experimental-e2e.yaml

---
# Source: olmv1/templates/namespace.yml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    app.kubernetes.io/part-of: olm
  name: olmv1-system
---
# Source: olmv1/templates/networkpolicy/networkpolicy-olmv1-system-catalogd-controller-manager.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-controller-manager
  namespace: olmv1-system
spec:
  egress:
    - {}
  ingress:
    - ports:
        - port: 7443
          protocol: TCP
        - port: 8443
          protocol: TCP
        - port: 9443
          protocol: TCP
  podSelector:
    matchLabels:
      control-plane: catalogd-controller-manager
  policyTypes:
    - Ingress
    - Egress
---
# Source: olmv1/templates/networkpolicy/networkpolicy-olmv1-system-default-deny-all-traffic.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    app.kubernetes.io/part-of: olm
  name: default-deny-all-traffic
  namespace: olmv1-system
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# Source: olmv1/templates/networkpolicy/networkpolicy-olmv1-system-operator-controller-controller-manager.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-controller-manager
  namespace: olmv1-system
spec:
  egress:
    - {}
  ingress:
    - ports:
        - port: 8443
          protocol: TCP
  podSelector:
    matchLabels:
      control-plane: operator-controller-controller-manager
  policyTypes:
    - Ingress
    - Egress
---
# Source: olmv1/templates/poddisruptionbudget-olmv1-system-catalogd.yml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: catalogd-controller-manager
  namespace: olmv1-system
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
spec:
  minAvailable: 1
  selector:
    matchLabels:
      control-plane: catalogd-controller-manager
---
# Source: olmv1/templates/poddisruptionbudget-olmv1-system-operator-controller.yml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: operator-controller-controller-manager
  namespace: olmv1-system
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
spec:
  minAvailable: 1
  selector:
    matchLabels:
      control-plane: operator-controller-controller-manager
---
# Source: olmv1/templates/serviceaccount-olmv1-system-common-controller-manager.yml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-controller-manager
  namespace: olmv1-system
---
# Source: olmv1/templates/serviceaccount-olmv1-system-common-controller-manager.yml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-controller-manager
  namespace: olmv1-system
---
# Source: olmv1/templates/e2e/configmap-olmv1-system-e2e-registries-conf.yml
apiVersion: v1
data:
  registries.conf: |
    [[registry]]
    prefix = "mirrored-registry.operator-controller-e2e.svc.cluster.local:5000"
    location = "docker-registry.operator-controller-e2e.svc.cluster.local:5000"

    [[registry]]
    prefix = "dynamic-registry.operator-controller-e2e.svc.cluster.local:5000"
    location = "docker-registry.operator-controller-e2e.svc.cluster.local:5000"
kind: ConfigMap
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: e2e
    app.kubernetes.io/part-of: olm
  name: e2e-registries-conf
  namespace: olmv1-system
---
# Source: olmv1/templates/e2e/persistentvolumeclaim-olmv1-system-e2e-coverage.yml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: e2e
    app.kubernetes.io/part-of: olm
  name: e2e-coverage
  namespace: olmv1-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 64Mi
---
# Source: olmv1/templates/crds/customresourcedefinition-clustercatalogs.olm.operatorframework.io.yml
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.20.1
    olm.operatorframework.io/generator: experimental
  name: clustercatalogs.olm.operatorframework.io
spec:
  group: olm.operatorframework.io
  names:
    kind: ClusterCatalog
    listKind: ClusterCatalogList
    plural: clustercatalogs
    singular: clustercatalog
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.lastUnpacked
      name: LastUnpacked
      type: date
    - jsonPath: .status.conditions[?(@.type=="Serving")].status
      name: Serving
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          ClusterCatalog makes File-Based Catalog (FBC) data available to your cluster.
          For more information on FBC, see https://olm.operatorframework.io/docs/reference/file-based-catalogs/#docs
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              spec is a required field that defines the desired state of the ClusterCatalog.
              The controller ensures that the catalog is unpacked and served over the catalog content HTTP server.
            properties:
              availabilityMode:
                default: Available
                description: |-
                  availabilityMode is an optional field that defines how the ClusterCatalog is made available to clients on the cluster.

                  Allowed values are "Available", "Unavailable", or omitted.

                  When omitted, the default value is "Available".

                  When set to "Available", the catalog contents are unpacked and served over the catalog content HTTP server.
                  Clients should consider this ClusterCatalog and its contents as usable.

                  When set to "Unavailable", the catalog contents are no longer served over the catalog content HTTP server.
                  Treat this the same as if the ClusterCatalog does not exist.
                  Use "Unavailable" when you want to keep the ClusterCatalog but treat it as if it doesn't exist.
                enum:
                - Unavailable
                - Available
                type: string
              priority:
                default: 0
                description: |-
                  priority is an optional field that defines a priority for this ClusterCatalog.

                  Clients use the ClusterCatalog priority as a tie-breaker between ClusterCatalogs that meet their requirements.
                  Higher numbers mean higher priority.

                  Clients decide how to handle scenarios where multiple ClusterCatalogs with the same priority meet their requirements.
                  Clients should prompt users for additional input to break the tie.

                  When omitted, the default priority is 0.

                  Use negative numbers to specify a priority lower than the default.
                  Use positive numbers to specify a priority higher than the default.

                  The lowest possible value is -2147483648.
                  The highest possible value is 2147483647.
                format: int32
                maximum: 2147483647
                minimum: -2147483648
                type: integer
              source:
                description: |-
                  source is a required field that defines the source of a catalog.
                  A catalog contains information on content that can be installed on a cluster.
                  The catalog source makes catalog contents discoverable and usable by other on-cluster components.
                  These components can present the content in a GUI dashboard or install content from the catalog on the cluster.
                  The catalog source must contain catalog metadata in the File-Based Catalog (FBC) format.
                  For more information on FBC, see https://olm.operatorframework.io/docs/reference/file-based-catalogs/#docs.

                  Below is a minimal example of a ClusterCatalogSpec that sources a catalog from an image:

                   source:
                     type: Image
                     image:
                       ref: quay.io/operatorhubio/catalog:latest
                properties:
                  image:
                    description: |-
                      image configures how catalog contents are sourced from an OCI image.
                      It is required when type is Image, and forbidden otherwise.
                    properties:
                      pollIntervalMinutes:
                        description: |-
                          pollIntervalMinutes is an optional field that sets the interval, in minutes, at which the image source is polled for new content.
                          You cannot specify pollIntervalMinutes when ref is a digest-based reference.

                          When omitted, the image is not polled for new content.
                        minimum: 1
                        type: integer
                      ref:
                        description: |-
                          ref is a required field that defines the reference to a container image containing catalog contents.
                          It cannot be more than 1000 characters.

                          A reference has 3 parts: the domain, name, and identifier.

                          The domain is typically the registry where an image is located.
                          It must be alphanumeric characters (lowercase and uppercase) separated by the "." character.
                          Hyphenation is allowed, but the domain must start and end with alphanumeric characters.
                          Specifying a port to use is also allowed by adding the ":" character followed by numeric values.
                          The port must be the last value in the domain.
                          Some examples of valid domain values are "registry.mydomain.io", "quay.io", "my-registry.io:8080".

                          The name is typically the repository in the registry where an image is located.
                          It must contain lowercase alphanumeric characters separated only by the ".", "_", "__", "-" characters.
                          Multiple names can be concatenated with the "/" character.
                          The domain and name are combined using the "/" character.
                          Some examples of valid name values are "operatorhubio/catalog", "catalog", "my-catalog.prod".
                          An example of the domain and name parts of a reference being combined is "quay.io/operatorhubio/catalog".

                          The identifier is typically the tag or digest for an image reference and is present at the end of the reference.
                          It starts with a separator character used to distinguish the end of the name and beginning of the identifier.
                          For a digest-based reference, the "@" character is the separator.
                          For a tag-based reference, the ":" character is the separator.
                          An identifier is required in the reference.

                          Digest-based references must contain an algorithm reference immediately after the "@" separator.
                          The algorithm reference must be followed by the ":" character and an encoded string.
                          The algorithm must start with an uppercase or lowercase alpha character followed by alphanumeric characters and may contain the "-", "_", "+", and "." characters.
                          Some examples of valid algorithm values are "sha256", "sha256+b64u", "multihash+base58".
                          The encoded string following the algorithm must be hex digits (a-f, A-F, 0-9) and must be a minimum of 32 characters.

                          Tag-based references must begin with a word character (alphanumeric + "_") followed by word characters or ".", and "-" characters.
                          The tag must not be longer than 127 characters.

