Chapter 5. Cluster extensions 5.1. Managing cluster extensions Important Operator Lifecycle Manager (OLM) v1 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . After a catalog has been added to your cluster, you have access to the versions, patches, and over-the-air updates of the extensions and Operators that are published to the catalog. You can manage extensions declaratively from the CLI using custom resources (CRs). Important Currently, Operator Lifecycle Manager (OLM) v1 cannot authenticate private registries, such as the Red Hat-provided Operator catalogs. This is a known issue. As a result, the OLM v1 procedures that rely on having the Red Hat Operators catalog installed do not work. ( OCPBUGS-36364 ) 5.1.1. Supported extensions Currently, Operator Lifecycle Manager (OLM) v1 supports installing cluster extensions that meet all of the following criteria: The extension must use the registry+v1 bundle format introduced in existing OLM. The extension must support installation via the AllNamespaces install mode. The extension must not use webhooks. The extension must not declare dependencies by using any of the following file-based catalog properties: olm.gvk.required olm.package.required olm.constraint OLM v1 checks that the extension you want to install meets these constraints. If the extension that you want to install does not meet these constraints, an error message is printed in the cluster extension's conditions. Important Operator Lifecycle Manager (OLM) v1 does not support the OperatorConditions API introduced in existing OLM. If an extension relies on only the OperatorConditions API to manage updates, the extension might not install correctly. Most extensions that rely on this API fail at start time, but some might fail during reconciliation. As a workaround, you can pin your extension to a specific version. When you want to update your extension, consult the extension's documentation to find out when it is safe to pin the extension to a new version. Additional resources Operator conditions 5.1.2. Finding Operators to install from a catalog After you add a catalog to your cluster, you can query the catalog to find Operators and extensions to install. Before you can query catalogs, you must port forward the catalog server service. Prerequisites You have added a catalog to your cluster. You have installed the jq CLI tool. Procedure Port forward the catalog server service in the openshift-catalogd namespace by running the following command: USD oc -n openshift-catalogd port-forward svc/catalogd-catalogserver 8080:443 In a new terminal window or tab, download the catalog's JSON file locally by running the following command: USD curl -L -k https://localhost:8080/catalogs/<catalog_name>/all.json \ -C - -o /<path>/<catalog_name>.json Example 5.1. Example command USD curl -L -k https://localhost:8080/catalogs/redhat-operators/all.json \ -C - -o /home/username/catalogs/rhoc.json Run one of the following commands to return a list of Operators and extensions in a catalog. Important Currently, Operator Lifecycle Manager (OLM) v1 supports installing cluster extensions that meet all of the following criteria: The extension must use the registry+v1 bundle format introduced in existing OLM. The extension must support installation via the AllNamespaces install mode. The extension must not use webhooks. The extension must not declare dependencies by using any of the following file-based catalog properties: olm.gvk.required olm.package.required olm.constraint OLM v1 checks that the extension you want to install meets these constraints. If the extension that you want to install does not meet these constraints, an error message is printed in the cluster extension's conditions. Get a list of all the Operators and extensions from the local catalog file by running the following command: USD jq -s '.[] | select(.schema == "olm.package") | .name' \ /<path>/<filename>.json Example 5.2. Example command USD jq -s '.[] | select(.schema == "olm.package") | .name' \ /home/username/catalogs/rhoc.json Example 5.3. Example output NAME AGE "3scale-operator" "advanced-cluster-management" "amq-broker-rhel8" "amq-online" "amq-streams" "amq7-interconnect-operator" "ansible-automation-platform-operator" "ansible-cloud-addons-operator" "apicast-operator" "aws-efs-csi-driver-operator" "aws-load-balancer-operator" "bamoe-businessautomation-operator" "bamoe-kogito-operator" "bare-metal-event-relay" "businessautomation-operator" ... Get list of packages that support AllNamespaces install mode and do not use webhooks from the local catalog file by running the following command: USD jq -c 'select(.schema == "olm.bundle") | \ {"package":.package, "version":.properties[] | \ select(.type == "olm.bundle.object").value.data | @base64d | fromjson | \ select(.kind == "ClusterServiceVersion" and (.spec.installModes[] | \ select(.type == "AllNamespaces" and .supported == true) != null) \ and .spec.webhookdefinitions == null).spec.version}' \ /<path>/<catalog_name>.json Example 5.4. Example output {"package":"3scale-operator","version":"0.10.0-mas"} {"package":"3scale-operator","version":"0.10.5"} {"package":"3scale-operator","version":"0.11.0-mas"} {"package":"3scale-operator","version":"0.11.1-mas"} {"package":"3scale-operator","version":"0.11.2-mas"} {"package":"3scale-operator","version":"0.11.3-mas"} {"package":"3scale-operator","version":"0.11.5-mas"} {"package":"3scale-operator","version":"0.11.6-mas"} {"package":"3scale-operator","version":"0.11.7-mas"} {"package":"3scale-operator","version":"0.11.8-mas"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-2"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-3"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-4"} {"package":"amq-broker-rhel8","version":"7.10.1-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.1-opr-2"} {"package":"amq-broker-rhel8","version":"7.10.2-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.2-opr-2"} ... Inspect the contents of an Operator or extension's metadata by running the following command: USD jq -s '.[] | select( .schema == "olm.package") | \ select( .name == "<package_name>")' /<path>/<catalog_name>.json Example 5.5. Example command USD jq -s '.[] | select( .schema == "olm.package") | \ select( .name == "openshift-pipelines-operator-rh")' \ /home/username/rhoc.json Example 5.6. Example output { "defaultChannel": "stable", "icon": { "base64data": "PHN2ZyB4bWxu..." "mediatype": "image/png" }, "name": "openshift-pipelines-operator-rh", "schema": "olm.package" } 5.1.2.1. Common catalog queries You can query catalogs by using the jq CLI tool. Table 5.1. Common package queries Query Request Available packages in a catalog USD jq -s '.[] | select( .schema == "olm.package") | \ .name' <catalog_name>.json Packages that support AllNamespaces install mode and do not use webhooks USD jq -c 'select(.schema == "olm.bundle") | \ {"package":.package, "version":.properties[] | \ select(.type == "olm.bundle.object").value.data | \ @base64d | fromjson | \ select(.kind == "ClusterServiceVersion" and (.spec.installModes[] | \ select(.type == "AllNamespaces" and .supported == true) != null) \ and .spec.webhookdefinitions == null).spec.version}' \ <catalog_name>.json Package metadata USD jq -s '.[] | select( .schema == "olm.package") | \ select( .name == "<package_name>")' <catalog_name>.json Catalog blobs in a package USD jq -s '.