Merge pull request #376 from venkateshsredhat/feature-MTSRE-1335

Make sure catalogsource resources used by OLM operator are compatible with restricted SCC enforcement

Author: openshift-merge-robot

config/olm/catalog-source.yaml

@@ -5,6 +5,8 @@ metadata:
   namespace: olm
 spec:
   sourceType: grpc
+  grpcPodConfig:
+    securityContextConfig: restricted
   publisher: Red Hat
   displayName: MTSRE Addon Operator
   image: quay.io/app-sre/addon-operator-index:main

hack/olm-registry/olm-artifacts-template.yaml

@@ -69,6 +69,7 @@ objects:
                 - effect: NoSchedule
                   key: node-role.kubernetes.io/infra
                   operator: Exists
+              securityContextConfig: restricted
         - apiVersion: operators.coreos.com/v1
           kind: OperatorGroup
           metadata:

internal/controllers/addon/phase_ensure_catalogsource.go

@@ -37,10 +37,11 @@ func (r *olmReconciler) ensureCatalogSource(
 			Namespace: commonConfig.Namespace,
 		},
 		Spec: operatorsv1alpha1.CatalogSourceSpec{
-			SourceType:  operatorsv1alpha1.SourceTypeGrpc,
-			Publisher:   catalogSourcePublisher,
-			DisplayName: addon.Spec.DisplayName,
-			Image:       commonConfig.CatalogSourceImage,
+			SourceType:    operatorsv1alpha1.SourceTypeGrpc,
+			Publisher:     catalogSourcePublisher,
+			DisplayName:   addon.Spec.DisplayName,
+			Image:         commonConfig.CatalogSourceImage,
+			GrpcPodConfig: &operatorsv1alpha1.GrpcPodConfig{SecurityContextConfig: operatorsv1alpha1.Restricted},
 		},
 	}
 	if len(commonConfig.PullSecretName) > 0 {
@@ -103,10 +104,11 @@ func (r *olmReconciler) ensureAdditionalCatalogSources(
 				Namespace: targetNamespace,
 			},
 			Spec: operatorsv1alpha1.CatalogSourceSpec{
-				SourceType:  operatorsv1alpha1.SourceTypeGrpc,
-				Publisher:   catalogSourcePublisher,
-				DisplayName: addon.Spec.DisplayName,
-				Image:       additionalCatalogSrc.Image,
+				SourceType:    operatorsv1alpha1.SourceTypeGrpc,
+				Publisher:     catalogSourcePublisher,
+				DisplayName:   addon.Spec.DisplayName,
+				Image:         additionalCatalogSrc.Image,
+				GrpcPodConfig: &operatorsv1alpha1.GrpcPodConfig{SecurityContextConfig: operatorsv1alpha1.Restricted},
 			},
 		}