                          An example of a valid digest-based image reference is "quay.io/operatorhubio/catalog@sha256:200d4ddb2a73594b91358fe6397424e975205bfbe44614f5846033cad64b3f05"
                          An example of a valid tag-based image reference is "quay.io/operatorhubio/catalog:latest"
                        maxLength: 1000
                        type: string
                        x-kubernetes-validations:
                        - message: must start with a valid domain. valid domains must
                            be alphanumeric characters (lowercase and uppercase) separated
                            by the "." character.
                          rule: self.matches('^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])((\\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(:[0-9]+)?\\b')
                        - message: a valid name is required. valid names must contain
                            lowercase alphanumeric characters separated only by the
                            ".", "_", "__", "-" characters.
                          rule: self.find('(\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?((\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?)+)?)')
                            != ""
                        - message: must end with a digest or a tag
                          rule: self.find('(@.*:)') != "" || self.find(':.*$') !=
                            ""
                        - message: tag is invalid. the tag must not be more than 127
                            characters
                          rule: 'self.find(''(@.*:)'') == "" ? (self.find('':.*$'')
                            != "" ? self.find('':.*$'').substring(1).size() <= 127
                            : true) : true'
                        - message: tag is invalid. valid tags must begin with a word
                            character (alphanumeric + "_") followed by word characters
                            or ".", and "-" characters
                          rule: 'self.find(''(@.*:)'') == "" ? (self.find('':.*$'')
                            != "" ? self.find('':.*$'').matches('':[\\w][\\w.-]*$'')
                            : true) : true'
                        - message: digest algorithm is not valid. valid algorithms
                            must start with an uppercase or lowercase alpha character
                            followed by alphanumeric characters and may contain the
                            "-", "_", "+", and "." characters.
                          rule: 'self.find(''(@.*:)'') != "" ? self.find(''(@.*:)'').matches(''(@[A-Za-z][A-Za-z0-9]*([-_+.][A-Za-z][A-Za-z0-9]*)*[:])'')
                            : true'
                        - message: digest is not valid. the encoded string must be
                            at least 32 characters
                          rule: 'self.find(''(@.*:)'') != "" ? self.find('':.*$'').substring(1).size()
                            >= 32 : true'
                        - message: digest is not valid. the encoded string must only
                            contain hex characters (A-F, a-f, 0-9)
                          rule: 'self.find(''(@.*:)'') != "" ? self.find('':.*$'').matches('':[0-9A-Fa-f]*$'')
                            : true'
                    required:
                    - ref
                    type: object
                    x-kubernetes-validations:
                    - message: cannot specify pollIntervalMinutes while using digest-based
                        image
                      rule: 'self.ref.find(''(@.*:)'') != "" ? !has(self.pollIntervalMinutes)
                        : true'
                  type:
                    description: |-
                      type is a required field that specifies the type of source for the catalog.

                      The only allowed value is "Image".

                      When set to "Image", the ClusterCatalog content is sourced from an OCI image.
                      When using an image source, the image field must be set and must be the only field defined for this type.
                    enum:
                    - Image
                    type: string
                required:
                - type
                type: object
                x-kubernetes-validations:
                - message: image is required when source type is Image, and forbidden
                    otherwise
                  rule: 'has(self.type) && self.type == ''Image'' ? has(self.image)
                    : !has(self.image)'
            required:
            - source
            type: object
          status:
            description: |-
              status contains the following information about the state of the ClusterCatalog:
                - Whether the catalog contents are being served via the catalog content HTTP server
                - Whether the ClusterCatalog is progressing to a new state
                - A reference to the source from which the catalog contents were retrieved
            properties:
              conditions:
                description: |-
                  conditions represents the current state of this ClusterCatalog.

                  The current condition types are Serving and Progressing.

                  The Serving condition represents whether the catalog contents are being served via the HTTP(S) web server:
                    - When status is True and reason is Available, the catalog contents are being served.
                    - When status is False and reason is Unavailable, the catalog contents are not being served because the contents are not yet available.
                    - When status is False and reason is UserSpecifiedUnavailable, the catalog contents are not being served because the catalog has been intentionally marked as unavailable.

                  The Progressing condition represents whether the ClusterCatalog is progressing or is ready to progress towards a new state:
                    - When status is True and reason is Retrying, an error occurred that may be resolved on subsequent reconciliation attempts.
                    - When status is True and reason is Succeeded, the ClusterCatalog has successfully progressed to a new state and is ready to continue progressing.
                    - When status is False and reason is Blocked, an error occurred that requires manual intervention for recovery.

                  If the system initially fetched contents and polling identifies updates, both conditions can be active simultaneously:
                    - The Serving condition remains True with reason Available because the previous contents are still served via the HTTP(S) web server.
                    - The Progressing condition is True with reason Retrying because the system is working to serve the new version.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              lastUnpacked:
                description: |-
                  lastUnpacked represents the last time the catalog contents were extracted from their source format.
                  For example, when using an Image source, the OCI image is pulled and image layers are written to a file-system backed cache.
                  This extraction from the source format is called "unpacking".
                format: date-time
                type: string
              resolvedSource:
                description: resolvedSource contains information about the resolved
                  source based on the source type.
                properties:
                  image:
                    description: |-
                      image contains resolution information for a catalog sourced from an image.
                      It must be set when type is Image, and forbidden otherwise.
                    properties:
                      ref:
                        description: |-
                          ref contains the resolved image digest-based reference.
                          The digest format allows you to use other tooling to fetch the exact OCI manifests
                          that were used to extract the catalog contents.
                        maxLength: 1000
                        type: string
                        x-kubernetes-validations:
                        - message: must start with a valid domain. valid domains must
                            be alphanumeric characters (lowercase and uppercase) separated
                            by the "." character.
                          rule: self.matches('^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])((\\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(:[0-9]+)?\\b')
                        - message: a valid name is required. valid names must contain
                            lowercase alphanumeric characters separated only by the
                            ".", "_", "__", "-" characters.
                          rule: self.find('(\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?((\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?)+)?)')
                            != ""
                        - message: must end with a digest
                          rule: self.find('(@.*:)') != ""
                        - message: digest algorithm is not valid. valid algorithms
                            must start with an uppercase or lowercase alpha character
                            followed by alphanumeric characters and may contain the
                            "-", "_", "+", and "." characters.
                          rule: 'self.find(''(@.*:)'') != "" ? self.find(''(@.*:)'').matches(''(@[A-Za-z][A-Za-z0-9]*([-_+.][A-Za-z][A-Za-z0-9]*)*[:])'')
                            : true'
                        - message: digest is not valid. the encoded string must be
                            at least 32 characters
                          rule: 'self.find(''(@.*:)'') != "" ? self.find('':.*$'').substring(1).size()
                            >= 32 : true'
                        - message: digest is not valid. the encoded string must only
                            contain hex characters (A-F, a-f, 0-9)
                          rule: 'self.find(''(@.*:)'') != "" ? self.find('':.*$'').matches('':[0-9A-Fa-f]*$'')
                            : true'
                    required:
                    - ref
                    type: object
                  type:
                    description: |-
                      type is a required field that specifies the type of source for the catalog.

                      The only allowed value is "Image".

                      When set to "Image", information about the resolved image source is set in the image field.
                    enum:
                    - Image
                    type: string
                required:
                - image
                - type
                type: object
                x-kubernetes-validations:
                - message: image is required when source type is Image, and forbidden
                    otherwise
                  rule: 'has(self.type) && self.type == ''Image'' ? has(self.image)
                    : !has(self.image)'
              urls:
                description: urls contains the URLs that can be used to access the
                  catalog.
                properties:
                  base:
                    description: |-
                      base is a cluster-internal URL that provides endpoints for accessing the catalog content.

                      Clients should append the path for the endpoint they want to access.

                      Currently, only a single endpoint is served and is accessible at the path /api/v1.

                      The endpoints served for the v1 API are:
                        - /all - this endpoint returns the entire catalog contents in the FBC format

                      New endpoints may be added as needs evolve.
                    maxLength: 525
                    type: string
                    x-kubernetes-validations:
                    - message: must be a valid URL
                      rule: isURL(self)
                    - message: scheme must be either http or https
                      rule: 'isURL(self) ? (url(self).getScheme() == "http" || url(self).getScheme()
                        == "https") : true'
                required:
                - base
                type: object
            type: object
        required:
        - metadata
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
# Source: olmv1/templates/crds/customresourcedefinition-clusterextensionrevisions.olm.operatorframework.io.yml
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.20.1
    olm.operatorframework.io/generator: experimental
  name: clusterextensionrevisions.olm.operatorframework.io
spec:
  group: olm.operatorframework.io
  names:
    kind: ClusterExtensionRevision
    listKind: ClusterExtensionRevisionList
    plural: clusterextensionrevisions
    singular: clusterextensionrevision
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type=='Available')].status
      name: Available
      type: string
    - jsonPath: .status.conditions[?(@.type=='Progressing')].status
      name: Progressing
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          ClusterExtensionRevision represents an immutable snapshot of Kubernetes objects
          for a specific version of a ClusterExtension. Each revision contains objects
          organized into phases that roll out sequentially. The same object can only be managed by a single revision
          at a time. Ownership of objects is transitioned from one revision to the next as the extension is upgraded
          or reconfigured. Once the latest revision has rolled out successfully, previous active revisions are archived for
          posterity.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: spec defines the desired state of the ClusterExtensionRevision.
            properties:
              collisionProtection:
                description: |-
                  collisionProtection specifies the default collision protection strategy for all objects
                  in this revision. Individual phases or objects can override this value.