[] | select( .package == "<package_name>")' \ <catalog_name>.json Table 5.2. Common channel queries Query Request Channels in a package USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select( .package == "<package_name>") | .name' \ <catalog_name>.json Versions in a channel USD jq -s '.[] | select( .package == "<package_name>" ) | \ select( .schema == "olm.channel" ) | \ select( .name == "<channel_name>" ) | \ .entries | .[] | .name' <catalog_name>.json Latest version in a channel Upgrade path USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select ( .name == "<channel>") | \ select( .package == "<package_name>")' \ <catalog_name>.json Table 5.3. Common bundle queries Query Request Bundles in a package USD jq -s '.[] | select( .schema == "olm.bundle" ) | \ select( .package == "<package_name>") | .name' \ <catalog_name>.json Bundle dependencies Available APIs USD jq -s '.[] | select( .schema == "olm.bundle" ) | \ select ( .name == "<bundle_name>") | \ select( .package == "<package_name>")' \ <catalog_name>.json 5.1.3. Creating a service account to manage cluster extensions Unlike existing Operator Lifecycle Manager (OLM), OLM v1 does not have permissions to install, update, and manage cluster extensions. Cluster administrators must create a service account and assign the role-based access controls (RBAC) required to install, update, and manage cluster extensions. Important There is a known issue in OLM v1. If you do not assign the correct role-based access controls (RBAC) to an extension's service account, OLM v1 gets stuck and reconciliation stops. Currently, OLM v1 does not have tools to help extension administrators find the correct RBAC for a service account. Because OLM v1 is a Technology Preview feature and must not be used on production clusters, you can avoid this issue by using the more permissive RBAC included in the documentation. This RBAC is intended for testing purposes only. Do not use it on production clusters. Prerequisites Access to an OpenShift Container Platform cluster using an account with cluster-admin permissions. Procedure Create a service account, similar to the following example: apiVersion: v1 kind: ServiceAccount metadata: name: <extension>-installer namespace: <namespace> Example 5.7. Example extension-service-account.yaml file apiVersion: v1 kind: ServiceAccount metadata: name: pipelines-installer namespace: pipelines Apply the service account by running the following command: USD oc apply -f extension-service-account.yaml Create a cluster role and assign RBAC, similar to the following example: Warning The following cluster role does not follow the principle of least privilege. This cluster role is intended for testing purposes only. Do not use it on production clusters. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: <extension>-installer-clusterrole rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"] Example 5.8. Example pipelines-cluster-role.yaml file apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pipelines-installer-clusterrole rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"] Add the cluster role to the cluster by running the following command: USD oc apply -f pipelines-role.yaml Bind the permissions granted by the cluster role to the service account by creating a cluster role binding, similar to the following example: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: <extension>-installer-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: <extension>-installer-clusterrole subjects: - kind: ServiceAccount name: <extension>-installer namespace: <namespace> Example 5.9. Example pipelines-cluster-role-binding.yaml file apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pipelines-installer-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pipelines-installer-clusterrole subjects: - kind: ServiceAccount name: pipelines-installer namespace: pipelines Apply the cluster role binding by running the following command: USD oc apply -f pipelines-cluster-role-binding.yaml 5.1.4. Installing a cluster extension from a catalog You can install an extension from a catalog by creating a custom resource (CR) and applying it to the cluster. Operator Lifecycle Manager (OLM) v1 supports installing cluster extensions, including existing OLM Operators via the registry+v1 bundle format, that are scoped to the cluster. For more information, see Supported extensions . Important Currently, Operator Lifecycle Manager (OLM) v1 cannot authenticate private registries, such as the Red Hat-provided Operator catalogs. This is a known issue. As a result, the OLM v1 procedures that rely on having the Red Hat Operators catalog installed do not work. ( OCPBUGS-36364 ) Prerequisites You have added a catalog to your cluster. You have downloaded a local copy of the catalog file. You have installed the jq CLI tool. You have created a service account and assigned enough role-based access controls (RBAC) to install, update, and manage the extension you want to install. For more information, see Creating a service account . Procedure Inspect a package for channel and version information from a local copy of your catalog file by completing the following steps: Get a list of channels from a selected package by running the following command: USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select( .package == "<package_name>") | \ .name' /<path>/<catalog_name>.json Example 5.10. Example command USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select( .package == "openshift-pipelines-operator-rh") | \ .name' /home/username/rhoc.json Example 5.11. Example output "latest" "pipelines-1.11" "pipelines-1.12" "pipelines-1.13" "pipelines-1.14" Get a list of the versions published in a channel by running the following command: USD jq -s '.[] | select( .package == "<package_name>" ) | \ select( .schema == "olm.channel" ) | \ select( .name == "<channel_name>" ) | .entries | \ .[] | .name' /<path>/<catalog_name>.json Example 5.12. Example command USD jq -s '.[] | select( .package == "openshift-pipelines-operator-rh" ) | \ select( .schema == "olm.channel" ) | select( .name == "latest" ) | \ .entries | .[] | .name' /home/username/rhoc.json Example 5.13. Example output "openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.13.1" "openshift-pipelines-operator-rh.v1.11.1" "openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.14.1" "openshift-pipelines-operator-rh.v1.14.2" "openshift-pipelines-operator-rh.v1.14.3" "openshift-pipelines-operator-rh.v1.14.4" If you want to install your extension into a new namespace, run the following command: USD oc adm new-project <new_namespace> Create a CR, similar to the following example: Example pipelines-operator.yaml CR apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> serviceAccount: name: <service_account> channel: <channel> version: "<version>" where: <namespace> Specifies the namespace where you want the bundle installed, such as pipelines or my-extension . Extensions are still cluster-scoped and might contain resources that are installed in different namespaces. <service_account> Specifies the name of the service account you created to install, update, and manage your extension. <channel> Optional: Specifies the channel, such as pipelines-1.11 or latest , for the