The operator cannot be installed normally in a cluster with psp

[0xff-dev]

Bug Report

The k8s cluster opens the psp policy, and the operator installation through olm will fail. because of the job in the namespace olm use default serviceaccount. related issue

What did you do? A clear and concise description of the steps you took (or insert a code snippet).

1. install olm

   kubectl apply -f crds.yaml
   kubectl apply -f olm.yaml

   filepath: quickstart

2. install etcd operator

   
   apiVersion: v1
   kind: Namespace
   metadata:
   name: my-etcd
   ---
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
   name: operatorgroup
   namespace: my-etcd
   spec:
   targetNamespaces:
   - my-etcd
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
   name: my-etcd
   namespace: my-etcd
   spec:
   channel: singlenamespace-alpha
   name: etcd
   source: operatorhubio-catalog
   sourceNamespace: olm

**What did you expect to see?**
A clear and concise description of what you expected to happen (or insert a code snippet).
etce operator can be installed normally.

**What did you see instead? Under which circumstances?**
```shell
Events:
  Type     Reason            Age                   From            Message
  ----     ------            ----                  ----            -------
  Warning  FailedCreate      6m58s (x15 over 65m)  job-controller  Error creating: pods "fe3359f072ef3976d6cf0d56c20a540531916356d88290cd72c0b5916672ca0-" is forbidden: unable to validate against any pod security policy: []

Environment

• operator-lifecycle-manager version: 0.17.0

• Kubernetes version information:

Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.8", GitCommit:"37996579a3bc0da0dad9ed07929115d8a6c4b28c", GitTreeState:"clean", BuildDate:"2020-08-18T10:49:04Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.8", GitCommit:"719f645b9670949cde39510176c1a7a61c4039a0", GitTreeState:"clean", BuildDate:"2020-08-18T09:53:48Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}

Possible Solution

1. clusterrolebinding is associated with the default serviceaccount of the olm namespace.

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
   name: olm-operator-binding-olm
   roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: system:controller:operator-lifecycle-manager
   subjects:
   - kind: ServiceAccount
   name: olm-operator-serviceaccount
   namespace: olm
   - kind: ServiceAccount
   name: default
   namespace: olm

2. add olm sa for the job https://github.com/operator-framework/operator-lifecycle-manager/blob/5eb1fa6ad6ecfbf1263a145e54e5bd181a078097/pkg/controller/bundle/bundle_unpacker.go#L68

[dinhxuanvu]

A potential solution is to create a separate ServiceAccount for the new CatalogSource that is created in that namespace instead of using the default ServiceAccount. Will need to look into this issue further.