Red Hat OpenShift Container Platform

Preflight permissions check for cluster extensions (Technology Preview)

Before installing an extension, the Operator Controller performs a dry run to verify service account access. This process confirms that the service account can create all required Kubernetes resources and RBAC rules defined by the extension bundle.

The preflight permissions check for cluster extensions is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

If the service account is missing any required RBAC rules, the preflight check fails before the actual installation proceeds. If the preflight check fails, the Operator Controller reports the errors in the status conditions of the extension and in the logs of the Operator Controller.

To proceed with the installation, update the roles and bindings to grant the missing permissions to the service account and apply the changes. If there are no errors, the Operator Controller reconciles the updated permissions and completes the installation.

Example report from the preflight permissions check

The following report indicates that the service account requires the following missing permissions:

RBAC rules to perform list and watch actions for the services resource in the core API group for the entire cluster
RBAC rules to perform create actions for deployments resources in the apps API group for the pipelines namespace

You can access the reports from the preflight permissions check in the status conditions of the cluster extension. The oc describe clusterextension command prints information about a cluster extension, including the status conditions.

Example command

$ oc describe clusterextension <extension_name>

Example report

apiVersion: v1
items:
- apiVersion: olm.operatorframework.io/v1
  kind: ClusterExtension
...
Conditions:
  Type:    Progressing
  Status:  False
  Reason:  Retrying
  Message: pre-authorization failed: service account requires the following permissions to manage cluster extension:
           Namespace:"" APIGroups:[] Resources:[services] Verbs:[list,watch]
           Namespace:"pipelines" APIGroups:["apps"] Resources:[deployments] Verbs:[create]

Namespace: Specifies the scope of the required RBAC rules at the namespace level, for example the pipelines namespace. An empty namespace value, "", indicates that you must scope the permission to the cluster.
APIGroups: Specifies the name of the API group the required permissions apply to. An empty value in the API group, [], indicates the permissions apply to the core API group. For example, services, secrets, and config maps are all core resources.

If a resource belongs to a named API group, the report lists the name in between the brackets. For example, the value of APIGroups:[apps] indicates the extension requires RBAC rules to act on resources in the apps API group.
Resources: Specifies the resource types that require permissions. For example, services, secrets, and custom resource definitions are common resource types.
Verbs: Specifies the actions, or verbs, that the service account needs permission to perform. If the report lists several verbs, all of the listed verbs require RBAC rules.

Common permission errors

Missing verbs: The service account does not have permission to perform a required action. To resolve this issue, update or create a role and binding to grant the necessary permissions. Roles and role bindings define resource permissions for a namespace. Cluster roles and cluster role bindings define resource permissions for the cluster.
Privilege escalation: The service account does not have enough permission to create a role or cluster role that the extension needs. When this happens, the preflight check reports the verbs as missing to prevent privilege escalation. To resolve this issue, grant enough permission to the service account so that it can create the roles.
Missing role references: The extension references a role or cluster role that the Operator Controller cannot find. When this happens, the preflight check lists the missing role and reports an authorization evalutation error. To resolve the issue, create or update the roles and cluster roles to ensure that all role references exist.