Red Hat build of MicroShift

Add OLM-based Operators to a networked node in a specific namespace

You can specify a namespace for an Operator for a variety of reasons, such as security and resource isolation. For example, you can specify the namespace olm-microshift.

In the following example, the catalog is scoped and available in the global openshift-marketplace namespace. The Operator uses content from the global namespace, but runs only in the olm-microshift namespace. For a MicroShift node that has network connectivity, Operator Lifecycle Manager (OLM) can access sources hosted on remote registries.

All of the Operators installed in a specific namespace must have the same watch scope. In this case, the watch scope is OwnNamespace.

Prerequisites

The OpenShift CLI (oc) is installed.
Operator Lifecycle Manager (OLM) is installed.
You have created a custom catalog that is running in the global namespace.

Procedure

Confirm that OLM is running by using the following command:

$ oc -n openshift-operator-lifecycle-manager get pod -l app=olm-operator

Example output

NAME                           READY   STATUS    RESTARTS   AGE
olm-operator-85b5c6786-n6kbc   1/1     Running   0          16m

Confirm that the OLM catalog Operator is running by using the following command:

$ oc -n openshift-operator-lifecycle-manager get pod -l app=catalog-operator

Example output

NAME                                READY   STATUS    RESTARTS   AGE
catalog-operator-5fc7f857b6-tj8cf   1/1     Running   0          16m

Create a namespace by using the following example YAML:
Example namespace YAML
```
apiVersion: v1
kind: Namespace
metadata:
  name: olm-microshift
```
Apply the namespace configuration using the following command:
```
$ oc apply -f <ns.yaml>
```
Replace <ns.yaml> with the name of your namespace configuration file. In this example, olm-microshift is used.
Example output
```
namespace/olm-microshift created
```
Create the Operator group YAML by using the following example YAML:
Example Operator group YAML
```
kind: OperatorGroup
apiVersion: operators.coreos.com/v1
metadata:
  name: og
  namespace: olm-microshift
spec:
  targetNamespaces:
  - olm-microshift
```
The spec.targetNamespaces field and values can be omitted for Operators using the global namespace.
Apply the Operator group configuration by running the following command:
```
$ oc apply -f <og.yaml>
```
Replace <og.yaml> with the name of your operator group configuration file.
Example output
```
operatorgroup.operators.coreos.com/og created
```
Create the CatalogSource object by using the following example YAML:
Example catalog source YAML
```
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: operatorhubio-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/operatorhubio/catalog:latest
  displayName: Community Operators
  publisher: OperatorHub.io
  grpcPodConfig:
    securityContextConfig: restricted
  updateStrategy:
    registryPoll:
      interval: 60m
```
where:

metadata.namespace

Specifies the global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions CRs in any namespace can reference catalogs created in the openshift-marketplace namespace.

spec.displayName

Specifies that the Community Operators are not installed by default with OLM for MicroShift. Listed here for example only.

grpcPodConfig.securityContextConfig

Specifies the value of securityContextConfig must be set to restricted for MicroShift.
Apply the CatalogSource configuration by running the following command:
```
$ oc apply -f <catalog_source.yaml>
```
Replace <catalog_source.yaml> with your catalog source configuration file name.

To verify that the catalog source is applied, check for the READY state by using the following command:

$ oc describe catalogsources.operators.coreos.com -n openshift-marketplace operatorhubio-catalog

Example output

Name:         operatorhubio-catalog
Namespace:    openshift-marketplace
Labels:       <none>
Annotations:  <none>
API Version:  operators.coreos.com/v1alpha1
Kind:         CatalogSource
Metadata:
  Creation Timestamp:  2024-01-31T10:09:46Z
  Generation:          1
  Resource Version:    2811
  UID:                 60ce4a36-86d3-4921-b9fc-84d67c28df48
Spec:
  Display Name:  Community Operators
  Grpc Pod Config:
    Security Context Config:  restricted
  Image:                      quay.io/operatorhubio/catalog:latest
  Publisher:                  OperatorHub.io
  Source Type:                grpc
  Update Strategy:
    Registry Poll:
      Interval:  60m
Status:
  Connection State:
    Address:              operatorhubio-catalog.openshift-marketplace.svc:50051
    Last Connect:         2024-01-31T10:10:04Z
    Last Observed State:  READY
  Registry Service:
    Created At:         2024-01-31T10:09:46Z
    Port:               50051
    Protocol:           grpc
    Service Name:       operatorhubio-catalog
    Service Namespace:  openshift-marketplace
Events:                 <none>

The Last Observed State field reports the status as READY.

Confirm that the catalog source is running by using the following command:

$ oc get pods -n openshift-marketplace -l olm.catalogSource=operatorhubio-catalog

Example output

NAME                          READY   STATUS    RESTARTS   AGE
operatorhubio-catalog-j7sc8   1/1     Running   0          43s

Create a Subscription CR configuration file by using the following example YAML:
Example Subscription custom resource YAML
```
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: my-gitlab-operator-kubernetes
  namespace: olm-microshift
spec:
  channel: stable
  name: gitlab-operator-kubernetes
  source: operatorhubio-catalog
  sourceNamespace: openshift-marketplace
```
where:

metadata.namespace

Specifies the specific namespace. Operators reference the global namespace for content, but run in the olm-microshift namespace.

spec.sourceNamespace

Specifies the global namespace. Subscriptions CRs in any namespace can reference catalogs created in the openshift-marketplace namespace.
Apply the Subscription CR configuration by running the following command:
```
$ oc apply -f <subscription_cr.yaml>
```
Replace <subscription_cr.yaml> with the name of the Subscription CR configuration file.
Example output
```
subscription.operators.coreos.com/my-gitlab-operator-kubernetes
```
You can create a configuration file for the specific Operand you want to use and apply it now.

Verification

Verify that your Operator is running by using the following command:

$ oc get pods -n olm-microshift

The olm-microshift uses the namespace from the Subscription CR.

Allow a minute or two for the Operator start.

Example output

NAME                                         READY   STATUS    RESTARTS   AGE
gitlab-controller-manager-69bb6df7d6-g7ntx   2/2     Running   0          3m24s