                  When set, this value is used as the default for any phase or object that does not
                  explicitly specify its own collisionProtection.

                  The resolution order is: object > phase > spec
                enum:
                - Prevent
                - IfNoController
                - None
                type: string
                x-kubernetes-validations:
                - message: collisionProtection is immutable
                  rule: self == oldSelf
              lifecycleState:
                description: |-
                  lifecycleState specifies the lifecycle state of the ClusterExtensionRevision.

                  When set to "Active", the revision is actively managed and reconciled.
                  When set to "Archived", the revision is inactive and any resources not managed by a subsequent revision are deleted.
                  The revision is removed from the owner list of all objects previously under management.
                  All objects that did not transition to a succeeding revision are deleted.

                  Once a revision is set to "Archived", it cannot be un-archived.

                  It is possible for more than one revision to be "Active" simultaneously. This will occur when
                  moving from one revision to another. The old revision will not be set to "Archived" until the
                  new revision has been completely rolled out.
                enum:
                - Active
                - Archived
                type: string
                x-kubernetes-validations:
                - message: cannot un-archive
                  rule: oldSelf == 'Active' || oldSelf == 'Archived' && oldSelf ==
                    self
              phases:
                description: |-
                  phases is an optional, immutable list of phases that group objects to be applied together.

                  Objects are organized into phases based on their Group-Kind. Common phases include:
                    - namespaces: Namespace objects
                    - policies: ResourceQuota, LimitRange, NetworkPolicy objects
                    - rbac: ServiceAccount, Role, RoleBinding, ClusterRole, ClusterRoleBinding objects
                    - crds: CustomResourceDefinition objects
                    - storage: PersistentVolume, PersistentVolumeClaim, StorageClass objects
                    - deploy: Deployment, StatefulSet, DaemonSet, Service, ConfigMap, Secret objects
                    - publish: Ingress, APIService, Route, Webhook objects

                  All objects in a phase are applied in no particular order.
                  The revision progresses to the next phase only after all objects in the current phase pass their readiness probes.

                  Once set, even if empty, the phases field is immutable.

                  Each phase in the list must have a unique name. The maximum number of phases is 20.
                items:
                  description: |-
                    ClusterExtensionRevisionPhase represents a group of objects that are applied together. The phase is considered
                    complete only after all objects pass their status probes.
                  properties:
                    collisionProtection:
                      description: |-
                        collisionProtection specifies the default collision protection strategy for all objects
                        in this phase. Individual objects can override this value.

                        When set, this value is used as the default for any object in this phase that does not
                        explicitly specify its own collisionProtection.

                        When omitted, we use .spec.collistionProtection as the default for any object in this phase that does not
                        explicitly specify its own collisionProtection.
                      enum:
                      - Prevent
                      - IfNoController
                      - None
                      type: string
                    name:
                      description: |-
                        name is a required identifier for this phase.

                        phase names must follow the DNS label standard as defined in [RFC 1123].
                        They must contain only lowercase alphanumeric characters or hyphens (-),
                        start and end with an alphanumeric character, and be no longer than 63 characters.

                        Common phase names include: namespaces, policies, rbac, crds, storage, deploy, publish.

                        [RFC 1123]: https://tools.ietf.org/html/rfc1123
                      maxLength: 63
                      minLength: 1
                      type: string
                      x-kubernetes-validations:
                      - message: the value must consist of only lowercase alphanumeric
                          characters and hyphens, and must start with an alphabetic
                          character and end with an alphanumeric character.
                        rule: '!format.dns1123Label().validate(self).hasValue()'
                    objects:
                      description: |-
                        objects is a required list of all Kubernetes objects that belong to this phase.

                        All objects in this list are applied to the cluster in no particular order. The maximum number of objects per phase is 50.
                      items:
                        description: |-
                          ClusterExtensionRevisionObject represents a Kubernetes object to be applied as part
                          of a phase, along with its collision protection settings.
                        properties:
                          collisionProtection:
                            description: |-
                              collisionProtection controls whether the operator can adopt and modify objects
                              that already exist on the cluster.

                              Allowed values are: "Prevent", "IfNoController", and "None".

                              When set to "Prevent", the operator only manages objects it created itself.
                              This prevents ownership collisions.

                              When set to "IfNoController", the operator can adopt and modify pre-existing objects
                              that are not owned by another controller.
                              This is useful for taking over management of manually-created resources.

                              When set to "None", the operator can adopt and modify any pre-existing object, even if
                              owned by another controller.
                              Use this setting with extreme caution as it may cause multiple controllers to fight over
                              the same resource, resulting in increased load on the API server and etcd.

                              When omitted, the value is inherited from the phase, then spec.
                            enum:
                            - Prevent
                            - IfNoController
                            - None
                            type: string
                          object:
                            description: |-
                              object is a required embedded Kubernetes object to be applied.

                              This object must be a valid Kubernetes resource with apiVersion, kind, and metadata fields.
                            type: object
                            x-kubernetes-embedded-resource: true
                            x-kubernetes-preserve-unknown-fields: true
                        required:
                        - object
                        type: object
                      maxItems: 50
                      type: array
                  required:
                  - name
                  - objects
                  type: object
                maxItems: 20
                type: array
                x-kubernetes-list-map-keys:
                - name
                x-kubernetes-list-type: map
                x-kubernetes-validations:
                - message: phases is immutable
                  rule: self == oldSelf || oldSelf.size() == 0
              progressDeadlineMinutes:
                description: |-
                  progressDeadlineMinutes is an optional field that defines the maximum period
                  of time in minutes after which an installation should be considered failed and
                  require manual intervention. This functionality is disabled when no value
                  is provided. The minimum period is 10 minutes, and the maximum is 720 minutes (12 hours).
                format: int32
                maximum: 720
                minimum: 10
                type: integer
              progressionProbes:
                description: |-
                  progressionProbes is an optional field which provides the ability to define custom readiness probes
                  for objects defined within spec.phases. As documented in that field, most kubernetes-native objects
                  within the phases already have some kind of readiness check built-in, but this field allows for checks
                  which are tailored to the objects being rolled out - particularly custom resources.

                  Probes defined within the progressionProbes list will apply to every phase in the revision. However, the probes will only
                  execute against phase objects which are a match for the provided selector type. For instance, a probe using a GroupKind selector
                  for ConfigMaps will automatically be considered to have passed for any non-ConfigMap object, but will halt any phase containing
                  a ConfigMap if that particular object does not pass the probe check.

                  The maximum number of probes is 20.
                items:
                  description: ProgressionProbe provides a custom probe definition,
                    consisting of an object selection method and assertions.
                  properties:
                    assertions:
                      description: |-
                        assertions is a required list of checks which will run against the objects selected by the selector. If
                        one or more assertions fail then the phase within which the object lives will be not be considered
                        'Ready', blocking rollout of all subsequent phases.
                      items:
                        description: Assertion is a discriminated union which defines
                          the probe type and definition used as an assertion.
                        properties:
                          conditionEqual:
                            description: conditionEqual contains the expected condition
                              type and status.
                            properties:
                              status:
                                description: |-
                                  status sets the expected condition status.