package you want to install or update. <version> Optional: Specifies the version or version range, such as 1.11.1 , 1.12.x , or >=1.12.1 , of the package you want to install or update. For more information, see "Example custom resources (CRs) that specify a target version" and "Support for version ranges". Important If you try to install an Operator or extension that does not have unique name, the installation might fail or lead to an unpredictable result. This occurs for the following reasons: If mulitple catalogs are installed on a cluster, Operator Lifecycle Manager (OLM) v1 does not include a mechanism to specify a catalog when you install an Operator or extension. OLM v1 requires that all of the Operators and extensions that are available to install on a cluster use a unique name for their bundles and packages. Apply the CR to the cluster by running the following command: USD oc apply -f pipeline-operator.yaml Example output clusterextension.olm.operatorframework.io/pipelines-operator created Verification View the Operator or extension's CR in the YAML format by running the following command: USD oc get clusterextension pipelines-operator -o yaml Example 5.14. Example output apiVersion: v1 items: - apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"pipelines","packageName":"openshift-pipelines-operator-rh","serviceAccount":{"name":"pipelines-installer"},"pollInterval":"30m"}} creationTimestamp: "2024-06-10T17:50:51Z" finalizers: - olm.operatorframework.io/cleanup-unpack-cache generation: 1 name: pipelines-operator resourceVersion: "53324" uid: c54237be-cde4-46d4-9b31-d0ec6acc19bf spec: channel: latest installNamespace: pipelines packageName: openshift-pipelines-operator-rh serviceAccount: name: pipelines-installer upgradeConstraintPolicy: Enforce status: conditions: - lastTransitionTime: "2024-06-10T17:50:58Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:dd3d18367da2be42539e5dde8e484dac3df33ba3ce1d5bcf896838954f3864ec" observedGeneration: 1 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-10T17:51:11Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:dd3d18367da2be42539e5dde8e484dac3df33ba3ce1d5bcf896838954f3864ec" observedGeneration: 1 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: BundleDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: 'unpack successful: observedGeneration: 1 reason: UnpackSuccess status: "True" type: Unpacked installedBundle: name: openshift-pipelines-operator-rh.v1.14.4 version: 1.14.4 resolvedBundle: name: openshift-pipelines-operator-rh.v1.14.4 version: 1.14.4 where: spec.channel Displays the channel defined in the CR of the extension. spec.version Displays the version or version range defined in the CR of the extension. status.conditions Displays information about the status and health of the extension. type: Deprecated Displays whether one or more of following are deprecated: type: PackageDeprecated Displays whether the resolved package is deprecated. type: ChannelDeprecated Displays whether the resolved channel is deprecated. type: BundleDeprecated Displays whether the resolved bundle is deprecated. The value of False in the status field indicates that the reason: Deprecated condition is not deprecated. The value of True in the status field indicates that the reason: Deprecated condition is deprecated. installedBundle.name Displays the name of the bundle installed. installedBundle.version Displays the version of the bundle installed. resolvedBundle.name Displays the name of the resolved bundle. resolvedBundle.version Displays the version of the resolved bundle. Additional resources Supported extensions Creating a service account Example custom resources (CRs) that specify a target version Support for version ranges 5.1.5. Updating a cluster extension You can update your cluster extension or Operator by manually editing the custom resource (CR) and applying the changes. Prerequisites You have a catalog installed. You have downloaded a local copy of the catalog file. You have an Operator or extension installed. You have installed the jq CLI tool. Procedure Inspect a package for channel and version information from a local copy of your catalog file by completing the following steps: Get a list of channels from a selected package by running the following command: USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select( .package == "<package_name>") | \ .name' /<path>/<catalog_name>.json Example 5.15. Example command USD jq -s '.[] | select( .schema == "olm.channel" ) | \ select( .package == "openshift-pipelines-operator-rh") | \ .name' /home/username/rhoc.json Example 5.16. Example output "latest" "pipelines-1.11" "pipelines-1.12" "pipelines-1.13" "pipelines-1.14" Get a list of the versions published in a channel by running the following command: USD jq -s '.[] | select( .package == "<package_name>" ) | \ select( .schema == "olm.channel" ) | \ select( .name == "<channel_name>" ) | .entries | \ .[] | .name' /<path>/<catalog_name>.json Example 5.17. Example command USD jq -s '.[] | select( .package == "openshift-pipelines-operator-rh" ) | \ select( .schema == "olm.channel" ) | select( .name == "latest" ) | \ .entries | .[] | .name' /home/username/rhoc.json Example 5.18. Example output "openshift-pipelines-operator-rh.v1.11.1" "openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.14.1" "openshift-pipelines-operator-rh.v1.14.2" "openshift-pipelines-operator-rh.v1.14.3" "openshift-pipelines-operator-rh.v1.14.4" Find out what version or channel is specified in your Operator or extension's CR by running the following command: USD oc get clusterextension <operator_name> -o yaml Example command USD oc get clusterextension pipelines-operator -o yaml Example 5.19. Example output apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"\u003c1.12"}} creationTimestamp: "2024-06-11T15:55:37Z" generation: 1 name: pipelines-operator resourceVersion: "69776" uid: 6a11dff3-bfa3-42b8-9e5f-d8babbd6486f spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: <1.12 status: conditions: - lastTransitionTime: "2024-06-11T15:56:09Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:e09d37bb1e754db42324fd18c1cb3e7ce77e7b7fcbf4932d0535391579938280" observedGeneration: 1 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-11T15:55:50Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:e09d37bb1e754db42324fd18c1cb3e7ce77e7b7fcbf4932d0535391579938280" observedGeneration: 1 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: BundleDeprecated installedBundle: name: openshift-pipelines-operator-rh.v1.11.1 version: 1.11.1 resolvedBundle: name: openshift-pipelines-operator-rh.v1.11.1 version: 1.11.1 Edit your CR by using one of the following methods: If you want to pin your Operator or extension to specific version, such as 1.12.1 , edit your CR similar to the following example: Example pipelines-operator.yaml CR apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> version: "1.12.1" 1 1 Update the version from 1.11.1 to 1.12.1 If you want to define a range of acceptable update versions, edit your CR similar to the following example: Example CR with a version range specified apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> version: ">1.11.1, <1.13" 1 1 Specifies that the desired version range is greater than version 1.11.1 and less than 1.13 . For more information, see "Support for version ranges" and "Version comparison strings". If you want to update to the latest version that can be resolved from a channel, edit your CR similar to the following example: Example CR with a specified channel apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> channel: pipelines-1.13 1 1 Installs the latest release that can be resolved from the specified channel. Updates to the channel are automatically installed. If you want to specify a channel and version or version range, edit your CR similar to the following example: Example CR with a specified channel and version range apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> channel: latest version: "<1.13" For more information, see "Example custom resources (CRs) that specify a target version". Apply the update to the cluster by running the following command: USD oc apply -f pipelines-operator.yaml Example output clusterextension.olm.operatorframework.io/pipelines-operator configured Tip You can patch and apply the changes to your CR from the CLI by running the following command: USD oc patch clusterextension/pipelines-operator -p \ '{"spec":{"version":"<1.13"}}' \ --type=merge Example output clusterextension.olm.operatorframework.io/pipelines-operator patched Verification Verify that the channel and version updates have been applied by running the following command: USD oc get clusterextension pipelines-operator -o yaml Example 5.20. Example output apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"\u003c1.13"}} creationTimestamp: "2024-06-11T18:23:26Z" generation: 2 name: pipelines-operator resourceVersion: "66310" uid: ce0416ba-13ea-4069-a6c8-e5efcbc47537 spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: <1.13 status: conditions: - lastTransitionTime: "2024-06-11T18:23:33Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:814742c8a7cc7e2662598e114c35c13993a7b423cfe92548124e43ea5d469f82" observedGeneration: 2 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-11T18:23:52Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:814742c8a7cc7e2662598e114c35c13993a7b423cfe92548124e43ea5d469f82" observedGeneration: 2 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: BundleDeprecated installedBundle: name: openshift-pipelines-operator-rh.v1.12.2 version: 1.12.2 resolvedBundle: name: openshift-pipelines-operator-rh.v1.12.2 version: 1.12.2 Troubleshooting If you specify a target version or channel that is deprecated or does not exist, you can run the following command to check the status of your extension: USD oc get clusterextension <operator_name> -o yaml Example 5.21. Example output for a version that does not exist apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"3.0"}} creationTimestamp: "2024-06-11T18:23:26Z" generation: 3 name: pipelines-operator resourceVersion: "71852" uid: ce0416ba-13ea-4069-a6c8-e5efcbc47537 spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: "3.0" status: conditions: - lastTransitionTime: "2024-06-11T18:29:02Z" message: 'error upgrading from currently installed version "1.12.2": no package "openshift-pipelines-operator-rh" matching version "3.0" found in channel "latest"' observedGeneration: 3 reason: ResolutionFailed status: "False" type: Resolved - lastTransitionTime: "2024-06-11T18:29:02Z" message: installation has not been attempted as resolution failed observedGeneration: 3 reason: InstallationStatusUnknown status: Unknown type: Installed - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: Deprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: PackageDeprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: ChannelDeprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: BundleDeprecated Additional resources Upgrade edges 5.1.6. Deleting an Operator You can delete an Operator and its custom resource definitions (CRDs) by deleting the ClusterExtension custom resource (CR). Prerequisites You have a catalog installed. You have an Operator installed. Procedure Delete an Operator and its CRDs by running the following command: USD oc delete clusterextension <operator_name> Example output clusterextension.olm.operatorframework.io "<operator_name>" deleted Verification Run the following commands to verify that your Operator and its resources were deleted: Verify the Operator is deleted by running the following command: USD oc get clusterextensions Example output No resources found Verify that the Operator's system namespace is deleted by running the following command: USD oc get ns <operator_name>-system Example output Error from server (NotFound): namespaces "<operator_name>-system" not found 5.2. Upgrade edges Important Operator Lifecycle Manager (OLM) v1 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . When determining upgrade edges, also known as upgrade paths or upgrade constraints, for an installed cluster extension, Operator Lifecycle Manager (OLM) v1 supports existing OLM semantics starting in OpenShift Container Platform 4.16. This support follows the behavior from existing OLM, including replaces , skips , and skipRange directives, with a few noted differences. By supporting existing OLM semantics, OLM v1 now honors the upgrade graph from catalogs accurately. Important Currently, Operator Lifecycle Manager (OLM) v1 cannot authenticate private registries, such as the Red Hat-provided Operator catalogs. This is a known issue. As a result, the OLM v1 procedures that rely on having the Red Hat Operators catalog installed do not work. ( OCPBUGS-36364 ) Differences from original existing OLM implementation If there are multiple possible successors, OLM v1 behavior differs in the following ways: In existing OLM, the successor closest to the channel head is chosen. In OLM v1, the successor with the highest semantic version (semver) is chosen. Consider the following set of file-based catalog (FBC) channel entries: # ... - name: example.v3.0.0 skips: ["example.v2.0.0"] - name: example.v2.0.0 skipRange: >=1.0.0 <2.0.0 If 1.0.0 is installed, OLM v1 behavior differs in the following ways: Existing OLM will not detect an upgrade edge to v2.0.0 because v2.0.0 is skipped and not on the replaces chain. OLM v1 will detect the upgrade edge because OLM v1 does not have a concept of a replaces chain. OLM v1 finds all entries that have a replace , skip , or skipRange value that covers the currently installed version. Additional resources Existing OLM upgrade semantics 5.2.1. Support for version ranges In Operator Lifecycle Manager (OLM) v1, you can specify a version range by using a comparison string in an Operator or extension's custom resource (CR). If you specify a version range in the CR, OLM v1 installs or updates to the latest version of the Operator that can be resolved within the version range. Resolved version workflow The resolved version is the latest version of the Operator that satisfies the constraints of the Operator and the environment. An Operator update within the specified range is automatically installed if it is resolved successfully. An update is not installed if it is outside of the specified range or if it cannot be resolved successfully. 