Enhance the documentation on install modes supported by Liberty Operator

[leochr]

Documentation on install modes supported by Liberty Operator. Document / reference the roles and role binding required for each mode.

[leochr]

Draft:

WebSphere Liberty Operator Installation Modes

The WebSphere Liberty Operator (WLO) can be installed in different modes depending on your cluster setup and application management requirements. Below are the supported installation modes and their characteristics:

1. OwnNamespace

• Description:
  WLO watches and manages resources in a specific namespace, and the Operator itself is installed in the same namespace.
• RBAC Requirements:
  • Role and RoleBinding only (namespace-scoped).
  • The required RBAC permissions are used exclusively for deploying and managing Liberty applications in that namespace.
• Scope:
  WLO can only deploy and manage applications in that namespace.
• Use Case:
  Ideal when you want strict isolation and manage applications within a single namespace.

2. AllNamespaces

• Description:
  WLO watches all namespaces in the cluster and can deploy/manage applications across any namespace.
• RBAC Requirements:
  • ClusterRole and ClusterRoleBinding (cluster-scoped).
  • Same set of RBAC permissions as OwnNamespace, but applied cluster-wide.
• Scope:
  WLO can manage applications in any namespace.
• Use Case:
  Commonly used by cluster administrators for centralized management.
  • Easier to maintain a single WLO instance.
  • Avoids conflicts between different WLO versions in multiple namespaces.
• Performance Note:
  A single WLO instance can handle many applications across namespaces efficiently due to built-in optimizations.

3. SingleNamespace

• Description:
  Similar to OwnNamespace, but the Operator is installed in a different namespace than the one it manages/watches.
• Installation Method:
  • Not supported via OpenShift UI.
  • Must be installed using CLI.
• RBAC Requirements:
  Same as OwnNamespace (Role and RoleBinding).
• Scope:
  WLO manages only the target namespace, not the one it is installed in.

Important Considerations

• If all applications managed by WLO cannot reside in a single namespace, you can install multiple WLO instances in different namespaces.
  • Each instance will manage its respective namespace.
  • This approach limits permissions but requires careful coordination to avoid version conflicts.
• CRD Management:
  • Custom Resource Definitions (CRDs) are cluster-wide.
  • Installing an older Operator version after a newer one in another namespace can corrupt CRDs and cause issues.
• Operator Lifecycle Manager (OLM):
  • OLM attempts to detect and block problematic installs.
  • However, it may not cover all scenarios—exercise caution when using multiple WLO versions.

Summary Table

Mode	Watches	Operator Location	RBAC Type	Supported via UI
OwnNamespace	Single NS	Same namespace	Role/RoleBinding	Yes
AllNamespaces	All NS	Any namespace	ClusterRole/ClusterRoleBinding	Yes
SingleNamespace	Single NS	Different namespace	Role/RoleBinding	No (CLI only)