Cluster-scoped permissions required by the IBM Cloud Pak® for Integration instance

The IBM Cloud Pak for Integration operator requires various cluster-scoped permissions as part of its functionality.

  • List specific Consoles: Allows the IBM Cloud Pak for Integration operator to identify the URL derived from the host for the route that is created for the OpenShift web console.
    • API Groups: config.openshift.io
    • Resources: consoles
    • Verbs: list, get, watch
  • List specific ClusterVersions: Allows the IBM Cloud Pak for Integration operator to identify the OCP version that the cluster is reconciling towards.
    • API Groups: config.openshift.io
    • Resources: clusterversions
    • Verbs: list, get, watch
  • Manage ValidatingWebhookConfigurations: The IBM Cloud Pak for Integration operator uses validation webhooks to provide immediate validation and feedback about the creation and modification of Platform Navigation instances. The permission to manage webhooks is required for the operator to register these actions.
    • API Groups: admissionregistration.k8s.io
    • Resources: validatingwebhookconfigurations
    • Verbs: get, create, update, delete
  • Manage ConsoleYAMLSamples: ConsoleYAMLSamples are used to provide samples for the Cloud Pak for Integration resources in the OpenShift web console. The permission to manage ConsoleYAMLSamples is required for the operator to register the setting up of samples.
    • API Groups: console.openshift.io
    • Resources: consoleyamlsamples
    • Verbs: get, create, update, delete
  • List specific CustomResourceDefinitions: Required to allow the IBM Cloud Pak for Integration operator to give permissions to the Platform UI, in order to identify whether other optional dependencies have been installed into the cluster.
    • API Groups: apiextensions.k8s.io
    • Resources: customerresourcedefinitions
    • Verbs: get, list
  • Manage ClusterRoles and ClusterRoleBindings: The IBM Cloud Pak for Integration operator gives the Platform UI permissions to list CustomResourceDefinitions, which are cluster-scoped objects. These permissions must be created and managed as ClusterRoles. The permission to manage ClusterRoleBindings allows the operator to identify the appropriate ClusterRole created.
    • API Groups: rbac.authorization.k8s.io
    • Resources: clusterroles, clusterrolebindings
    • Verbs: create, list, get, watch, update, delete