5.2.2. Version comparison strings You can define a version range by adding a comparison string to the spec.version field in an Operator or extension's custom resource (CR). A comparison string is a list of space- or comma-separated values and one or more comparison operators enclosed in double quotation marks ( " ). You can add another comparison string by including an OR , or double vertical bar ( || ), comparison operator between the strings. Table 5.4. Basic comparisons Comparison operator Definition = Equal to != Not equal to > Greater than < Less than >= Greater than or equal to <= Less than or equal to You can specify a version range in an Operator or extension's CR by using a range comparison similar to the following example: Example version range comparison apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> version: ">=1.11, <1.13" You can use wildcard characters in all types of comparison strings. OLM v1 accepts x , X , and asterisks ( * ) as wildcard characters. When you use a wildcard character with the equal sign ( = ) comparison operator, you define a comparison at the patch or minor version level. Table 5.5. Example wildcard characters in comparison strings Wildcard comparison Matching string 1.11.x >=1.11.0, <1.12.0 >=1.12.X >=1.12.0 <=2.x <3 * >=0.0.0 You can make patch release comparisons by using the tilde ( ~ ) comparison operator. Patch release comparisons specify a minor version up to the major version. Table 5.6. Example patch release comparisons Patch release comparison Matching string ~1.11.0 >=1.11.0, <1.12.0 ~1 >=1, <2 ~1.12 >=1.12, <1.13 ~1.12.x >=1.12.0, <1.13.0 ~1.x >=1, <2 You can use the caret ( ^ ) comparison operator to make a comparison for a major release. If you make a major release comparison before the first stable release is published, the minor versions define the API's level of stability. In the semantic versioning (semver) specification, the first stable release is published as the 1.0.0 version. Table 5.7. Example major release comparisons Major release comparison Matching string ^0 >=0.0.0, <1.0.0 ^0.0 >=0.0.0, <0.1.0 ^0.0.3 >=0.0.3, <0.0.4 ^0.2 >=0.2.0, <0.3.0 ^0.2.3 >=0.2.3, <0.3.0 ^1.2.x >= 1.2.0, < 2.0.0 ^1.2.3 >= 1.2.3, < 2.0.0 ^2.x >= 2.0.0, < 3 ^2.3 >= 2.3, < 3 5.2.3. Example custom resources (CRs) that specify a target version In Operator Lifecycle Manager (OLM) v1, cluster administrators can declaratively set the target version of an Operator or extension in the custom resource (CR). You can define a target version by specifying any of the following fields: Channel Version number Version range If you specify a channel in the CR, OLM v1 installs the latest version of the Operator or extension that can be resolved within the specified channel. When updates are published to the specified channel, OLM v1 automatically updates to the latest release that can be resolved from the channel. Example CR with a specified channel apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> channel: latest 1 1 Installs the latest release that can be resolved from the specified channel. Updates to the channel are automatically installed. If you specify the Operator or extension's target version in the CR, OLM v1 installs the specified version. When the target version is specified in the CR, OLM v1 does not change the target version when updates are published to the catalog. If you want to update the version of the Operator that is installed on the cluster, you must manually edit the Operator's CR. Specifying an Operator's target version pins the Operator's version to the specified release. Example CR with the target version specified apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> version: "1.11.1" 1 1 Specifies the target version. If you want to update the version of the Operator or extension that is installed, you must manually update this field the CR to the desired target version. If you want to define a range of acceptable versions for an Operator or extension, you can specify a version range by using a comparison string. When you specify a version range, OLM v1 installs the latest version of an Operator or extension that can be resolved by the Operator Controller. Example CR with a version range specified apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> version: ">1.11.1" 1 1 Specifies that the desired version range is greater than version 1.11.1 . For more information, see "Support for version ranges". After you create or update a CR, apply the configuration file by running the following command: Command syntax USD oc apply -f <extension_name>.yaml 5.2.4. Forcing an update or rollback OLM v1 does not support automatic updates to the major version or rollbacks to an earlier version. If you want to perform a major version update or rollback, you must verify and force the update manually. Warning You must verify the consequences of forcing a manual update or rollback. Failure to verify a forced update or rollback might have catastrophic consequences such as data loss. Prerequisites You have a catalog installed. You have an Operator or extension installed. You have created a service account and assigned enough role-based access controls (RBAC) to install, update, and manage the extension you want to install. For more information, see Creating a service account . Procedure Edit the custom resource (CR) of your Operator or extension as shown in the following example: Example CR apiVersion: olm.operatorframework.io/v1alpha1 kind: Operator metadata: name: <operator_name> 1 spec: packageName: <package_name> 2 installNamespace: <namespace_name> serviceAccount: name: <service_account> version: <version> 3 upgradeConstraintPolicy: Ignore 4 1 Specifies the name of the Operator or extension, such as pipelines-operator 2 Specifies the package name, such as openshift-pipelines-operator-rh . 3 Specifies the blocked update or rollback version. 4 Optional: Specifies the upgrade constraint policy. To force an update or rollback, set the field to Ignore . If unspecified, the default setting is Enforce . Apply the changes to your Operator or extensions CR by running the following command: USD oc apply -f <extension_name>.yaml Additional resources Support for version ranges 5.3. Custom resource definition (CRD) upgrade safety Important Operator Lifecycle Manager (OLM) v1 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . When you update a custom resource definition (CRD) that is provided by a cluster extension, Operator Lifecycle Manager (OLM) v1 runs a CRD upgrade safety preflight check to ensure backwards compatibility with versions of that CRD. The CRD update must pass the validation checks before the change is allowed to progress on a cluster. Additional resources Updating a cluster extension 5.3.1. Prohibited CRD upgrade changes The following changes to an existing custom resource definition (CRD) are caught by the CRD upgrade safety preflight check and prevent the upgrade: A new required field is added to an existing version of the CRD An existing field is removed from an existing version of the CRD An existing field type is changed in an existing version of the CRD A new default value is added to a field that did not previously have a default value The default value of a field is changed An existing default value of a field is removed New enum restrictions are added to an existing field which did not previously have enum restrictions Existing enum values from an existing field are removed The minimum value of an existing field is increased in an existing version The maximum value of an existing field is decreased in an existing version Minimum or maximum field constraints are added to a field that did not previously have constraints Note The rules for changes to minimum and maximum values apply to minimum , minLength , minProperties , minItems , maximum , maxLength , maxProperties , and maxItems constraints. The following changes to an existing CRD are reported by the CRD upgrade safety preflight check and prevent the upgrade, though the operations are technically handled by the Kubernetes API server: The scope changes from Cluster to Namespace or from Namespace to Cluster An existing stored version of the CRD is removed If the CRD upgrade safety preflight check encounters one of the prohibited upgrade changes, it logs an error for each prohibited change detected in the CRD upgrade. Tip In cases where a change to the CRD does not fall into one of the prohibited change categories, but is also unable to be properly detected as allowed, the CRD upgrade safety preflight check will prevent the upgrade and log an error for an "unknown change". 