fix(olm): generate rbac roles for ownnamespace operators correctly

Author: ecordell

pkg/controller/operators/olm/operator.go

@@ -621,11 +621,6 @@ func (a *Operator) syncCopyCSV(obj interface{}) (syncError error) {
 		syncError = err
 	}
 
-	// Ensure cluster roles exist for using provided apis
-	if err := a.ensureClusterRolesForCSV(clusterServiceVersion, operatorGroup); err != nil {
-		logger.WithError(err).Info("couldn't ensure clusterroles for provided api types")
-		syncError = err
-	}
 	return
 }
 
@@ -988,6 +983,13 @@ func (a *Operator) transitionCSVState(in v1alpha1.ClusterServiceVersion) (out *v
 			return
 		}
 
+		// Ensure cluster roles exist for using provided apis
+		if err := a.ensureClusterRolesForCSV(out, operatorGroup); err != nil {
+			logger.WithError(err).Info("couldn't ensure clusterroles for provided api types")
+			syncError = err
+			return
+		}
+
 	case v1alpha1.CSVPhaseFailed:
 		installer, strategy, _ := a.parseStrategiesAndUpdateStatus(out)
 		if strategy == nil {

pkg/controller/operators/olm/operatorgroup.go

@@ -742,14 +742,10 @@ func (a *Operator) ensureOpGroupClusterRole(op *v1.OperatorGroup, suffix string)
 }
 
 func (a *Operator) ensureOpGroupClusterRoles(op *v1.OperatorGroup) error {
-	if err := a.ensureOpGroupClusterRole(op, AdminSuffix); err != nil {
-		return err
-	}
-	if err := a.ensureOpGroupClusterRole(op, EditSuffix); err != nil {
-		return err
-	}
-	if err := a.ensureOpGroupClusterRole(op, ViewSuffix); err != nil {
-		return err
+	for _, suffix := range Suffices {
+		if err := a.ensureOpGroupClusterRole(op, suffix); err != nil {
+			return err
+		}
 	}
 	return nil
 }