                                  Allowed values are "True" and "False".
                                enum:
                                - "True"
                                - "False"
                                type: string
                              type:
                                description: type sets the expected condition type,
                                  i.e. "Ready".
                                maxLength: 200
                                minLength: 1
                                type: string
                            required:
                            - status
                            - type
                            type: object
                          fieldValue:
                            description: fieldValue contains the expected field path
                              and value found within.
                            properties:
                              fieldPath:
                                description: |-
                                  fieldPath sets the field path for the field to check, i.e. "status.phase". The probe will fail
                                  if the path does not exist.
                                maxLength: 200
                                minLength: 1
                                type: string
                                x-kubernetes-validations:
                                - message: must contain a valid field path. valid
                                    fields contain upper or lower-case alphanumeric
                                    characters separated by the "." character.
                                  rule: self.matches('^[a-zA-Z0-9]+(?:\\.[a-zA-Z0-9]+)*$')
                              value:
                                description: value sets the expected value found at
                                  fieldPath, i.e. "Bound".
                                maxLength: 200
                                minLength: 1
                                type: string
                            required:
                            - fieldPath
                            - value
                            type: object
                          fieldsEqual:
                            description: fieldsEqual contains the two field paths
                              whose values are expected to match.
                            properties:
                              fieldA:
                                description: |-
                                  fieldA sets the field path for the first field, i.e. "spec.replicas". The probe will fail
                                  if the path does not exist.
                                maxLength: 200
                                minLength: 1
                                type: string
                                x-kubernetes-validations:
                                - message: must contain a valid field path. valid
                                    fields contain upper or lower-case alphanumeric
                                    characters separated by the "." character.
                                  rule: self.matches('^[a-zA-Z0-9]+(?:\\.[a-zA-Z0-9]+)*$')
                              fieldB:
                                description: |-
                                  fieldB sets the field path for the second field, i.e. "status.readyReplicas". The probe will fail
                                  if the path does not exist.
                                maxLength: 200
                                minLength: 1
                                type: string
                                x-kubernetes-validations:
                                - message: must contain a valid field path. valid
                                    fields contain upper or lower-case alphanumeric
                                    characters separated by the "." character.
                                  rule: self.matches('^[a-zA-Z0-9]+(?:\\.[a-zA-Z0-9]+)*$')
                            required:
                            - fieldA
                            - fieldB
                            type: object
                          type:
                            description: |-
                              type is a required field which specifies the type of probe to use.

                              The allowed probe types are "ConditionEqual", "FieldsEqual", and "FieldValue".

                              When set to "ConditionEqual", the probe checks objects that have reached a condition of specified type and status.
                              When set to "FieldsEqual", the probe checks that the values found at two provided field paths are matching.
                              When set to "FieldValue", the probe checks that the value found at the provided field path matches what was specified.
                            enum:
                            - ConditionEqual
                            - FieldsEqual
                            - FieldValue
                            type: string
                        required:
                        - type
                        type: object
                        x-kubernetes-validations:
                        - message: conditionEqual is required when type is ConditionEqual,
                            and forbidden otherwise
                          rule: 'self.type == ''ConditionEqual'' ?has(self.conditionEqual)
                            : !has(self.conditionEqual)'
                        - message: fieldsEqual is required when type is FieldsEqual,
                            and forbidden otherwise
                          rule: 'self.type == ''FieldsEqual'' ?has(self.fieldsEqual)
                            : !has(self.fieldsEqual)'
                        - message: fieldValue is required when type is FieldValue,
                            and forbidden otherwise
                          rule: 'self.type == ''FieldValue'' ?has(self.fieldValue)
                            : !has(self.fieldValue)'
                      maxItems: 20
                      minItems: 1
                      type: array
                      x-kubernetes-list-type: atomic
                    selector:
                      description: |-
                        selector is a required field which defines the method by which we select objects to apply the below
                        assertions to. Any object which matches the defined selector will have all the associated assertions
                        applied against it.

                        If no objects within a phase are selected by the provided selector, then all assertions defined here
                        are considered to have succeeded.
                      properties:
                        groupKind:
                          description: |-
                            groupKind specifies the group and kind of objects to select.

                            Required when type is "GroupKind".

                            Uses the Kubernetes format specified here:
                            https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#GroupKind
                          properties:
                            group:
                              type: string
                            kind:
                              type: string
                          required:
                          - group
                          - kind
                          type: object
                        label:
                          description: |-
                            label is the label selector definition.

                            Required when type is "Label".

                            A probe using a Label selector will be executed against every object matching the labels or expressions; you must use care
                            when using this type of selector. For example, if multiple Kind objects are selected via labels then the probe is
                            likely to fail because the values of different Kind objects rarely share the same schema.

                            The LabelSelector field uses the following Kubernetes format:
                            https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#LabelSelector
                            Requires exactly one of matchLabels or matchExpressions.
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - key
                                - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                          x-kubernetes-validations:
                          - message: exactly one of matchLabels or matchExpressions
                              must be set
                            rule: (has(self.matchExpressions) && !has(self.matchLabels))
                              || (!has(self.matchExpressions) && has(self.matchLabels))
                        type:
                          description: |-
                            type is a required field which specifies the type of selector to use.

                            The allowed selector types are "GroupKind" and "Label".

                            When set to "GroupKind", all objects which match the specified group and kind will be selected.
                            When set to "Label", all objects which match the specified labels and/or expressions will be selected.
                          enum:
                          - GroupKind
                          - Label
                          type: string
                      required:
                      - type
                      type: object
                      x-kubernetes-validations:
                      - message: groupKind is required when type is GroupKind, and
                          forbidden otherwise
                        rule: 'self.type == ''GroupKind'' ?has(self.groupKind) : !has(self.groupKind)'
                      - message: label is required when type is Label, and forbidden
                          otherwise
                        rule: 'self.type == ''Label'' ?has(self.label) : !has(self.label)'
                  required:
                  - assertions
                  - selector
                  type: object
                maxItems: 20
                minItems: 1
                type: array
                x-kubernetes-list-type: atomic
              revision:
                description: |-
                  revision is a required, immutable sequence number representing a specific revision
                  of the parent ClusterExtension.

                  The revision field must be a positive integer.
                  Each ClusterExtensionRevision belonging to the same parent ClusterExtension must have a unique revision number.
                  The revision number must always be the previous revision number plus one, or 1 for the first revision.
                format: int64
                minimum: 1
                type: integer
                x-kubernetes-validations:
                - message: revision is immutable
                  rule: self == oldSelf
            required:
            - collisionProtection
            - lifecycleState
            - revision
            type: object
          status:
            description: status is optional and defines the observed state of the
              ClusterExtensionRevision.
            properties:
              conditions:
                description: |-
                  conditions is an optional list of status conditions describing the state of the
                  ClusterExtensionRevision.

                  The Progressing condition represents whether the revision is actively rolling out:
                    - When status is True and reason is RollingOut, the ClusterExtensionRevision rollout is actively making progress and is in transition.
                    - When status is True and reason is Retrying, the ClusterExtensionRevision has encountered an error that could be resolved on subsequent reconciliation attempts.
                    - When status is True and reason is Succeeded, the ClusterExtensionRevision has reached the desired state.
                    - When status is False and reason is Blocked, the ClusterExtensionRevision has encountered an error that requires manual intervention for recovery.
                    - When status is False and reason is Archived, the ClusterExtensionRevision is archived and not being actively reconciled.

                  The Available condition represents whether the revision has been successfully rolled out and is available:
                    - When status is True and reason is ProbesSucceeded, the ClusterExtensionRevision has been successfully rolled out and all objects pass their readiness probes.
                    - When status is False and reason is ProbeFailure, one or more objects are failing their readiness probes during rollout.
                    - When status is Unknown and reason is Reconciling, the ClusterExtensionRevision has encountered an error that prevented it from observing the probes.
                    - When status is Unknown and reason is Archived, the ClusterExtensionRevision has been archived and its objects have been torn down.
                    - When status is Unknown and reason is Migrated, the ClusterExtensionRevision was migrated from an existing release and object status probe results have not yet been observed.

                  The Succeeded condition represents whether the revision has successfully completed its rollout:
                    - When status is True and reason is Succeeded, the ClusterExtensionRevision has successfully completed its rollout. This condition is set once and persists even if the revision later becomes unavailable.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
# Source: olmv1/templates/crds/customresourcedefinition-clusterextensions.olm.operatorframework.io.yml
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.20.1
    olm.operatorframework.io/generator: experimental
  name: clusterextensions.olm.operatorframework.io
spec:
  group: olm.operatorframework.io
  names:
    kind: ClusterExtension
    listKind: ClusterExtensionList
    plural: clusterextensions
    singular: clusterextension
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.install.bundle.name
      name: Installed Bundle
      type: string
    - jsonPath: .status.install.bundle.version
      name: Version
      type: string
    - jsonPath: .status.conditions[?(@.type=='Installed')].status
      name: Installed
      type: string
    - jsonPath: .status.conditions[?(@.type=='Progressing')].status
      name: Progressing
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: ClusterExtension is the Schema for the clusterextensions API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: spec is an optional field that defines the desired state
              of the ClusterExtension.
            properties:
              config:
                description: |-
                  config is optional and specifies bundle-specific configuration.
                  Configuration is bundle-specific and a bundle may provide a configuration schema.
                  When not specified, the default configuration of the resolved bundle is used.

                  config is validated against a configuration schema provided by the resolved bundle. If the bundle does not provide
                  a configuration schema the bundle is deemed to not be configurable. More information on how
                  to configure bundles can be found in the OLM documentation associated with your current OLM version.
                properties:
                  configType:
                    description: |-
                      configType is required and specifies the type of configuration source.

                      The only allowed value is "Inline".

                      When set to "Inline", the cluster extension configuration is defined inline within the ClusterExtension resource.
                    enum:
                    - Inline
                    type: string
                  inline:
                    description: |-
                      inline contains JSON or YAML values specified directly in the ClusterExtension.

                      It is used to specify arbitrary configuration values for the ClusterExtension.
                      It must be set if configType is 'Inline' and must be a valid JSON/YAML object containing at least one property.
                      The configuration values are validated at runtime against a JSON schema provided by the bundle.
                    minProperties: 1
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                required:
                - configType
                type: object
                x-kubernetes-validations:
                - message: inline is required when configType is Inline, and forbidden
                    otherwise
                  rule: 'has(self.configType) && self.configType == ''Inline'' ?has(self.inline)
                    : !has(self.inline)'
              install:
                description: |-
                  install is optional and configures installation options for the ClusterExtension,
                  such as the pre-flight check configuration.
                properties:
                  preflight:
                    description: |-
                      preflight is optional and configures the checks that run before installation or upgrade
                      of the content for the package specified in the packageName field.

                      When specified, it replaces the default preflight configuration for install/upgrade actions.
                      When not specified, the default configuration is used.
                    properties:
                      crdUpgradeSafety:
                        description: |-
                          crdUpgradeSafety configures the CRD Upgrade Safety pre-flight checks that run
                          before upgrades of installed content.

                          The CRD Upgrade Safety pre-flight check safeguards from unintended consequences of upgrading a CRD,
                          such as data loss.
                        properties:
                          enforcement:
                            description: |-
                              enforcement is required and configures the state of the CRD Upgrade Safety pre-flight check.

                              Allowed values are "None" or "Strict". The default value is "Strict".

                              When set to "None", the CRD Upgrade Safety pre-flight check is skipped during an upgrade operation.
                              Use this option with caution as unintended consequences such as data loss can occur.

                              When set to "Strict", the CRD Upgrade Safety pre-flight check runs during an upgrade operation.
                            enum:
                            - None
                            - Strict
                            type: string
                        required:
                        - enforcement
                        type: object
                    required:
                    - crdUpgradeSafety
                    type: object
                    x-kubernetes-validations:
                    - message: at least one of [crdUpgradeSafety] are required when
                        preflight is specified
                      rule: has(self.crdUpgradeSafety)
                type: object
                x-kubernetes-validations:
                - message: at least one of [preflight] are required when install is
                    specified
                  rule: has(self.preflight)
              namespace:
                description: |-
                  namespace specifies a Kubernetes namespace.
                  This is the namespace where the provided ServiceAccount must exist.
                  It also designates the default namespace where namespace-scoped resources for the extension are applied to the cluster.
                  Some extensions may contain namespace-scoped resources to be applied in other namespaces.
                  This namespace must exist.

                  The namespace field is required, immutable, and follows the DNS label standard as defined in [RFC 1123].
                  It must contain only lowercase alphanumeric characters or hyphens (-), start and end with an alphanumeric character,
                  and be no longer than 63 characters.

                  [RFC 1123]: https://tools.ietf.org/html/rfc1123
                maxLength: 63
                type: string
                x-kubernetes-validations:
                - message: namespace is immutable
                  rule: self == oldSelf
                - message: namespace must be a valid DNS1123 label
                  rule: self.matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?$")
              progressDeadlineMinutes:
                description: |-
                  progressDeadlineMinutes is an optional field that defines the maximum period
                  of time in minutes after which an installation should be considered failed and
                  require manual intervention. This functionality is disabled when no value
                  is provided. The minimum period is 10 minutes, and the maximum is 720 minutes (12 hours).
                format: int32
                maximum: 720
                minimum: 10
                type: integer
              serviceAccount:
                description: |-
                  serviceAccount specifies a ServiceAccount used to perform all interactions with the cluster
                  that are required to manage the extension.
                  The ServiceAccount must be configured with the necessary permissions to perform these interactions.
                  The ServiceAccount must exist in the namespace referenced in the spec.
                  The serviceAccount field is required.
                properties:
                  name:
                    description: |-
                      name is a required, immutable reference to the name of the ServiceAccount used for installation
                      and management of the content for the package specified in the packageName field.

                      This ServiceAccount must exist in the installNamespace.

                      The name field follows the DNS subdomain standard as defined in [RFC 1123].
                      It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.),
                      start and end with an alphanumeric character, and be no longer than 253 characters.

                      Some examples of valid values are:
                        - some-serviceaccount
                        - 123-serviceaccount
                        - 1-serviceaccount-2
                        - someserviceaccount
                        - some.serviceaccount

                      Some examples of invalid values are:
                        - -some-serviceaccount
                        - some-serviceaccount-

                      [RFC 1123]: https://tools.ietf.org/html/rfc1123
                    maxLength: 253
                    type: string
                    x-kubernetes-validations:
                    - message: name is immutable
                      rule: self == oldSelf
                    - message: name must be a valid DNS1123 subdomain. It must contain
                        only lowercase alphanumeric characters, hyphens (-) or periods
                        (.), start and end with an alphanumeric character, and be
                        no longer than 253 characters
                      rule: self.matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
                required:
                - name
                type: object
              source:
                description: |-
                  source is required and selects the installation source of content for this ClusterExtension.
                  Set the sourceType field to perform the selection.

                  Catalog is currently the only implemented sourceType.
                  Setting sourceType to "Catalog" requires the catalog field to also be defined.

                  Below is a minimal example of a source definition (in yaml):

                  source:
                    sourceType: Catalog
                    catalog:
                      packageName: example-package
                properties:
                  catalog:
                    description: |-
                      catalog configures how information is sourced from a catalog.
                      It is required when sourceType is "Catalog", and forbidden otherwise.
                    properties:
                      channels:
                        description: |-
                          channels is optional and specifies a set of channels belonging to the package
                          specified in the packageName field.

                          A channel is a package-author-defined stream of updates for an extension.

                          Each channel in the list must follow the DNS subdomain standard as defined in [RFC 1123].
                          It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.),
                          start and end with an alphanumeric character, and be no longer than 253 characters.
                          You can specify no more than 256 channels.

                          When specified, it constrains the set of installable bundles and the automated upgrade path.
                          This constraint is an AND operation with the version field. For example:
                            - Given channel is set to "foo"
                            - Given version is set to ">=1.0.0, <1.5.0"
                            - Only bundles that exist in channel "foo" AND satisfy the version range comparison are considered installable
                            - Automatic upgrades are constrained to upgrade edges defined by the selected channel

                          When unspecified, upgrade edges across all channels are used to identify valid automatic upgrade paths.

                          Some examples of valid values are:
                            - 1.1.x
                            - alpha
                            - stable
                            - stable-v1
                            - v1-stable
                            - dev-preview
                            - preview
                            - community

                          Some examples of invalid values are:
                            - -some-channel
                            - some-channel-
                            - thisisareallylongchannelnamethatisgreaterthanthemaximumlength
                            - original_40
                            - --default-channel

                          [RFC 1123]: https://tools.ietf.org/html/rfc1123
                        items:
                          maxLength: 253
                          type: string
                          x-kubernetes-validations:
                          - message: channels entries must be valid DNS1123 subdomains
                            rule: self.matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
                        maxItems: 256
                        type: array
                      packageName:
                        description: |-
                          packageName specifies the name of the package to be installed and is used to filter
                          the content from catalogs.

                          It is required, immutable, and follows the DNS subdomain standard as defined in [RFC 1123].
                          It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.),
                          start and end with an alphanumeric character, and be no longer than 253 characters.

                          Some examples of valid values are:
                            - some-package
                            - 123-package
                            - 1-package-2
                            - somepackage

                          Some examples of invalid values are:
                            - -some-package
                            - some-package-
                            - thisisareallylongpackagenamethatisgreaterthanthemaximumlength
                            - some.package

                          [RFC 1123]: https://tools.ietf.org/html/rfc1123
                        maxLength: 253
                        type: string
                        x-kubernetes-validations:
                        - message: packageName is immutable
                          rule: self == oldSelf
                        - message: packageName must be a valid DNS1123 subdomain.
                            It must contain only lowercase alphanumeric characters,
                            hyphens (-) or periods (.), start and end with an alphanumeric
                            character, and be no longer than 253 characters
                          rule: self.matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
                      selector:
                        description: |-
                          selector is optional and filters the set of ClusterCatalogs used in the bundle selection process.

