Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OperatorGroup RBAC Documentation is outdated #198

Open
awgreene opened this issue Nov 5, 2021 · 0 comments
Open

OperatorGroup RBAC Documentation is outdated #198

awgreene opened this issue Nov 5, 2021 · 0 comments

Comments

@awgreene
Copy link
Member

awgreene commented Nov 5, 2021

The OperatorGroup RBAC Documentation is dated as of this commit.

Steps to reproduce:

  1. Install OLM
  2. Install the elasticSearch Operator with the following command: kubectl create -f https://operatorhub.io/install/elastic-cloud-eck.yaml
  3. View the available clusterRoles
$ k get clusterroles
...
# ClusterRoles generated for the `operators/global-operators operatorGroup`.
global-operators-admin                                                 2021-11-05T21:34:28Z
global-operators-edit                                                  2021-11-05T21:34:28Z
global-operators-view                                                  2021-11-05T21:34:28Z
...
# Some of the ClusterRoles generated for the packagemanifest CRD introduced by the elasticSearch operator
apmservers.apm.k8s.elastic.co-v1-admin                                 2021-11-05T21:50:54Z
apmservers.apm.k8s.elastic.co-v1-crdview                               2021-11-05T21:50:54Z
apmservers.apm.k8s.elastic.co-v1-edit                                  2021-11-05T21:50:54Z
apmservers.apm.k8s.elastic.co-v1-view                                  2021-11-05T21:50:54Z
...
  1. Mutiple labels are generated in the operatorGroup's clusterRole
k get clusterroles global-operators-edit -o yaml
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      olm.opgroup.permissions/aggregate-to-91302e3d8ef46fe2-edit: "true"
...
...
...

$ k get clusterRoles -l  olm.opgroup.permissions/aggregate-to-91302e3d8ef46fe2-edit=true
NAME                                    CREATED AT
apmservers.apm.k8s.elastic.co-v1-edit   2021-11-05T21:50:54Z

Proposed Fix:

Documentation should be updated to reflect that OLM now generates a label selector for each provided api in the operatorGroup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant