Skip to content

Commit d810024

Browse files
tolushadeerskindoll
tolusha
and
deerskindoll
authored
chore: Minimal set of permissions to deploy che on openshift (#2794)
* chore: Minimal set of permissions to deploy che on openshift Signed-off-by: Anatolii Bazko <abazko@redhat.com> * Add articles to nav.adoc Signed-off-by: Anatolii Bazko <abazko@redhat.com> * Add additional resources Signed-off-by: Anatolii Bazko <abazko@redhat.com> * Update modules/administration-guide/pages/permissions-to-install-che-on-openshift-using-the-web-console.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/permissions-to-install-che-on-openshift-using-cli.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/permissions-to-install-che.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> --------- Signed-off-by: Anatolii Bazko <abazko@redhat.com> Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com>
1 parent af356b0 commit d810024

6 files changed

+128
-0
lines changed

‎modules/administration-guide/nav.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
*** xref:installing-che-on-minikube.adoc[]
2727
*** xref:installing-che-on-minikube-keycloak-oidc.adoc[]
2828
** xref:finding-the-fully-qualified-domain-name-fqdn.adoc[]
29+
** xref:permissions-to-install-che.adoc[]
30+
*** xref:permissions-to-install-che-on-openshift-using-cli.adoc[]
31+
*** xref:permissions-to-install-che-on-openshift-using-the-web-console.adoc[]
2932
* xref:configuring-che.adoc[]
3033
** xref:understanding-the-checluster-custom-resource.adoc[]
3134
*** xref:using-chectl-to-configure-the-checluster-custom-resource-during-installation.adoc[]

‎modules/administration-guide/pages/installing-che-on-openshift-using-cli.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,7 @@ $ {prod-cli} server:status
4949
----
5050
$ {prod-cli} dashboard:open
5151
----
52+
53+
.Additional resources
54+
55+
* xref:permissions-to-install-che-on-openshift-using-cli.adoc[]

‎modules/administration-guide/pages/installing-che-on-openshift-using-the-web-console.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,7 @@ pass:[<!-- vale RedHat.Spelling = YES -->]
5757
. Under *{prod} URL*, wait until the URL of the {prod-short} instance appears, and then open the URL to check the {prod-short} dashboard.
5858

5959
. In the *Resources* tab, view the resources for the {prod-short} deployment and their status.
60+
61+
.Additional resources
62+
63+
* xref:permissions-to-install-che-on-openshift-using-the-web-console.adoc[]

‎modules/administration-guide/pages/permissions-to-install-che-on-openshift-using-cli.adoc

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
:_content-type: REFERENCE
2+
:description: Minimum set of permissions required to install {prod-short} on OpenShift using CLI
3+
:keywords: permissions, openshift, installing, cli
4+
:navtitle: Permissions to install {prod-short} on OpenShift using CLI
5+
6+
[id="permissions-to-install-che-on-openshift-using-cli"]
7+
= Permissions to install {prod-short} on OpenShift using CLI
8+
9+
Below is the minimal set of permissions required to install {prod-short} on an OpenShift cluster using {prod-cli}:
10+
11+
[source,yaml,subs="+quotes,+attributes"]
12+
----
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: {prod-id-short}-install-{prod-cli}
17+
rules:
18+
- apiGroups: ["org.eclipse.che"]
19+
resources: ["checlusters"]
20+
verbs: ["*"]
21+
- apiGroups: ["project.openshift.io"]
22+
resources: ["projects"]
23+
verbs: ["get", "list"]
24+
- apiGroups: [""]
25+
resources: ["namespaces"]
26+
verbs: ["get", "list", "create"]
27+
- apiGroups: [""]
28+
resources: ["pods", "configmaps"]
29+
verbs: ["get", "list"]
30+
- apiGroups: ["route.openshift.io"]
31+
resources: ["routes"]
32+
verbs: ["get", "list"]
33+
# OLM resources permissions
34+
- apiGroups: ["operators.coreos.com"]
35+
resources: ["catalogsources", "subscriptions"]
36+
verbs: ["create", "get", "list", "watch"]
37+
- apiGroups: ["operators.coreos.com"]
38+
resources: ["operatorgroups", "clusterserviceversions"]
39+
verbs: ["get", "list", "watch"]
40+
- apiGroups: ["operators.coreos.com"]
41+
resources: ["installplans"]
42+
verbs: ["patch", "get", "list", "watch"]
43+
- apiGroups: ["packages.operators.coreos.com"]
44+
resources: ["packagemanifests"]
45+
verbs: ["get", "list"]
46+
----
47+
48+
.Additional resources
49+
50+
* https://docs.openshift.com/container-platform/latest/cli_reference/openshift_cli/developer-cli-commands.html#oc-apply[`oc apply` command]
51+
* link:https://docs.openshift.com/container-platform/4.17/cli_reference/openshift_cli/administrator-cli-commands.html#oc-adm-policy-add-cluster-role-to-user[`oc adm policy` command]

