Summary
The OpenShift readiness gate asserts that an operator's ClusterServiceVersion (CSV) reaches phase: Succeeded, but the generated gate Role does not grant access to operators.coreos.com resources — so the gate Job hits an RBAC-forbidden error and cannot read the CSV it is supposed to wait on.
Evidence
- The OCP OLM readiness check reads the CSV:
recipes/components/gpu-operator-ocp-olm/readiness.yaml asserts on ClusterServiceVersion (operators.coreos.com).
- The generated gate role omits that API group:
pkg/bundler/gatemanifest/manifest.go grants only apiGroups: ["", "apps", "batch", "nvidia.com", "apiextensions.k8s.io"] — no operators.coreos.com.
Result: on OCP, --readiness-hooks gates fail with clusterserviceversions.operators.coreos.com is forbidden.
Fix
Add operators.coreos.com (verb get/list/watch on clusterserviceversions) to the generated gate Role when the readiness assertion targets OLM resources.
Docs (#1528) caveat the OCP readiness gate pending this fix.
Summary
The OpenShift readiness gate asserts that an operator's
ClusterServiceVersion(CSV) reachesphase: Succeeded, but the generated gateRoledoes not grant access tooperators.coreos.comresources — so the gate Job hits an RBAC-forbidden error and cannot read the CSV it is supposed to wait on.Evidence
recipes/components/gpu-operator-ocp-olm/readiness.yamlasserts onClusterServiceVersion(operators.coreos.com).pkg/bundler/gatemanifest/manifest.gogrants onlyapiGroups: ["", "apps", "batch", "nvidia.com", "apiextensions.k8s.io"]— nooperators.coreos.com.Result: on OCP,
--readiness-hooksgates fail withclusterserviceversions.operators.coreos.com is forbidden.Fix
Add
operators.coreos.com(verbget/list/watchonclusterserviceversions) to the generated gate Role when the readiness assertion targets OLM resources.Docs (#1528) caveat the OCP readiness gate pending this fix.