                          When unspecified, all ClusterCatalogs are used in the bundle selection process.
                        properties:
                          matchExpressions:
                            description: matchExpressions is a list of label selector
                              requirements. The requirements are ANDed.
                            items:
                              description: |-
                                A label selector requirement is a selector that contains values, a key, and an operator that
                                relates the key and values.
                              properties:
                                key:
                                  description: key is the label key that the selector
                                    applies to.
                                  type: string
                                operator:
                                  description: |-
                                    operator represents a key's relationship to a set of values.
                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                  type: string
                                values:
                                  description: |-
                                    values is an array of string values. If the operator is In or NotIn,
                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                    the values array must be empty. This array is replaced during a strategic
                                    merge patch.
                                  items:
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                              required:
                              - key
                              - operator
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          matchLabels:
                            additionalProperties:
                              type: string
                            description: |-
                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                            type: object
                        type: object
                        x-kubernetes-map-type: atomic
                      upgradeConstraintPolicy:
                        default: CatalogProvided
                        description: |-
                          upgradeConstraintPolicy is optional and controls whether the upgrade paths defined in the catalog
                          are enforced for the package referenced in the packageName field.

                          Allowed values are "CatalogProvided", "SelfCertified", or omitted.

                          When set to "CatalogProvided", automatic upgrades only occur when upgrade constraints specified by the package
                          author are met.

                          When set to "SelfCertified", the upgrade constraints specified by the package author are ignored.
                          This allows upgrades and downgrades to any version of the package.
                          This is considered a dangerous operation as it can lead to unknown and potentially disastrous outcomes,
                          such as data loss.
                          Use this option only if you have independently verified the changes.

                          When omitted, the default value is "CatalogProvided".
                        enum:
                        - CatalogProvided
                        - SelfCertified
                        type: string
                      version:
                        description: |-
                          version is an optional semver constraint (a specific version or range of versions).
                          When unspecified, the latest version available is installed.

                          Acceptable version ranges are no longer than 64 characters.
                          Version ranges are composed of comma- or space-delimited values and one or more comparison operators,
                          known as comparison strings.
                          You can add additional comparison strings using the OR operator (||).

                          # Range Comparisons

                          To specify a version range, you can use a comparison string like ">=3.0,
                          <3.6". When specifying a range, automatic updates will occur within that
                          range. The example comparison string means "install any version greater than
                          or equal to 3.0.0 but less than 3.6.0.". It also states intent that if any
                          upgrades are available within the version range after initial installation,
                          those upgrades should be automatically performed.

                          # Pinned Versions

                          To specify an exact version to install you can use a version range that
                          "pins" to a specific version. When pinning to a specific version, no
                          automatic updates will occur. An example of a pinned version range is
                          "0.6.0", which means "only install version 0.6.0 and never
                          upgrade from this version".

                          # Basic Comparison Operators

                          The basic comparison operators and their meanings are:
                            - "=", equal (not aliased to an operator)
                            - "!=", not equal
                            - "<", less than
                            - ">", greater than
                            - ">=", greater than OR equal to
                            - "<=", less than OR equal to

                          # Wildcard Comparisons

                          You can use the "x", "X", and "*" characters as wildcard characters in all
                          comparison operations. Some examples of using the wildcard characters:
                            - "1.2.x", "1.2.X", and "1.2.*" is equivalent to ">=1.2.0, < 1.3.0"
                            - ">= 1.2.x", ">= 1.2.X", and ">= 1.2.*" is equivalent to ">= 1.2.0"
                            - "<= 2.x", "<= 2.X", and "<= 2.*" is equivalent to "< 3"
                            - "x", "X", and "*" is equivalent to ">= 0.0.0"

                          # Patch Release Comparisons

                          When you want to specify a minor version up to the next major version you
                          can use the "~" character to perform patch comparisons. Some examples:
                            - "~1.2.3" is equivalent to ">=1.2.3, <1.3.0"
                            - "~1" and "~1.x" is equivalent to ">=1, <2"
                            - "~2.3" is equivalent to ">=2.3, <2.4"
                            - "~1.2.x" is equivalent to ">=1.2.0, <1.3.0"

                          # Major Release Comparisons

                          You can use the "^" character to make major release comparisons after a
                          stable 1.0.0 version is published. If there is no stable version published, // minor versions define the stability level. Some examples:
                            - "^1.2.3" is equivalent to ">=1.2.3, <2.0.0"
                            - "^1.2.x" is equivalent to ">=1.2.0, <2.0.0"
                            - "^2.3" is equivalent to ">=2.3, <3"
                            - "^2.x" is equivalent to ">=2.0.0, <3"
                            - "^0.2.3" is equivalent to ">=0.2.3, <0.3.0"
                            - "^0.2" is equivalent to ">=0.2.0, <0.3.0"
                            - "^0.0.3" is equvalent to ">=0.0.3, <0.0.4"
                            - "^0.0" is equivalent to ">=0.0.0, <0.1.0"
                            - "^0" is equivalent to ">=0.0.0, <1.0.0"

                          # OR Comparisons
                          You can use the "||" character to represent an OR operation in the version
                          range. Some examples:
                            - ">=1.2.3, <2.0.0 || >3.0.0"
                            - "^0 || ^3 || ^5"

                          For more information on semver, please see https://semver.org/
                        maxLength: 64
                        type: string
                        x-kubernetes-validations:
                        - message: invalid version expression
                          rule: self.matches("^(\\s*(=||!=|>|<|>=|=>|<=|=<|~|~>|\\^)\\s*(v?(0|[1-9]\\d*|[x|X|\\*])(\\.(0|[1-9]\\d*|x|X|\\*]))?(\\.(0|[1-9]\\d*|x|X|\\*))?(-([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?(\\+([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?)\\s*)((?:\\s+|,\\s*|\\s*\\|\\|\\s*)(=||!=|>|<|>=|=>|<=|=<|~|~>|\\^)\\s*(v?(0|[1-9]\\d*|x|X|\\*])(\\.(0|[1-9]\\d*|x|X|\\*))?(\\.(0|[1-9]\\d*|x|X|\\*]))?(-([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?(\\+([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?)\\s*)*$")
                    required:
                    - packageName
                    type: object
                  sourceType:
                    description: |-
                      sourceType is required and specifies the type of install source.

                      The only allowed value is "Catalog".

                      When set to "Catalog", information for determining the appropriate bundle of content to install
                      is fetched from ClusterCatalog resources on the cluster.
                      When using the Catalog sourceType, the catalog field must also be set.
                    enum:
                    - Catalog
                    type: string
                required:
                - sourceType
                type: object
                x-kubernetes-validations:
                - message: catalog is required when sourceType is Catalog, and forbidden
                    otherwise
                  rule: 'has(self.sourceType) && self.sourceType == ''Catalog'' ?
                    has(self.catalog) : !has(self.catalog)'
            required:
            - namespace
            - serviceAccount
            - source
            type: object
          status:
            description: status is an optional field that defines the observed state
              of the ClusterExtension.
            properties:
              activeRevisions:
                description: |-
                  activeRevisions holds a list of currently active (non-archived) ClusterExtensionRevisions,
                  including both installed and rolling out revisions.
                items:
                  description: RevisionStatus defines the observed state of a ClusterExtensionRevision.
                  properties:
                    conditions:
                      description: |-
                        conditions optionally expose Progressing and Available condition of the revision,
                        in case when it is not yet marked as successfully installed (condition Succeeded is not set to True).
                        Given that a ClusterExtension should remain available during upgrades, an observer may use these conditions
                        to get more insights about reasons for its current state.
                      items:
                        description: Condition contains details for one aspect of
                          the current state of this API Resource.
                        properties:
                          lastTransitionTime:
                            description: |-
                              lastTransitionTime is the last time the condition transitioned from one status to another.
                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                            format: date-time
                            type: string
                          message:
                            description: |-
                              message is a human readable message indicating details about the transition.
                              This may be an empty string.
                            maxLength: 32768
                            type: string
                          observedGeneration:
                            description: |-
                              observedGeneration represents the .metadata.generation that the condition was set based upon.
                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                              with respect to the current state of the instance.
                            format: int64
                            minimum: 0
                            type: integer
                          reason:
                            description: |-
                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
                              Producers of specific condition types may define expected values and meanings for this field,
                              and whether the values are considered a guaranteed API.
                              The value should be a CamelCase string.
                              This field may not be empty.
                            maxLength: 1024
                            minLength: 1
                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                            type: string
                          status:
                            description: status of the condition, one of True, False,
                              Unknown.
                            enum:
                            - "True"
                            - "False"
                            - Unknown
                            type: string
                          type:
                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
                            maxLength: 316
                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                            type: string
                        required:
                        - lastTransitionTime
                        - message
                        - reason
                        - status
                        - type
                        type: object
                      type: array
                      x-kubernetes-list-map-keys:
                      - type
                      x-kubernetes-list-type: map
                    name:
                      description: name of the ClusterExtensionRevision resource
                      type: string
                  required:
                  - name
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - name
                x-kubernetes-list-type: map
              conditions:
                description: |-
                  conditions represents the current state of the ClusterExtension.