‎modules/administration-guide/pages/permissions-to-install-che-on-openshift-using-the-web-console.adoc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
:_content-type: REFERENCE
2+
:description: Minimum set of permissions required to install {prod-short} on OpenShift using the web console
3+
:keywords: permissions, openshift, installing
4+
:navtitle: Permissions to install {prod-short} on OpenShift using web console
5+
6+
[id="permissions-to-install-che-on-openshift-using-the-web-console"]
7+
= Permissions to install {prod-short} on OpenShift using the web console
8+
9+
Below is the minimal set of permissions required to install {prod-short} on an OpenShift cluster using the web console:
10+
11+
[source,yaml,subs="+quotes,+attributes"]
12+
----
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: {prod-id-short}-install-web-console
17+
rules:
18+
- apiGroups: ["org.eclipse.che"]
19+
resources: ["checlusters"]
20+
verbs: ["*"]
21+
- apiGroups: [""]
22+
resources: ["namespaces"]
23+
verbs: ["get", "list", "create"]
24+
- apiGroups: ["project.openshift.io"]
25+
resources: ["projects"]
26+
verbs: ["get", "list", "create"]
27+
# OLM resources permissions
28+
- apiGroups: ["operators.coreos.com"]
29+
resources: ["subscriptions"]
30+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
31+
- apiGroups: ["operators.coreos.com"]
32+
resources: ["operatorgroups"]
33+
verbs: ["get", "list", "watch"]
34+
- apiGroups: ["operators.coreos.com"]
35+
resources: ["clusterserviceversions", "catalogsources", "installplans"]
36+
verbs: ["get", "list", "watch", "delete"]
37+
- apiGroups: ["packages.operators.coreos.com"]
38+
resources: ["packagemanifests", "packagemanifests/icon"]
39+
verbs: ["get", "list", "watch"]
40+
# Workaround related to viewing operators in OperatorHub
41+
- apiGroups: ["operator.openshift.io"]
42+
resources: ["cloudcredentials"]
43+
verbs: ["get", "list", "watch"]
44+
- apiGroups: ["config.openshift.io"]
45+
resources: ["infrastructures", "authentications"]
46+
verbs: ["get", "list", "watch"]
47+
----
48+
49+
.Additional resources
50+
51+
* https://docs.openshift.com/container-platform/latest/cli_reference/openshift_cli/developer-cli-commands.html#oc-apply[`oc apply` command]
52+
* link:https://docs.openshift.com/container-platform/4.17/cli_reference/openshift_cli/administrator-cli-commands.html#oc-adm-policy-add-cluster-role-to-user[`oc adm policy` command]

‎modules/administration-guide/pages/permissions-to-install-che.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
:_content-type: ASSEMBLY
2+
:description: Permissions to install {prod}
3+
:keywords: administration-guide, installing, permissions
4+
:navtitle: Permissions to install Che
5+
:page-aliases:
6+
7+
[id="permissions-to-install-che"]
8+
= Permissions to install {prod-short}
9+
10+
Learn about the permissions required to install {prod} on different {kubernetes} clusters.
11+
12+
* xref:permissions-to-install-che-on-openshift-using-cli.adoc[]
13+
14+
* xref:permissions-to-install-che-on-openshift-using-the-web-console.adoc[]

0 commit comments

Comments
 (0)