✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations #2429

camilamacedo86 · 2026-01-06T17:22:01Z

What's New

When BoxcutterRuntime is enabled, OLM v1 now correctly uses the ServiceAccount you specify in your ClusterExtension to install and manage extensions. This ensures your extensions are installed with only the permissions you grant, not admin privileges.

What This Means for You

More Control:

Extensions can only create resources that the ServiceAccount is allowed to create
If an extension tries to create something without permission, it fails immediately with a clear error
You see exactly which ServiceAccount performed each action in audit logs

Better Security:

Extensions no longer bypass RBAC during installation
Each extension limited to its ServiceAccount's permissions
No more admin-level access by default

Example

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-installer
  namespace: my-app
---
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
  name: my-extension
spec:
  namespace: my-app
  serviceAccount:
    name: my-installer  # ← Your extension uses this SA's permissions
  source:
    sourceType: Catalog
    catalog:
      packageName: my-package

What happens: OLM installs the extension using my-installer ServiceAccount. The extension can only do what you've granted that ServiceAccount permission to do.

netlify · 2026-01-06T17:22:07Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`76b836b`
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/695ebad70d13a50008f45b45
😎 Deploy Preview	https://deploy-preview-2429--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/operator-controller/controllers/revision_engine_factory_test.go

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/operator-controller/controllers/revision_engine_factory.go

openshift-ci · 2026-01-07T18:13:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign perdasilva for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/operator-controller/labels/labels.go

test/e2e/steps/testdata/rbac-template.yaml

camilamacedo86 · 2026-01-07T18:30:04Z

test/e2e/steps/testdata/rbac-template.yaml

+    # for roles it doesn't have and grant permissions beyond its own. This is required
+    # because extension bundles contain their own RBAC that must be created.
+    # See docs/concepts/permission-model.md for details on these requirements.
+    verbs: [ update, create, list, watch, get, delete, patch, bind, escalate ]


@perdasilva that proves it is working :-)
The permissions were missing, and e2e tests were failing.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/operator-controller/controllers/revision_engine_factory.go

internal/operator-controller/labels/labels.go

internal/operator-controller/applier/boxcutter.go

test/e2e/steps/testdata/rbac-template.yaml

…operations Implement serviceAccount-scoped token-based authentication for ClusterExtensionRevision controller using annotation-based configuration. - Add RevisionEngineFactory with CreateRevisionEngine(ctx, rev) interface - Read ServiceAccount from annotations (no ClusterExtension dependency) - Token-based auth using TokenInjectingRoundTripper - ServiceAccount name and namespace in annotations for observability - TrackingCache uses global client for caching/cleanup - Comprehensive error path tests ClusterExtensionRevision can exist independently. Easy mode impersonation deferred until API is finalized. Assisted-by: Cursor

Scoped ServiceAccount clients need `bind` and `escalate` verbs to create ClusterRoleBindings. The admin client previously used bypassed this RBAC requirement. The documentation (docs/concepts/permission-model.md) already specifies that ServiceAccounts need `bind` and `escalate` verbs for RBAC resources to install extensions with their own RBAC. The e2e test template was missing these verbs, causing tests to fail when using scoped ServiceAccount clients (which properly enforce Kubernetes RBAC) instead of the admin client.

Adds documentation comments to all label/annotation constants explaining: - What each constant represents - Where they are applied (labels vs annotations) - ServiceAccount constants document their relationship to ClusterExtension spec Addresses code review feedback for improved maintainability.

The upgrade test ServiceAccount needs permissions to manage ClusterExtensionRevisions when BoxcutterRuntime is enabled. Without these permissions, the upgraded controller cannot create or update ClusterExtensionRevision resources, causing the ClusterExtension to fail reconciliation after upgrade.

Copilot AI review requested due to automatic review settings January 6, 2026 17:22

camilamacedo86 requested a review from a team as a code owner January 6, 2026 17:22

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 6, 2026

openshift-ci bot requested review from grokspawn and oceanc80 January 6, 2026 17:22

Copilot started reviewing on behalf of camilamacedo86 January 6, 2026 17:22 View session

This comment was marked as outdated.