5.3.2. Allowed CRD upgrade changes The following changes to an existing custom resource definition (CRD) are safe for backwards compatibility and will not cause the CRD upgrade safety preflight check to halt the upgrade: Adding new enum values to the list of allowed enum values in a field An existing required field is changed to optional in an existing version The minimum value of an existing field is decreased in an existing version The maximum value of an existing field is increased in an existing version A new version of the CRD is added with no modifications to existing versions 5.3.3. Disabling CRD upgrade safety preflight check The custom resource definition (CRD) upgrade safety preflight check can be disabled by adding the preflight.crdUpgradeSafety.disabled field with a value of true to the ClusterExtension object that provides the CRD. Warning Disabling the CRD upgrade safety preflight check could break backwards compatibility with stored versions of the CRD and cause other unintended consequences on the cluster. You cannot disable individual field validators. If you disable the CRD upgrade safety preflight check, all field validators are disabled. Note The following checks are handled by the Kubernetes API server: The scope changes from Cluster to Namespace or from Namespace to Cluster An existing stored version of the CRD is removed After disabling the CRD upgrade safety preflight check via Operator Lifecycle Manager (OLM) v1, these two operations are still prevented by Kubernetes. Prerequisites You have a cluster extension installed. Procedure Edit the ClusterExtension object of the CRD: USD oc edit clusterextension <clusterextension_name> Set the preflight.crdUpgradeSafety.disabled field to true : Example 5.22. Example ClusterExtension object apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: clusterextension-sample spec: installNamespace: default packageName: argocd-operator version: 0.6.0 preflight: crdUpgradeSafety: disabled: true 1 1 Set to true . 5.3.4. Examples of unsafe CRD changes The following examples demonstrate specific changes to sections of an example custom resource definition (CRD) that would be caught by the CRD upgrade safety preflight check. For the following examples, consider a CRD object in the following starting state: Example 5.23. Example CRD object apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.13.0 name: example.test.example.com spec: group: test.example.com names: kind: Sample listKind: SampleList plural: samples singular: sample scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object served: true storage: true subresources: status: {} 5.3.4.1. Scope change In the following custom resource definition (CRD) example, the scope field is changed from Namespaced to Cluster : Example 5.24. Example scope change in a CRD spec: group: test.example.com names: kind: Sample listKind: SampleList plural: samples singular: sample scope: Cluster versions: - name: v1alpha1 Example 5.25. Example error output validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoScopeChange" validation failed: scope changed from "Namespaced" to "Cluster" 5.3.4.2. Removal of a stored version In the following custom resource definition (CRD) example, the existing stored version, v1alpha1 , is removed: Example 5.26. Example removal of a stored version in a CRD versions: - name: v1alpha2 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object Example 5.27. Example error output validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoStoredVersionRemoved" validation failed: stored version "v1alpha1" removed 5.3.4.3. Removal of an existing field In the following custom resource definition (CRD) example, the pollInterval property field is removed from the v1alpha1 schema: Example 5.28. Example removal of an existing field in a CRD versions: - name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object type: object Example 5.29. Example error output validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoExistingFieldRemoved" validation failed: crd/test.example.com version/v1alpha1 field/^.spec.pollInterval may not be removed 5.3.4.4. Addition of a required field In the following custom resource definition (CRD) example, the pollInterval property has been changed to a required field: Example 5.30. Example addition of a required field in a CRD versions: - name: v1alpha2 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object required: - pollInterval Example 5.31. Example error output validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "ChangeValidator" validation failed: version "v1alpha1", field "^": new required fields added: [pollInterval]

Commands:
oc -n openshift-catalogd port-forward svc/catalogd-catalogserver 8080:443
curl -L -k https://localhost:8080/catalogs/<catalog_name>/all.json -C - -o /<path>/<catalog_name>.json
curl -L -k https://localhost:8080/catalogs/redhat-operators/all.json -C - -o /home/username/catalogs/rhoc.json
jq -s '.[] | select(.schema == "olm.package") | .name' /<path>/<filename>.json
jq -s '.[] | select(.schema == "olm.package") | .name' /home/username/catalogs/rhoc.json
NAME AGE "3scale-operator" "advanced-cluster-management" "amq-broker-rhel8" "amq-online" "amq-streams" "amq7-interconnect-operator" "ansible-automation-platform-operator" "ansible-cloud-addons-operator" "apicast-operator" "aws-efs-csi-driver-operator" "aws-load-balancer-operator" "bamoe-businessautomation-operator" "bamoe-kogito-operator" "bare-metal-event-relay" "businessautomation-operator"
jq -c 'select(.schema == "olm.bundle") | {"package":.package, "version":.properties[] | select(.type == "olm.bundle.object").value.data | @base64d | fromjson | select(.kind == "ClusterServiceVersion" and (.spec.installModes[] | select(.type == "AllNamespaces" and .supported == true) != null) and .spec.webhookdefinitions == null).spec.version}' /<path>/<catalog_name>.json