                  The set of condition types which apply to all spec.source variations are Installed and Progressing.

                  The Installed condition represents whether the bundle has been installed for this ClusterExtension:
                    - When Installed is True and the Reason is Succeeded, the bundle has been successfully installed.
                    - When Installed is False and the Reason is Failed, the bundle has failed to install.

                  The Progressing condition represents whether or not the ClusterExtension is advancing towards a new state.
                  When Progressing is True and the Reason is Succeeded, the ClusterExtension is making progress towards a new state.
                  When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.
                  When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.

                  When Progressing is True and Reason is RollingOut, the ClusterExtension has one or more ClusterExtensionRevisions in active roll out.

                  When the ClusterExtension is sourced from a catalog, it surfaces deprecation conditions based on catalog metadata.
                  These are indications from a package owner to guide users away from a particular package, channel, or bundle:
                    - BundleDeprecated is True if the installed bundle is marked deprecated, False if not deprecated, or Unknown if no bundle is installed yet or if catalog data is unavailable.
                    - ChannelDeprecated is True if any requested channel is marked deprecated, False if not deprecated, or Unknown if catalog data is unavailable.
                    - PackageDeprecated is True if the requested package is marked deprecated, False if not deprecated, or Unknown if catalog data is unavailable.
                    - Deprecated is a rollup condition that is True when any deprecation exists, False when none exist, or Unknown when catalog data is unavailable.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              install:
                description: install is a representation of the current installation
                  status for this ClusterExtension.
                properties:
                  bundle:
                    description: |-
                      bundle is required and represents the identifying attributes of a bundle.

