Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1754810

Summary: The common user should see the OperatorHub section on the Web console
Product: OpenShift Container Platform Reporter: Jian Zhang <jiazha>
Component: Management ConsoleAssignee: Samuel Padgett <spadgett>
Status: CLOSED NOTABUG QA Contact: Yadan Pei <yapei>
Severity: high Docs Contact:
Priority: high    
Version: 4.2.0CC: amobrem, aos-bugs, bandrade, chuo, dmesser, ecordell, jfan, jokerman, scolange, shurley, spadgett
Target Milestone: ---   
Target Release: 4.3.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-11-06 21:40:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jian Zhang 2019-09-24 06:36:10 UTC 
Description of problem:
This bug is split from bug 1691282. It's an old issue for 4.2. For better tracking and more clear. I create this one.
As the design of the OLM, the common users can install operators in their namespaces after the cluster-admin create the OperatorGroup in their namespaces.
But, now, the common users cannot see the OperatorHub section on the Web console, so, they cannot get any operators actually. 

Version-Release number of selected component (if applicable):
4.2.0-0.nightly-2019-09-23-215123

How reproducible:
always

Steps to Reproduce:
1. Login the cluster Web console as a common user. For example, called jian.
2. Create a namespace.
3. Logout it and login it as a a cluster-admin user.
4, Create an OperatorGroup in jian namespace.
mac:~ jianzhang$ oc get og -n jian
NAME      AGE
test-og   7s

5, Logout and Login as this common user. And try to install operators.


Actual results:
But, the common users cannot see the OperatorHub section on the Web console.
So, actually, they cannot install any operator.
https://user-images.githubusercontent.com/15416633/65486959-64fb3e00-ded8-11e9-87d8-6ee7726ba79b.png

Expected results:
The common users can see the OperatorHub section on the Web console.

Additional info:
The reason why the common users need to install operators https://bugzilla.redhat.com/show_bug.cgi?id=1691282#c32:

The reason why it’s not just cluster-admin who should be able to do this is hosted clusters, where the tenant gets some level of admin access but not cluster-admin, in order for the backing SRE team to reasonably be able to make some guarantees. OpenShift Dedicated is one example.
IMHO it is legitimate for an administrative persona to be able to install Operators in a constrained way, that ensures the cluster’s stability at large is not impacted. We have made such constraints available with an OperatorGroups that carry a ServiceAccount, defining maximum permissions and by leaving the creation of an OperatorGroup a cluster-admin-only use case.
Comment 6 Daniel Messer 2019-09-26 17:52:38 UTC 
One thing we can do is to bind the visibility of the OperatorHub to the RBAC the user has on Subscriptions. That's how it's done on OSD IIRC.
Comment 7 Jian Zhang 2019-09-29 07:25:46 UTC 
Samuel,

> The UI should appear for any user with those permissions.

Ok, thanks! But now, the common users don't have the permission to create OperatorGroups. @Daniel What's your suggestion?


Daniel,

> One thing we can do is to bind the visibility of the OperatorHub to the RBAC the user has on Subscriptions.

Do we need to list the steps for this in 4.2 release doc?