OLM GUI does not have permission to list its OLM CRDs

[jsafrane]

On current Kubernetes cluster (see below), "Kubernetes Marketplace" page shows:

Restricted Access
You don't have access to this section due to cluster policy.
packagemanifests.packages.apps.redhat.com is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "packagemanifests" in API group "packages.apps.redhat.com" at the cluster scope

I installed OLM this way:

1. Run Kubernetes using hack/local-up-cluster.sh (~today-ish master)
2. Install OLM using kubectl create -f deploy/upstream/manifests/latest/ (with current OLM master)
3. Run console using ./scripts/run_console_local.sh

[jsafrane]

I worked around this issue by adding cluster-admin role to kube-system/default

[ecordell]

Hi @jsafrane

We provide two ClusterRoles that you can bind a user to: aggregate-olm-view and aggregate-olm-view. They are automatically aggregated to the view and edit roles, if those are appropriate to use.

cluster-admin works as well, but these will let you use OLM types without granting that high.