From 027876d56860d353f36f8ec7a58a136b88ab634b Mon Sep 17 00:00:00 2001 From: pkomarov Date: Thu, 9 Jul 2026 23:59:36 +0300 Subject: [PATCH] docs(security): add opt-in Manual installPlanApproval overlays (OSPRH-32422 / FIND-010) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The shipped subscriptions for ESO, VSO, and openshift-gitops-operator use installPlanApproval: Automatic — operators upgrade automatically when the catalog publishes a new version to the channel. This is intentional: it keeps the deployment simple and avoids the operational overhead of an in-cluster Job that must approve every new InstallPlan. For deployments that require stricter change-control over operator upgrades (e.g. production environments where every component version must be reviewed before installation), opt-in overlay components are provided: components/secrets/external-secrets-operator/manual-approval/ components/secrets/vault-secrets-operator/manual-approval/ These components switch installPlanApproval to Manual and pin a startingCSV. Consumers include them after the base subscription component and update startingCSV whenever they want to advance the operator version. Administrators must then approve the resulting InstallPlan (manually or via automation) before OLM installs the new CSV. The openshift-gitops-operator subscription is excluded from this pattern: it is applied by the Ansible bootstrap before ArgoCD exists, so no in-cluster Job can approve a Manual InstallPlan at that stage. Version gating for that operator is handled via the openshift_gitops_deploy_git_ref pin in the automation repo. Addresses OWASP K8s Top 10 K07 (Vulnerable/Unverified Components). Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../manual-approval/kustomization.yaml | 44 +++++++++++++++++++ .../manual-approval/kustomization.yaml | 33 ++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 components/secrets/external-secrets-operator/manual-approval/kustomization.yaml create mode 100644 components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml diff --git a/components/secrets/external-secrets-operator/manual-approval/kustomization.yaml b/components/secrets/external-secrets-operator/manual-approval/kustomization.yaml new file mode 100644 index 0000000..ef4cbc8 --- /dev/null +++ b/components/secrets/external-secrets-operator/manual-approval/kustomization.yaml @@ -0,0 +1,44 @@ +--- +# Opt-in overlay: switch the ESO subscription to Manual installPlanApproval. +# +# Include this component AFTER the base ESO component (community or redhat) +# to override installPlanApproval from Automatic to Manual and pin a +# specific startingCSV. +# +# Manual approval means OLM will not install a new operator version until +# an administrator (or automation) explicitly approves the InstallPlan. +# This provides change-control over operator upgrades at the cost of +# requiring an approval step on every new version. +# +# NOTE: When using Manual approval you must ensure InstallPlans are approved +# before the operator can install or upgrade. Options: +# - Approve manually: oc patch installplan -n --type merge +# -p '{"spec":{"approved":true}}' +# - Or implement an automated approval Job (see the pattern in +# components/utilities/approve-installplan for the openstack-operator). +# +# Usage in a consumer kustomization: +# components: +# - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/redhat?ref= +# - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/manual-approval?ref= +# +# Remember to update startingCSV to the version currently running in your +# cluster before switching to Manual. Query with: +# oc get subscription openshift-external-secrets-operator -n external-secrets-operator \ +# -o jsonpath='{.status.currentCSV}' + +# ---- EXAMPLE — uncomment and fill in before using ---- +# +# apiVersion: kustomize.config.k8s.io/v1alpha1 +# kind: Component +# patches: +# - target: +# kind: Subscription +# name: external-secrets-operator +# patch: |- +# - op: replace +# path: /spec/installPlanApproval +# value: Manual +# - op: add +# path: /spec/startingCSV +# value: openshift-external-secrets-operator.v # replace with current CSV diff --git a/components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml b/components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml new file mode 100644 index 0000000..59586ab --- /dev/null +++ b/components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml @@ -0,0 +1,33 @@ +--- +# Opt-in overlay: switch the VSO subscription to Manual installPlanApproval. +# +# Include this component AFTER the base VSO component to override +# installPlanApproval from Automatic to Manual and pin a specific startingCSV. +# +# See components/secrets/external-secrets-operator/manual-approval/kustomization.yaml +# for full usage notes and approval options. +# +# Query your currently installed CSV: +# oc get subscription vault-secrets-operator -n openshift-operators \ +# -o jsonpath='{.status.currentCSV}' +# +# Usage in a consumer kustomization: +# components: +# - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator?ref= +# - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator/manual-approval?ref= + +# ---- EXAMPLE — uncomment and fill in before using ---- +# +# apiVersion: kustomize.config.k8s.io/v1alpha1 +# kind: Component +# patches: +# - target: +# kind: Subscription +# name: vault-secrets-operator +# patch: |- +# - op: replace +# path: /spec/installPlanApproval +# value: Manual +# - op: add +# path: /spec/startingCSV +# value: vault-secrets-operator.v # replace with current CSV