<commit_before>// Module included in the following assemblies:
//
// * operators/admin/olm-creating-policy.adoc

[id="olm-policy-fine-grained-permissions_{context}"]
= Fine-grained permissions

Operator Lifecycle Manager (OLM) uses the service account specified in an Operator group to create or update the following resources related to the Operator being installed:

* `ClusterServiceVersion`
* `Subscription`
* `Secret`
* `ServiceAccount`
* `Service`
* `ClusterRole` and `ClusterRoleBinding`
* `Role` and `RoleBinding`

To confine Operators to a designated namespace, cluster administrators can start by granting the following permissions to the service account:

[NOTE]
====
The following role is a generic example and additional rules might be required based on the specific Operator.
====

[source,yaml]
----
kind: Role
rules:
- apiGroups: ["operators.coreos.com"]
  resources: ["subscriptions", "clusterserviceversions"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["services", "serviceaccounts"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: ["apps"] <1>
  resources: ["deployments"]
  verbs: ["list", "watch", "get", "create", "update", "patch", "delete"]
- apiGroups: [""] <1>
  resources: ["pods"]
  verbs: ["list", "watch", "get", "create", "update", "patch", "delete"]
----
<1> Add permissions to create other resources, such as deployments and pods shown here.

In addition, if any Operator specifies a pull secret, the following permissions must also be added:

[source,yaml]
----
kind: ClusterRole <1>
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
kind: Role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "update", "patch"]
----
<1> Required to get the secret from the OLM namespace.<commit_msg>BZ2012744: Fix YAML snippet formatting<commit_after>// Module included in the following assemblies:
//
// * operators/admin/olm-creating-policy.adoc

[id="olm-policy-fine-grained-permissions_{context}"]
= Fine-grained permissions

Operator Lifecycle Manager (OLM) uses the service account specified in an Operator group to create or update the following resources related to the Operator being installed:

* `ClusterServiceVersion`
* `Subscription`
* `Secret`
* `ServiceAccount`
* `Service`
* `ClusterRole` and `ClusterRoleBinding`
* `Role` and `RoleBinding`

To confine Operators to a designated namespace, cluster administrators can start by granting the following permissions to the service account:

[NOTE]
====
The following role is a generic example and additional rules might be required based on the specific Operator.
====

[source,yaml]
----
kind: Role
rules:
- apiGroups: ["operators.coreos.com"]
  resources: ["subscriptions", "clusterserviceversions"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["services", "serviceaccounts"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["get", "create", "update", "patch"]
- apiGroups: ["apps"] <1>
  resources: ["deployments"]
  verbs: ["list", "watch", "get", "create", "update", "patch", "delete"]
- apiGroups: [""] <1>
  resources: ["pods"]
  verbs: ["list", "watch", "get", "create", "update", "patch", "delete"]
----
<1> Add permissions to create other resources, such as deployments and pods shown here.

In addition, if any Operator specifies a pull secret, the following permissions must also be added:

[source,yaml,subs="+macros"]
----
kind: ClusterRole <1>
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
++---++
kind: Role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "update", "patch"]
----
<1> Required to get the secret from the OLM namespace.
{'fraction_non_alphanumeric': 0.16206543967280163, 'fraction_numerical': 0.0048568507157464216, 'mean_word_length': 5.085536547433904, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '127736', 'n_tokens_mistral': 1213, 'n_tokens_neox': 1172, 'n_words': 413}