{"package":"3scale-operator","version":"0.10.0-mas"} {"package":"3scale-operator","version":"0.10.5"} {"package":"3scale-operator","version":"0.11.0-mas"} {"package":"3scale-operator","version":"0.11.1-mas"} {"package":"3scale-operator","version":"0.11.2-mas"} {"package":"3scale-operator","version":"0.11.3-mas"} {"package":"3scale-operator","version":"0.11.5-mas"} {"package":"3scale-operator","version":"0.11.6-mas"} {"package":"3scale-operator","version":"0.11.7-mas"} {"package":"3scale-operator","version":"0.11.8-mas"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-2"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-3"} {"package":"amq-broker-rhel8","version":"7.10.0-opr-4"} {"package":"amq-broker-rhel8","version":"7.10.1-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.1-opr-2"} {"package":"amq-broker-rhel8","version":"7.10.2-opr-1"} {"package":"amq-broker-rhel8","version":"7.10.2-opr-2"}
jq -s '.[] | select( .schema == "olm.package") | select( .name == "<package_name>")' /<path>/<catalog_name>.json
jq -s '.[] | select( .schema == "olm.package") | select( .name == "openshift-pipelines-operator-rh")' /home/username/rhoc.json
{ "defaultChannel": "stable", "icon": { "base64data": "PHN2ZyB4bWxu..." "mediatype": "image/png" }, "name": "openshift-pipelines-operator-rh", "schema": "olm.package" }
jq -s '.[] | select( .schema == "olm.package") | .name' <catalog_name>.json
jq -c 'select(.schema == "olm.bundle") | {"package":.package, "version":.properties[] | select(.type == "olm.bundle.object").value.data | @base64d | fromjson | select(.kind == "ClusterServiceVersion" and (.spec.installModes[] | select(.type == "AllNamespaces" and .supported == true) != null) and .spec.webhookdefinitions == null).spec.version}' <catalog_name>.json
jq -s '.[] | select( .schema == "olm.package") | select( .name == "<package_name>")' <catalog_name>.json
jq -s '.[] | select( .package == "<package_name>")' <catalog_name>.json
jq -s '.[] | select( .schema == "olm.channel" ) | select( .package == "<package_name>") | .name' <catalog_name>.json
jq -s '.[] | select( .package == "<package_name>" ) | select( .schema == "olm.channel" ) | select( .name == "<channel_name>" ) | .entries | .[] | .name' <catalog_name>.json
jq -s '.[] | select( .schema == "olm.channel" ) | select ( .name == "<channel>") | select( .package == "<package_name>")' <catalog_name>.json
jq -s '.[] | select( .schema == "olm.bundle" ) | select( .package == "<package_name>") | .name' <catalog_name>.json
jq -s '.[] | select( .schema == "olm.bundle" ) | select ( .name == "<bundle_name>") | select( .package == "<package_name>")' <catalog_name>.json
apiVersion: v1 kind: ServiceAccount metadata: name: <extension>-installer namespace: <namespace>
apiVersion: v1 kind: ServiceAccount metadata: name: pipelines-installer namespace: pipelines
oc apply -f extension-service-account.yaml
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: <extension>-installer-clusterrole rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pipelines-installer-clusterrole rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]
oc apply -f pipelines-role.yaml
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: <extension>-installer-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: <extension>-installer-clusterrole subjects: - kind: ServiceAccount name: <extension>-installer namespace: <namespace>
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pipelines-installer-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pipelines-installer-clusterrole subjects: - kind: ServiceAccount name: pipelines-installer namespace: pipelines
oc apply -f pipelines-cluster-role-binding.yaml
jq -s '.[] | select( .schema == "olm.channel" ) | select( .package == "<package_name>") | .name' /<path>/<catalog_name>.json
jq -s '.[] | select( .schema == "olm.channel" ) | select( .package == "openshift-pipelines-operator-rh") | .name' /home/username/rhoc.json
"latest" "pipelines-1.11" "pipelines-1.12" "pipelines-1.13" "pipelines-1.14"
jq -s '.[] | select( .package == "<package_name>" ) | select( .schema == "olm.channel" ) | select( .name == "<channel_name>" ) | .entries | .[] | .name' /<path>/<catalog_name>.json
jq -s '.[] | select( .package == "openshift-pipelines-operator-rh" ) | select( .schema == "olm.channel" ) | select( .name == "latest" ) | .entries | .[] | .name' /home/username/rhoc.json
"openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.13.1" "openshift-pipelines-operator-rh.v1.11.1" "openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.14.1" "openshift-pipelines-operator-rh.v1.14.2" "openshift-pipelines-operator-rh.v1.14.3" "openshift-pipelines-operator-rh.v1.14.4"
oc adm new-project <new_namespace>
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> serviceAccount: name: <service_account> channel: <channel> version: "<version>"
oc apply -f pipeline-operator.yaml
clusterextension.olm.operatorframework.io/pipelines-operator created
oc get clusterextension pipelines-operator -o yaml
apiVersion: v1 items: - apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"pipelines","packageName":"openshift-pipelines-operator-rh","serviceAccount":{"name":"pipelines-installer"},"pollInterval":"30m"}} creationTimestamp: "2024-06-10T17:50:51Z" finalizers: - olm.operatorframework.io/cleanup-unpack-cache generation: 1 name: pipelines-operator resourceVersion: "53324" uid: c54237be-cde4-46d4-9b31-d0ec6acc19bf spec: channel: latest installNamespace: pipelines packageName: openshift-pipelines-operator-rh serviceAccount: name: pipelines-installer upgradeConstraintPolicy: Enforce status: conditions: - lastTransitionTime: "2024-06-10T17:50:58Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:dd3d18367da2be42539e5dde8e484dac3df33ba3ce1d5bcf896838954f3864ec" observedGeneration: 1 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-10T17:51:11Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:dd3d18367da2be42539e5dde8e484dac3df33ba3ce1d5bcf896838954f3864ec" observedGeneration: 1 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: BundleDeprecated - lastTransitionTime: "2024-06-10T17:50:58Z" message: 'unpack successful: observedGeneration: 1 reason: UnpackSuccess status: "True" type: Unpacked installedBundle: name: openshift-pipelines-operator-rh.v1.14.4 version: 1.14.4 resolvedBundle: name: openshift-pipelines-operator-rh.v1.14.4 version: 1.14.4
jq -s '.[] | select( .schema == "olm.channel" ) | select( .package == "<package_name>") | .name' /<path>/<catalog_name>.json
jq -s '.[] | select( .schema == "olm.channel" ) | select( .package == "openshift-pipelines-operator-rh") | .name' /home/username/rhoc.json
"latest" "pipelines-1.11" "pipelines-1.12" "pipelines-1.13" "pipelines-1.14"
jq -s '.[] | select( .package == "<package_name>" ) | select( .schema == "olm.channel" ) | select( .name == "<channel_name>" ) | .entries | .[] | .name' /<path>/<catalog_name>.json
jq -s '.[] | select( .package == "openshift-pipelines-operator-rh" ) | select( .schema == "olm.channel" ) | select( .name == "latest" ) | .entries | .[] | .name' /home/username/rhoc.json
"openshift-pipelines-operator-rh.v1.11.1" "openshift-pipelines-operator-rh.v1.12.0" "openshift-pipelines-operator-rh.v1.12.1" "openshift-pipelines-operator-rh.v1.12.2" "openshift-pipelines-operator-rh.v1.13.0" "openshift-pipelines-operator-rh.v1.14.1" "openshift-pipelines-operator-rh.v1.14.2" "openshift-pipelines-operator-rh.v1.14.3" "openshift-pipelines-operator-rh.v1.14.4"
oc get clusterextension <operator_name> -o yaml
oc get clusterextension pipelines-operator -o yaml
