata.name":"rhdh-fast"}}},"sourceType":"Catalog"}}}
creationTimestamp: '2026-06-23T05:57:28Z'
finalizers:
- olm.operatorframework.io/cleanup-unpack-cache
- olm.operatorframework.io/cleanup-contentmanager-cache
generation: 1
managedFields:
- apiVersion: olm.operatorframework.io/v1
fieldsType: FieldsV1
fieldsV1:
'f:spec':
.: {}
'f:install':
.: {}
'f:preflight':
.: {}
'f:crdUpgradeSafety':
.: {}
'f:enforcement': {}
'f:namespace': {}
'f:serviceAccount':
.: {}
'f:name': {}
'f:source':
.: {}
'f:catalog':
.: {}
'f:channels': {}
'f:packageName': {}
'f:selector': {}
'f:upgradeConstraintPolicy': {}
'f:sourceType': {}
manager: kubectl-client-side-apply
operation: Update
time: '2026-06-23T05:57:28Z'
- apiVersion: olm.operatorframework.io/v1
fieldsType: FieldsV1
fieldsV1:
'f:metadata':
'f:finalizers':
.: {}
'v:"olm.operatorframework.io/cleanup-contentmanager-cache"': {}
'v:"olm.operatorframework.io/cleanup-unpack-cache"': {}
manager: operator-controller
operation: Update
time: '2026-06-23T05:57:28Z'
- apiVersion: olm.operatorframework.io/v1
fieldsType: FieldsV1
fieldsV1:
'f:status':
.: {}
'f:conditions':
.: {}
'k:{"type":"BundleDeprecated"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'k:{"type":"ChannelDeprecated"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'k:{"type":"Deprecated"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'k:{"type":"Installed"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'k:{"type":"PackageDeprecated"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'k:{"type":"Progressing"}':
.: {}
'f:lastTransitionTime': {}
'f:message': {}
'f:observedGeneration': {}
'f:reason': {}
'f:status': {}
'f:type': {}
'f:install':
.: {}
'f:bundle':
.: {}
'f:name': {}
'f:version': {}
manager: operator-controller
operation: Update
subresource: status
time: '2026-06-23T05:57:30Z'
name: rhdh
resourceVersion: '68186'
uid: 2d7d5cc0-00f2-4e39-88e2-e2beb6435ef4
spec:
install:
preflight:
crdUpgradeSafety:
enforcement: None
namespace: rhdh-operator
serviceAccount:
name: rhdh-installer
source:
catalog:
channels:
- fast
packageName: rhdh
selector:
matchLabels:
olm.operatorframework.io/metadata.name: rhdh-fast
upgradeConstraintPolicy: CatalogProvided
sourceType: Catalog
status:
conditions:
- lastTransitionTime: '2026-06-23T05:57:28Z'
message: ''
observedGeneration: 1
reason: Deprecated
status: 'False'
type: Deprecated
- lastTransitionTime: '2026-06-23T05:57:28Z'
message: ''
observedGeneration: 1
reason: Deprecated
status: 'False'
type: PackageDeprecated
- lastTransitionTime: '2026-06-23T05:57:28Z'
message: ''
observedGeneration: 1
reason: Deprecated
status: 'False'
type: ChannelDeprecated
- lastTransitionTime: '2026-06-23T05:57:28Z'
message: ''
observedGeneration: 1
reason: Deprecated
status: 'False'
type: BundleDeprecated
- lastTransitionTime: '2026-06-23T05:57:30Z'
message: 'Installed bundle image-registry.openshift-image-registry.svc:5000/rhdh/rhdh-operator-bundle:1c0403295d17349851e0ddc12124b93fb18780c1f6869c27eddcf1ced8c1b673 successfully'
observedGeneration: 1
reason: Succeeded
status: 'True'
type: Installed
- lastTransitionTime: '2026-06-23T05:57:30Z'
message: Desired state reached
observedGeneration: 1
reason: Succeeded
status: 'True'
type: Progressing
install:
bundle:
name: rhdh-operator.v1.10.2
version: 1.10.2
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
--olm-version v0|v1|autoCLI flag (default:auto) toinstall-rhdh-catalog-source.shwith CRD-based OLM v1 detection. When OLM v1 is detected (or forced), the script creates a ClusterCatalog and ClusterExtension with a ServiceAccount and ClusterRoleBinding, instead of the OLM v0 CatalogSource, Subscription, and OperatorGroup. Resolution is pinned to the custom catalog viaselector.matchLabels, and CRD upgrade safety preflight is disabled (enforcement: None) per the known blocker RHIDP-8656. The OLM v0 path is fully preserved for backward compatibility on older clusters.Which issue(s) does this PR fix or relate to
Resolves: https://redhat.atlassian.net/browse/RHIDP-14790
PR acceptance criteria
How to test changes / Special notes to the reviewer
bash .rhdh/scripts/install-rhdh-catalog-source.sh --latest --install-operator rhdh 2>&1 | tee /tmp/olmv1-test3.log)
Signed-off-by: Fortune-Ndlovu fndlovu@redhat.com
Assisted-by: Claude (claude-opus-4-6)