OLMv0 delegated Operator installation warnings

[michaelryanpeter]

Version(s):

NOTE: I still need to place these admonitions/snippets in the appropriate sections of the docs. I am looking for initial feedback on the wording of these warnings while I work on the proper placement.

Issue:

Link to docs preview:

QE review:

• QE has approved this change.

Additional information:

[ocpdocs-previewbot]

🤖 Tue Sep 01 20:29:36 - Prow CI generated the docs preview:

https://119174--ocpdocs-pr.netlify.app/

[openshift-ci]

@michaelryanpeter: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[joelanford]

Maybe Workload creation (e.g. Pod, ReplicaSet, Deployment, Job, CronJob, DaemonSet)?

But this is a slippery slope and is hard to describe because those are just some of the APIs that enable running a pod with a certain service account. CRs for arbitrary CRDs might also lead to pods running in a way where the user can control the service account and code execution.

[michaelryanpeter]

Suggested change

	* Pod creation
	* Workload creation, for example:
	** Pods
	** Replica sets
	** Deployments
	** Jobs
	** Cron jobs
	** Daemon sets

Seeing it all listed out and knowing that this list is not exhaustive, perhaps we should take a different approach.

Could we simplify by saying:
"Do not install Operators that require cluster-scoped permissions in namespaces where non-administrator users have delegated Operator install permissions."

I understand that might include false positives, but that seems better than giving a false sense of security.

WDYT?
Is there another way to describe the risks more accurately?