Use of community-operators on OKD

[alexzose]

It has been mentioned that we should not use RedHat pull secret on OKD and the RedHat operators. Does this also apply to the community-operators that can be enabled via the cluster operatorhub resource?

[SupremeMortal]

The community operators catalogue is accessible without a pull secret therefore it doesn't require a license to consume any of the operators it contains. General rule of thumb is that anything under registry.access.redhat.com is free to use.

[BeardOverflow]

The following article explains it: https://access.redhat.com/RegistryAuthentication

I would like to make a long answer (under my own knowledge to date):

First of all, marketplace operator installs a cluster resource called operatorhub which installs Redhat's catalogsource resources.

$ oc get clusteroperator/marketplace -o yaml
# ... long output ...
$ oc get -n openshift-marketplace operatorhub/cluster -o yaml
# ... long output ...

At the end, for OKD it is just catalogsources/community-operators, introduced as intended: https://github.com/operator-framework/operator-marketplace/blob/release-4.17/hack/okd/0000_03_marketplace-operator_02_operatorhub.cr.yaml

You can review which is the registry used by it:

$ oc get catalogsources/community-operators -n openshift-marketplace --template '{{.spec.image}}'
registry.access.redhat.com/redhat/community-operator-index:v4.17

So, catalogsources/community-operators uses registry.access.redhat.com which is free to use without authentication as @SupremeMortal explained previously.

Answered the main question, you could be interested to install additional community markets like OKDerators and OperatorHub for K8S marketplace (you must add them as single catalogsource resources, they are not handled by marketplace operator):

---
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: operatorhubio-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/operatorhubio/catalog:latest
  displayName: OperatorHub.io
  publisher: OperatorHub.io
  updateStrategy:
    registryPoll:
      interval: 10m
---
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: okderators-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/okderators/catalog-index:latest
  displayName: OKDerators
  publisher: OKDerators
  updateStrategy:
    registryPoll:
      interval: 10m
---

Again, you can review which are registries used by all your catalogsources:

$ oc get catalogsources -n openshift-marketplace --template '{{range .items}}{{.metadata.name}}{{": "}}{{.spec.image}}{{"\n"}}{{end}}'
# ... long output ...