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"\u003c1.12"}} creationTimestamp: "2024-06-11T15:55:37Z" generation: 1 name: pipelines-operator resourceVersion: "69776" uid: 6a11dff3-bfa3-42b8-9e5f-d8babbd6486f spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: <1.12 status: conditions: - lastTransitionTime: "2024-06-11T15:56:09Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:e09d37bb1e754db42324fd18c1cb3e7ce77e7b7fcbf4932d0535391579938280" observedGeneration: 1 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-11T15:55:50Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:e09d37bb1e754db42324fd18c1cb3e7ce77e7b7fcbf4932d0535391579938280" observedGeneration: 1 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-11T15:55:50Z" message: "" observedGeneration: 1 reason: Deprecated status: "False" type: BundleDeprecated installedBundle: name: openshift-pipelines-operator-rh.v1.11.1 version: 1.11.1 resolvedBundle: name: openshift-pipelines-operator-rh.v1.11.1 version: 1.11.1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> version: "1.12.1" 1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> version: ">1.11.1, <1.13" 1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> channel: pipelines-1.13 1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace> channel: latest version: "<1.13"
oc apply -f pipelines-operator.yaml
clusterextension.olm.operatorframework.io/pipelines-operator configured
oc patch clusterextension/pipelines-operator -p '{"spec":{"version":"<1.13"}}' --type=merge
clusterextension.olm.operatorframework.io/pipelines-operator patched
oc get clusterextension pipelines-operator -o yaml
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"\u003c1.13"}} creationTimestamp: "2024-06-11T18:23:26Z" generation: 2 name: pipelines-operator resourceVersion: "66310" uid: ce0416ba-13ea-4069-a6c8-e5efcbc47537 spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: <1.13 status: conditions: - lastTransitionTime: "2024-06-11T18:23:33Z" message: resolved to "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:814742c8a7cc7e2662598e114c35c13993a7b423cfe92548124e43ea5d469f82" observedGeneration: 2 reason: Success status: "True" type: Resolved - lastTransitionTime: "2024-06-11T18:23:52Z" message: installed from "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:814742c8a7cc7e2662598e114c35c13993a7b423cfe92548124e43ea5d469f82" observedGeneration: 2 reason: Success status: "True" type: Installed - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: Deprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: PackageDeprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: ChannelDeprecated - lastTransitionTime: "2024-06-11T18:23:33Z" message: "" observedGeneration: 2 reason: Deprecated status: "False" type: BundleDeprecated installedBundle: name: openshift-pipelines-operator-rh.v1.12.2 version: 1.12.2 resolvedBundle: name: openshift-pipelines-operator-rh.v1.12.2 version: 1.12.2
oc get clusterextension <operator_name> -o yaml
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"olm.operatorframework.io/v1alpha1","kind":"ClusterExtension","metadata":{"annotations":{},"name":"pipelines-operator"},"spec":{"channel":"latest","installNamespace":"openshift-operators","packageName":"openshift-pipelines-operator-rh","pollInterval":"30m","version":"3.0"}} creationTimestamp: "2024-06-11T18:23:26Z" generation: 3 name: pipelines-operator resourceVersion: "71852" uid: ce0416ba-13ea-4069-a6c8-e5efcbc47537 spec: channel: latest installNamespace: openshift-operators packageName: openshift-pipelines-operator-rh upgradeConstraintPolicy: Enforce version: "3.0" status: conditions: - lastTransitionTime: "2024-06-11T18:29:02Z" message: 'error upgrading from currently installed version "1.12.2": no package "openshift-pipelines-operator-rh" matching version "3.0" found in channel "latest"' observedGeneration: 3 reason: ResolutionFailed status: "False" type: Resolved - lastTransitionTime: "2024-06-11T18:29:02Z" message: installation has not been attempted as resolution failed observedGeneration: 3 reason: InstallationStatusUnknown status: Unknown type: Installed - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: Deprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: PackageDeprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: ChannelDeprecated - lastTransitionTime: "2024-06-11T18:29:02Z" message: deprecation checks have not been attempted as resolution failed observedGeneration: 3 reason: Deprecated status: Unknown type: BundleDeprecated
oc delete clusterextension <operator_name>
clusterextension.olm.operatorframework.io "<operator_name>" deleted
oc get clusterextensions
No resources found
oc get ns <operator_name>-system
Error from server (NotFound): namespaces "<operator_name>-system" not found
- name: example.v3.0.0 skips: ["example.v2.0.0"] - name: example.v2.0.0 skipRange: >=1.0.0 <2.0.0
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> version: ">=1.11, <1.13"
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> channel: latest 1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> version: "1.11.1" 1
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: pipelines-operator spec: packageName: openshift-pipelines-operator-rh installNamespace: <namespace_name> serviceAccount: name: <service_account> version: ">1.11.1" 1
oc apply -f <extension_name>.yaml
apiVersion: olm.operatorframework.io/v1alpha1 kind: Operator metadata: name: <operator_name> 1 spec: packageName: <package_name> 2 installNamespace: <namespace_name> serviceAccount: name: <service_account> version: <version> 3 upgradeConstraintPolicy: Ignore 4
oc apply -f <extension_name>.yaml
oc edit clusterextension <clusterextension_name>
apiVersion: olm.operatorframework.io/v1alpha1 kind: ClusterExtension metadata: name: clusterextension-sample spec: installNamespace: default packageName: argocd-operator version: 0.6.0 preflight: crdUpgradeSafety: disabled: true 1
apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.13.0 name: example.test.example.com spec: group: test.example.com names: kind: Sample listKind: SampleList plural: samples singular: sample scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object served: true storage: true subresources: status: {}
spec: group: test.example.com names: kind: Sample listKind: SampleList plural: samples singular: sample scope: Cluster versions: - name: v1alpha1
validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoScopeChange" validation failed: scope changed from "Namespaced" to "Cluster"
versions: - name: v1alpha2 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object
validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoStoredVersionRemoved" validation failed: stored version "v1alpha1" removed
versions: - name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object type: object
validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "NoExistingFieldRemoved" validation failed: crd/test.example.com version/v1alpha1 field/^.spec.pollInterval may not be removed
versions: - name: v1alpha2 schema: openAPIV3Schema: properties: apiVersion: type: string kind: type: string metadata: type: object spec: type: object status: type: object pollInterval: type: string type: object required: - pollInterval
validating upgrade for CRD "test.example.com" failed: CustomResourceDefinition test.example.com failed upgrade safety validation. "ChangeValidator" validation failed: version "v1alpha1", field "^": new required fields added: [pollInterval]