docs(security): add opt-in Manual installPlanApproval overlays (FIND-010)#76
Merged
pinikomarov merged 1 commit intoJul 13, 2026
Conversation
…-32422 / FIND-010) The shipped subscriptions for ESO, VSO, and openshift-gitops-operator use installPlanApproval: Automatic — operators upgrade automatically when the catalog publishes a new version to the channel. This is intentional: it keeps the deployment simple and avoids the operational overhead of an in-cluster Job that must approve every new InstallPlan. For deployments that require stricter change-control over operator upgrades (e.g. production environments where every component version must be reviewed before installation), opt-in overlay components are provided: components/secrets/external-secrets-operator/manual-approval/ components/secrets/vault-secrets-operator/manual-approval/ These components switch installPlanApproval to Manual and pin a startingCSV. Consumers include them after the base subscription component and update startingCSV whenever they want to advance the operator version. Administrators must then approve the resulting InstallPlan (manually or via automation) before OLM installs the new CSV. The openshift-gitops-operator subscription is excluded from this pattern: it is applied by the Ansible bootstrap before ArgoCD exists, so no in-cluster Job can approve a Manual InstallPlan at that stage. Version gating for that operator is handled via the openshift_gitops_deploy_git_ref pin in the automation repo. Addresses OWASP K8s Top 10 K07 (Vulnerable/Unverified Components). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
pinikomarov
force-pushed
the
glasswing/find-010-manual-subscription-note
branch
from
28a6363 to
027876d
Compare
cjeanner
reviewed
Jul 10, 2026
cjeanner
approved these changes
Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses OSPRH-32422 / FIND-010: OLM Subscriptions use Automatic install-plan approval and floating channel without startingCSV.
The shipped subscriptions for ESO, VSO, and openshift-gitops-operator use
installPlanApproval: Automatic. This is intentional — it keeps the deployment simple and avoids the operational overhead of an in-cluster Job that must approve every new InstallPlan.Rather than switching the base manifests to Manual (which requires hacky in-cluster Jobs for each component and doesn't scale well when multiple plans land simultaneously), this PR provides opt-in overlay components for deployments that need stricter change-control:
components/secrets/external-secrets-operator/manual-approval/— switches ESO to Manual + pinsstartingCSVcomponents/secrets/vault-secrets-operator/manual-approval/— switches VSO to Manual + pinsstartingCSVConsumers include the overlay after the base component and update
startingCSVwhen they want to advance the operator version. Administrators then approve the resulting InstallPlan (manually or via automation) before OLM installs the new CSV.The
openshift-gitops-operatorsubscription is excluded: it is applied by the Ansible bootstrap before ArgoCD exists, so no in-cluster Job can approve a Manual InstallPlan at that stage. Version gating is handled viaopenshift_gitops_deploy_git_refin the automation repo.Test plan
kustomize buildwith the overlay applied showsinstallPlanApproval: ManualandstartingCSVon the subscriptionAutomatic(no behaviour change for existing consumers)🤖 Generated with Claude Code