                      A "bundle" is a versioned set of content that represents the resources that need to be applied
                      to a cluster to install a package.
                    properties:
                      name:
                        description: |-
                          name is required and follows the DNS subdomain standard as defined in [RFC 1123].
                          It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.),
                          start and end with an alphanumeric character, and be no longer than 253 characters.
                        type: string
                        x-kubernetes-validations:
                        - message: packageName must be a valid DNS1123 subdomain.
                            It must contain only lowercase alphanumeric characters,
                            hyphens (-) or periods (.), start and end with an alphanumeric
                            character, and be no longer than 253 characters
                          rule: self.matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
                      version:
                        description: |-
                          version is required and references the version that this bundle represents.
                          It follows the semantic versioning standard as defined in https://semver.org/.
                        type: string
                        x-kubernetes-validations:
                        - message: version must be well-formed semver
                          rule: self.matches("^([0-9]+)(\\.[0-9]+)?(\\.[0-9]+)?(-([-0-9A-Za-z]+(\\.[-0-9A-Za-z]+)*))?(\\+([-0-9A-Za-z]+(-\\.[-0-9A-Za-z]+)*))?")
                    required:
                    - name
                    - version
                    type: object
                required:
                - bundle
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
# Source: olmv1/templates/rbac/clusterrole-catalogd-manager-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: catalogd-manager-role
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
rules:
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clustercatalogs
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clustercatalogs/finalizers
    verbs:
      - update
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clustercatalogs/status
    verbs:
      - get
      - patch
      - update
---
# Source: olmv1/templates/rbac/clusterrole-common-metrics-reader.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-metrics-reader
rules:
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
---
# Source: olmv1/templates/rbac/clusterrole-common-metrics-reader.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-metrics-reader
rules:
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
---
# Source: olmv1/templates/rbac/clusterrole-common-proxy-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-proxy-role
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
---
# Source: olmv1/templates/rbac/clusterrole-common-proxy-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-proxy-role
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
---
# Source: olmv1/templates/rbac/clusterrole-operator-controller-clusterextension-viewer-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-clusterextension-viewer-role
rules:
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensions
    verbs:
      - get
      - list
      - watch
---
# Source: olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: operator-controller-manager-role
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
rules:
  - apiGroups:
      - ""
    resources:
      - serviceaccounts/token
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - serviceaccounts
    verbs:
      - get
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clustercatalogs
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensions
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensions/finalizers
    verbs:
      - update
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensions/status
    verbs:
      - patch
      - update
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterrolebindings
      - clusterroles
      - rolebindings
      - roles
    verbs:
      - list
      - watch
  - apiGroups:
      - "*"
    resources:
      - "*"
    verbs:
      - list
      - watch
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensionrevisions
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensionrevisions/status
    verbs:
      - patch
      - update
  - apiGroups:
      - olm.operatorframework.io
    resources:
      - clusterextensionrevisions/finalizers
    verbs:
      - update
---
# Source: olmv1/templates/rbac/clusterrolebinding-catalogd-manager-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: catalogd-manager-role
subjects:
  - kind: ServiceAccount
    name: catalogd-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/clusterrolebinding-common-proxy-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: catalogd-proxy-role
subjects:
  - kind: ServiceAccount
    name: catalogd-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/clusterrolebinding-common-proxy-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: operator-controller-proxy-role
subjects:
  - kind: ServiceAccount
    name: operator-controller-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/clusterrolebinding-operator-controller-manager-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-manager-admin-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: operator-controller-manager-role
subjects:
  - kind: ServiceAccount
    name: operator-controller-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/role-olmv1-system-catalogd-manager-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: catalogd-manager-role
  namespace: olmv1-system
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
      - serviceaccounts
    verbs:
      - get
      - list
      - watch
---
# Source: olmv1/templates/rbac/role-olmv1-system-common-leader-election-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-leader-election-role
  namespace: olmv1-system
rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
---
# Source: olmv1/templates/rbac/role-olmv1-system-common-leader-election-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-leader-election-role
  namespace: olmv1-system
rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
---
# Source: olmv1/templates/rbac/role-olmv1-system-operator-controller-manager-role.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: operator-controller-manager-role
  namespace: olmv1-system
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - serviceaccounts
    verbs:
      - get
      - list
      - watch
---
# Source: olmv1/templates/rbac/rolebinding-olmv1-system-common-leader-election-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-leader-election-rolebinding
  namespace: olmv1-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: catalogd-leader-election-role
subjects:
  - kind: ServiceAccount
    name: catalogd-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/rolebinding-olmv1-system-common-leader-election-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-leader-election-rolebinding
  namespace: olmv1-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: operator-controller-leader-election-role
subjects:
  - kind: ServiceAccount
    name: operator-controller-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/rolebinding-olmv1-system-common-manager-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-manager-rolebinding
  namespace: olmv1-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: catalogd-manager-role
subjects:
  - kind: ServiceAccount
    name: catalogd-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/rbac/rolebinding-olmv1-system-common-manager-rolebinding.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-manager-rolebinding
  namespace: olmv1-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: operator-controller-manager-role
subjects:
  - kind: ServiceAccount
    name: operator-controller-controller-manager
    namespace: olmv1-system
---
# Source: olmv1/templates/service-olmv1-system-catalogd-service.yml
apiVersion: v1
kind: Service
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-service
  namespace: olmv1-system
spec:
  ports:
    - name: https
      port: 443
      protocol: TCP
      targetPort: 8443
    - name: webhook
      port: 9443
      protocol: TCP
      targetPort: 9443
    - name: metrics
      port: 7443
      protocol: TCP
      targetPort: 7443
  selector:
    app.kubernetes.io/name: catalogd
---
# Source: olmv1/templates/service-olmv1-system-operator-controller-service.yml
apiVersion: v1
kind: Service
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-service
  namespace: olmv1-system
spec:
  ports:
    - name: metrics
      port: 8443
      protocol: TCP
      targetPort: 8443
  selector:
    app.kubernetes.io/name: operator-controller
---
# Source: olmv1/templates/e2e/pod-olmv1-system-e2e-coverage-copy-pod.yml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: e2e
    app.kubernetes.io/part-of: olm
  name: e2e-coverage-copy-pod
  namespace: olmv1-system
spec:
  containers:
    - command:
        - sleep
        - infinity
      image: busybox:1.36
      name: tar
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
        - mountPath: /e2e-coverage
          name: e2e-coverage-volume
          readOnly: true
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    seccompProfile:
      type: RuntimeDefault
  volumes:
    - name: e2e-coverage-volume
      persistentVolumeClaim:
        claimName: e2e-coverage
        readOnly: true
---
# Source: olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kubectl.kubernetes.io/default-logs-container: manager
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-controller-manager
  namespace: olmv1-system
spec:
  minReadySeconds: 5
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
      maxUnavailable: 0    # Never allow pods to be unavailable during updates
  selector:
    matchLabels:
      control-plane: catalogd-controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
        olm.operatorframework.io/feature-set: experimental-e2e
      labels:
        app.kubernetes.io/name: catalogd
        control-plane: catalogd-controller-manager
        app.kubernetes.io/part-of: olm
    spec:
      containers:
        - args:
            - --leader-elect
            - --metrics-bind-address=:7443
            - --pprof-bind-address=:6060
            - --external-address=catalogd-service.olmv1-system.svc
            - --feature-gates=APIV1MetasHandler=true
            - --tls-cert=/var/certs/tls.crt
            - --tls-key=/var/certs/tls.key
            - --pull-cas-dir=/var/ca-certs
            - --tls-profile=custom
            - --tls-custom-version=TLSv1.3
            - --tls-custom-curves=X25519,prime256v1
            - --tls-custom-ciphers=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384
          command:
            - ./catalogd
          env:
            - name: GOCOVERDIR
              value: /e2e-coverage
          image: "quay.io/operator-framework/catalogd:devel"
          name: manager
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          volumeMounts:
            - mountPath: /e2e-coverage
              name: e2e-coverage-volume
            - mountPath: /var/cache/
              name: cache
            - mountPath: /tmp
              name: tmp
            - mountPath: /var/certs
              name: catalogserver-certs
            - mountPath: /var/ca-certs
              name: ca-certs
              readOnly: true
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          terminationMessagePolicy: FallbackToLogsOnError
      serviceAccountName: catalogd-controller-manager
      volumes:
        - name: e2e-coverage-volume
          persistentVolumeClaim:
            claimName: e2e-coverage
        - emptyDir: {}
          name: cache
        - emptyDir: {}
          name: tmp
        - name: catalogserver-certs
          secret:
            items:
              - key: tls.crt
                path: tls.crt
              - key: tls.key
                path: tls.key
            optional: false
            secretName: catalogd-service-cert-git-version
        - name: ca-certs
          secret:
            items:
              - key: ca.crt
                path: olm-ca.crt
            optional: false
            secretName: catalogd-service-cert-git-version
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
                      - arm64
                      - ppc64le
                      - s390x
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: control-plane
                      operator: In
                      values:
                        - operator-controller-controller-manager
                        - catalogd-controller-manager
                topologyKey: kubernetes.io/hostname
              weight: 100
      nodeSelector:
        kubernetes.io/os: linux
        node-role.kubernetes.io/control-plane: ""
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      terminationGracePeriodSeconds: 10
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
---
# Source: olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kubectl.kubernetes.io/default-logs-container: manager
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: operator-controller
    app.kubernetes.io/part-of: olm
  name: operator-controller-controller-manager
  namespace: olmv1-system
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # Allow temporary extra pod for zero-downtime updates
      maxUnavailable: 0    # Never allow pods to be unavailable during updates
  selector:
    matchLabels:
      control-plane: operator-controller-controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
        olm.operatorframework.io/feature-set: experimental-e2e
      labels:
        app.kubernetes.io/name: operator-controller
        control-plane: operator-controller-controller-manager
        app.kubernetes.io/part-of: olm
    spec:
      containers:
        - args:
            - --health-probe-bind-address=:8081
            - --metrics-bind-address=:8443
            - --pprof-bind-address=:6060
            - --leader-elect
            - --feature-gates=SingleOwnNamespaceInstallSupport=true
            - --feature-gates=PreflightPermissions=true
            - --feature-gates=HelmChartSupport=true
            - --feature-gates=BoxcutterRuntime=true
            - --feature-gates=DeploymentConfig=true
            - --feature-gates=WebhookProviderOpenshiftServiceCA=false
            - --tls-cert=/var/certs/tls.crt
            - --tls-key=/var/certs/tls.key
            - --catalogd-cas-dir=/var/ca-certs
            - --pull-cas-dir=/var/ca-certs
            - --tls-profile=modern
          command:
            - /operator-controller
          env:
            - name: GOCOVERDIR
              value: /e2e-coverage
          image: "quay.io/operator-framework/operator-controller:devel"
          name: manager
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 10m
              memory: 64Mi
          volumeMounts:
            - mountPath: /etc/containers
              name: e2e-registries-conf
            - mountPath: /e2e-coverage
              name: e2e-coverage-volume
            - mountPath: /var/cache
              name: cache
            - mountPath: /tmp
              name: tmp
            - mountPath: /var/certs
              name: operator-controller-certs
              readOnly: true
            - mountPath: /var/ca-certs
              name: ca-certs
              readOnly: true
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          terminationMessagePolicy: FallbackToLogsOnError
      serviceAccountName: operator-controller-controller-manager
      volumes:
        - configMap:
            name: e2e-registries-conf
          name: e2e-registries-conf
        - name: e2e-coverage-volume
          persistentVolumeClaim:
            claimName: e2e-coverage
        - emptyDir: {}
          name: cache
        - emptyDir: {}
          name: tmp
        - name: operator-controller-certs
          secret:
            items:
              - key: tls.crt
                path: tls.crt
              - key: tls.key
                path: tls.key
            optional: false
            secretName: operator-controller-cert
        - name: ca-certs
          secret:
            items:
              - key: ca.crt
                path: olm-ca.crt
            optional: false
            secretName: operator-controller-cert
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
                      - arm64
                      - ppc64le
                      - s390x
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: control-plane
                      operator: In
                      values:
                        - operator-controller-controller-manager
                        - catalogd-controller-manager
                topologyKey: kubernetes.io/hostname
              weight: 100
      nodeSelector:
        kubernetes.io/os: linux
        node-role.kubernetes.io/control-plane: ""
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      terminationGracePeriodSeconds: 10
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
---
# Source: olmv1/templates/cert-manager/certificate-cert-manager-olmv1-ca.yml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    app.kubernetes.io/part-of: olm
  name: olmv1-ca
  namespace: cert-manager
spec:
  commonName: olmv1-ca
  isCA: true
  issuerRef:
    group: cert-manager.io
    kind: Issuer
    name: self-sign-issuer
  privateKey:
    algorithm: ECDSA
    rotationPolicy: Always
    size: 256
  secretName: olmv1-ca
  secretTemplate:
    annotations:
      cert-manager.io/allow-direct-injection: "true"
---
# Source: olmv1/templates/cert-manager/certificate-olmv1-system-catalogd-service-cert.yml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  name: catalogd-service-cert
  namespace: olmv1-system
spec:
  dnsNames:
    - localhost
    - catalogd-service.olmv1-system.svc
    - catalogd-service.olmv1-system.svc.cluster.local
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: olmv1-ca
  privateKey:
    algorithm: ECDSA
    rotationPolicy: Always
    size: 256
  secretName: catalogd-service-cert-git-version
---
# Source: olmv1/templates/cert-manager/certificate-olmv1-system-operator-controller-cert.yml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    app.kubernetes.io/part-of: olm
  name: operator-controller-cert
  namespace: olmv1-system
spec:
  dnsNames:
    - operator-controller-service.olmv1-system.svc
    - operator-controller-service.olmv1-system.svc.cluster.local
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: olmv1-ca
  privateKey:
    algorithm: ECDSA
    rotationPolicy: Always
    size: 256
  secretName: operator-controller-cert
---
# Source: olmv1/templates/cert-manager/clusterissuer-olmv1-ca.yml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    app.kubernetes.io/part-of: olm
  name: olmv1-ca
spec:
  ca:
    secretName: olmv1-ca
---
# Source: olmv1/templates/cert-manager/issuer-cert-manager-self-sign-issuer.yml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  annotations:
    olm.operatorframework.io/feature-set: experimental-e2e
  labels:
    app.kubernetes.io/name: olmv1
    app.kubernetes.io/part-of: olm
  name: self-sign-issuer
  namespace: cert-manager
spec:
  selfSigned: {}
---
# Source: olmv1/templates/mutatingwebhookconfiguration-catalogd-mutating-webhook-configuration.yml
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: catalogd-mutating-webhook-configuration
  labels:
    app.kubernetes.io/name: catalogd
    app.kubernetes.io/part-of: olm
  annotations:
    cert-manager.io/inject-ca-from-secret: cert-manager/olmv1-ca
    olm.operatorframework.io/feature-set: experimental-e2e
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: catalogd-service
        namespace: olmv1-system
        path: /mutate-olm-operatorframework-io-v1-clustercatalog
        port: 9443
    failurePolicy: Fail
    name: inject-metadata-name.olm.operatorframework.io
    rules:
      - apiGroups:
          - olm.operatorframework.io
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - clustercatalogs
    sideEffects: None
    timeoutSeconds: 10
    matchConditions:
      - name: MissingOrIncorrectMetadataNameLabel
        expression: "'name' in object.metadata && (!has(object.metadata.labels) || !('olm.operatorframework.io/metadata.name' in object.metadata.labels) || object.metadata.labels['olm.operatorframework.io/metadata.name'] != object.metadata.name)"