Sign in to view

camilamacedo86 force-pushed the admin-install branch from f7ebc0c to 2c82746 Compare January 6, 2026 18:00

Copilot AI review requested due to automatic review settings January 6, 2026 18:41

camilamacedo86 force-pushed the admin-install branch from 2c82746 to 7bcd536 Compare January 6, 2026 18:41

Copilot started reviewing on behalf of camilamacedo86 January 6, 2026 18:41 View session

operator-framework deleted a comment from Copilot AI Jan 6, 2026

camilamacedo86 force-pushed the admin-install branch from 7bcd536 to d7760da Compare January 6, 2026 18:45

camilamacedo86 changed the title ~~WIP: (feat): [Boxcutter] Use serviceAccount for ClusterExtensionRevision operations~~ ✨ Boxcutter ClusterExtensionRevision operations now uses .spec.serviceAccount Jan 6, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 6, 2026

camilamacedo86 changed the title ~~✨ Boxcutter ClusterExtensionRevision operations now uses .spec.serviceAccount~~ WIP ✨ Boxcutter ClusterExtensionRevision operations now uses .spec.serviceAccount Jan 6, 2026

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 6, 2026

Copilot AI reviewed Jan 6, 2026

View reviewed changes

internal/operator-controller/controllers/revision_engine_factory_test.go Outdated Show resolved Hide resolved

camilamacedo86 force-pushed the admin-install branch from d7760da to 586787b Compare January 6, 2026 19:01

operator-framework deleted a comment from Copilot AI Jan 6, 2026

Copilot AI review requested due to automatic review settings January 7, 2026 11:32

camilamacedo86 force-pushed the admin-install branch from 586787b to b6ad85e Compare January 7, 2026 11:32

Copilot started reviewing on behalf of camilamacedo86 January 7, 2026 11:32 View session

camilamacedo86 changed the title ~~WIP ✨ Boxcutter ClusterExtensionRevision operations now uses .spec.serviceAccount~~ ✨ Boxcutter ClusterExtensionRevision operations now uses .spec.serviceAccount Jan 7, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026

camilamacedo86 force-pushed the admin-install branch from a9a925a to 159f980 Compare January 7, 2026 15:41

Copilot AI review requested due to automatic review settings January 7, 2026 16:49

camilamacedo86 force-pushed the admin-install branch from 159f980 to fcf2a0a Compare January 7, 2026 16:49

camilamacedo86 changed the title ~~WIP ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations (Future: Easy Mode Support)~~ WIP ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations Jan 7, 2026

Copilot started reviewing on behalf of camilamacedo86 January 7, 2026 16:50 View session

Copilot AI reviewed Jan 7, 2026

View reviewed changes

internal/operator-controller/controllers/revision_engine_factory.go Show resolved Hide resolved

camilamacedo86 force-pushed the admin-install branch from fcf2a0a to 2a2d85c Compare January 7, 2026 17:56

Copilot AI review requested due to automatic review settings January 7, 2026 18:13

Copilot started reviewing on behalf of camilamacedo86 January 7, 2026 18:13 View session

camilamacedo86 force-pushed the admin-install branch from 2417fd2 to 5e67f84 Compare January 7, 2026 18:16

Copilot AI reviewed Jan 7, 2026

View reviewed changes

internal/operator-controller/labels/labels.go Outdated Show resolved Hide resolved

test/e2e/steps/testdata/rbac-template.yaml Show resolved Hide resolved

camilamacedo86 force-pushed the admin-install branch from 5e67f84 to ba37149 Compare January 7, 2026 18:24

Copilot AI review requested due to automatic review settings January 7, 2026 18:26

Copilot started reviewing on behalf of camilamacedo86 January 7, 2026 18:26 View session

camilamacedo86 changed the title ~~WIP ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations~~ ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations Jan 7, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026

camilamacedo86 requested a review from perdasilva January 7, 2026 18:29

camilamacedo86 commented Jan 7, 2026

View reviewed changes

Copilot AI reviewed Jan 7, 2026

View reviewed changes

camilamacedo86 changed the title ~~✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations~~ WIP ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations Jan 7, 2026

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026

camilamacedo86 force-pushed the admin-install branch from 702740f to 3d14643 Compare January 7, 2026 19:07

camilamacedo86 added 4 commits January 7, 2026 19:57

camilamacedo86 force-pushed the admin-install branch from 3d14643 to 76b836b Compare January 7, 2026 19:58

camilamacedo86 changed the title ~~WIP ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations~~ ✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations Jan 7, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations #2429

✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations #2429

camilamacedo86 commented Jan 6, 2026 •

edited

Loading

Uh oh!

netlify bot commented Jan 6, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

openshift-ci bot commented Jan 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

camilamacedo86 Jan 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations #2429

Are you sure you want to change the base?

✨ (feat): When using Boxcutter feature-gate, use ClusterExtension ServiceAccount for revision operations #2429

Conversation

camilamacedo86 commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's New

What This Means for You

Example

Uh oh!

netlify bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for olmv1 ready!

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

openshift-ci bot commented Jan 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

camilamacedo86 Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

camilamacedo86 commented Jan 6, 2026 •

edited

Loading

netlify bot commented Jan 6, 2026 •

edited

Loading