Designing a Minimal, Trust‑Bound OLM Setup on OpenShift

Requirements

To run Operator Lifecycle Manager (OLM) you need a running OpenShift cluster (4.12+) with OperatorHub enabled. OLM consumes four core custom resources: ClusterServiceVersion (CSV), CatalogSource, Subscription, and InstallPlan. The cluster must have a container image registry that supports image signing and digest verification, and you must hold at least cluster-admin or a dedicated operator-lifecycle-manager role to create cluster‑scoped CatalogSource objects.

Smallest Suitable Design

The minimal, production‑grade topology consists of three objects:

1. CatalogSource – points to a signed index image in a trusted registry.
2. Subscription – selects a channel and defines install‑plan approval (Automatic or Manual).
3. ServiceAccount + RoleBinding – grants the operator only the permissions it needs in its target namespaces.

Example CatalogSource

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: my-trusted-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: registry.example.com/my-org/operator-index:v1.2.3@sha256:abcd1234...
  displayName: "My Trusted Operators"
  publisher: "My Org"
  updateStrategy:
    registryPoll:
      interval: 30m

Run this on a control‑plane node (or any node with oc access) as a user with cluster-admin rights:

oc apply -f catalogsource.yaml

Example Subscription

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: my-operator-sub
  namespace: my-operator-ns
spec:
  channel: stable
  name: my-operator
  source: my-trusted-catalog
  sourceNamespace: openshift-marketplace
  installPlanApproval: Manual
  startingCSV: my-operator.v1.2.3

Apply with a user that can create namespaced resources in my-operator-ns:

oc apply -f subscription.yaml

Least‑Privilege ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-operator-sa
  namespace: my-operator-ns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-operator-role
  namespace: my-operator-ns
rules:
- apiGroups: ["", "apps"]
  resources: ["deployments", "services", "configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-operator-binding
  namespace: my-operator-ns
subjects:
- kind: ServiceAccount
  name: my-operator-sa
  namespace: my-operator-ns
roleRef:
  kind: Role
  name: my-operator-role
  apiGroup: rbac.authorization.k8s.io

Attach the ServiceAccount to the operator’s CSV (via spec.install.spec.deployments[].spec.template.spec.serviceAccountName) or let OLM inject it when the CSV declares serviceAccountName.

Trust and Data Boundaries

Operators execute inside the cluster, so the supply chain is the primary attack surface. Enforce image trust by:

• Signing the index image with cosign or Red Hat Simple Signing.
• Configuring an ImagePolicy (or ImageContentSourcePolicy) that requires a valid signature for registry.example.com/my-org/*.
• Scoping the ServiceAccount’s RBAC to the exact namespaces the operator manages; never grant cluster-admin to the operator’s SA.

Data produced by the operator (CRs, secrets, metrics) stays in the target namespaces. The CatalogSource itself is cluster‑scoped but read‑only for non‑admin users.

Operational Checks

Run these checks daily or integrate them into a monitoring pipeline:

1. Subscription health – oc get subscriptions -A -o custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,STATE:.status.state,CURRENT:.status.currentCSV. Expect STATE=AtLatestKnown.
2. InstallPlan approval – oc get installplan -A -o custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,APPROVAL:.spec.approval,APPROVED:.status.approved. Manual mode should show APPROVED=false until you run oc patch installplan -n -p '{"spec":{"approved":true}}' --type=merge.
3. Operator pod status – oc get pods -n my-operator-ns -l name=my-operator then oc describe pod -n my-operator-ns and oc logs -n my-operator-ns for error lines.
4. CatalogSource image digest – oc get catalogsource my-trusted-catalog -n openshift-marketplace -o jsonpath='{.spec.image}' and compare the digest with the registry UI.

Failure Modes

Conditions That Trigger a Redesign

• Upgrading OpenShift beyond the OLM version matrix (e.g., 4.12 → 4.16) – CSV APIs may change.
• Migrating the operator index to a different registry (quay.io → internal Harbor) – CatalogSource image URL and trust policy must be updated.
• Adopting multi‑cluster management (Red Hat Advanced Cluster Management) – you’ll replace per‑cluster CatalogSources with a centralized MultiClusterCatalogSource and adjust RBAC to cluster‑scoped ClusterRoleBinding.
• Regulatory requirement for immutable operator versions – switch installPlanApproval: Manual and pin startingCSV in every Subscription.

Verification Checklist (Run After Any Change)

# 1. Confirm CatalogSource image digest matches registry
oc get catalogsource my-trusted-catalog -n openshift-marketplace -o yaml | grep 'image:'
# 2. Verify Subscription reached desired state
oc get subscription my-operator-sub -n my-operator-ns -o jsonpath='{.status.state}'
# 3. Ensure InstallPlan matches approval mode
oc get installplan -n my-operator-ns -o jsonpath='{.items[*].spec.approval}'
# 4. Validate operator pods are Ready
oc get pods -n my-operator-ns -l name=my-operator --field-selector=status.phase=Running
# 5. Spot‑check logs for errors
oc logs -n my-operator-ns -l name=my-operator --tail=50 | grep -i error

If any step returns an unexpected value, treat it as a blocker before promoting the change to production.

Limitations

OLM does not automatically roll back a failed operator installation; you must manually delete the offending InstallPlan and Subscription or patch the CSV. The Manual approval mode adds operational overhead but prevents uncontrolled upgrades. CatalogSource updates that change the image tag without a new digest can cause operator drift – always pin by digest. Finally, OLM’s reconciliation loop runs roughly every 30 seconds; rapid successive changes may be coalesced, so allow a minute between apply and verification.