docs: update documentation for cluster-admin scope

Remove SA-related documentation, tutorials, and demo scripts.
Clean up remaining ServiceAccount references from unit tests.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Daniel Franz <dfranz@redhat.com>

Author: 3 people

docs/concepts/controlling-catalog-selection.md

@@ -24,8 +24,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:
@@ -50,8 +48,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:
@@ -72,8 +68,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:
@@ -102,8 +96,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:
@@ -127,8 +119,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:
@@ -226,8 +216,6 @@ If the system cannot resolve to a single bundle due to ambiguity, it will genera
       name: install-my-operator
     spec:
       namespace: my-operator-ns
-      serviceAccount:
-        name: my-operator-installer
       source:
         sourceType: Catalog
         catalog:

docs/concepts/crd-upgrade-safety.md

@@ -62,8 +62,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:

docs/concepts/permission-model.md

@@ -46,8 +46,6 @@ metadata:
   name: <extension_name>
 spec:
   namespace: <namespace>
-  serviceAccount:
-    name: <service_account>
   source:
     sourceType: Catalog
     catalog:
@@ -98,8 +96,6 @@ metadata:
   name: extension-sample
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   source:
     sourceType: Catalog
     catalog:

docs/concepts/upgrade-support.md

@@ -104,8 +104,6 @@ metadata:
   name: my-operator
 spec:
   namespace: my-operator-ns      # <--- Install Namespace
-  serviceAccount:
-    name: my-sa
   config:
     configType: Inline
     inline:
@@ -128,8 +126,6 @@ metadata:
   name: monitor-operator
 spec:
   namespace: ops-system          # <--- Install Namespace
-  serviceAccount:
-    name: monitor-operator-installer
   source:
     sourceType: Catalog
     catalog:
@@ -151,8 +147,6 @@ metadata:
 spec:
   namespace: operators
   # No config provided = Operator watches the entire cluster (AllNamespaces)
-  serviceAccount:
-    name: global-operator-installer
   source:
     sourceType: Catalog
     catalog:

docs/draft/howto/configure-bundles.md

@@ -48,8 +48,6 @@ metadata:
   name: my-operator
 spec:
   namespace: my-namespace
-  serviceAccount:
-    name: my-operator-sa
   source:
     sourceType: Catalog
     catalog:
@@ -236,8 +234,6 @@ metadata:
   name: production-operator
 spec:
   namespace: production-operators
-  serviceAccount:
-    name: production-operator-installer
   source:
     sourceType: Catalog
     catalog:
@@ -344,8 +340,6 @@ metadata:
   name: my-operator
 spec:
   namespace: operators
-  serviceAccount:
-    name: my-operator-installer
   source:
     sourceType: Catalog
     catalog:

docs/draft/howto/customize-operator-deployments.md

@@ -112,8 +112,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   config:
     inline:
       watchNamespace: argocd-watch
@@ -133,8 +131,6 @@ metadata:
   name: argocd
 spec:
   namespace: argocd
-  serviceAccount:
-    name: argocd-installer
   config:
     inline:
       watchNamespace: argocd

docs/draft/howto/rbac-permissions-checking.md

@@ -25,12 +25,11 @@ Here `extension` represents any individual OLMv1 installable, including (but not
 
 *What does it do?*
 
-- Creates enabling infrastructure for extension lifecycle (service accounts, etc.)
+- Creates enabling infrastructure for extension lifecycle (namespaces, etc.)
 - Installs extensions
 - Upgrades extensions
 - Removes extensions
 - Browses extensions offered in installed `ClusterCatalogs`
-- Derives minimum privilege for installation
 - filters visibility on installable extensions
 - Verifies that extension health is detectable to desired sensors
 

docs/draft/howto/single-ownnamespace-install.md

@@ -58,13 +58,11 @@ kubectl wait --for=condition=Serving=True clustercatalog/operatorhubio --timeout
 ### Install a Cluster Extension
 
 For simplicity, the following example manifest includes all necessary resources to install the ArgoCD operator.
-The manifest includes installation namespace, installer service account and associated minimal set of RBAC permissions
-needed for installation, and the ClusterExtension resource, which specifies the name and version of the extension to install.
-More information on installing extensions can be found [here](../tutorials/install-extension.md).
+The manifest includes installation namespace and the ClusterExtension resource, which specifies the name and 
+version of the extension to install. More information on installing extensions can be found [here](../tutorials/install-extension.md).
 
 ```bash
-# Apply the sample ClusterExtension. Manifest already includes
-# namespace and adequately privileged service account
+# Apply the sample ClusterExtension. Manifest already includes namespace
 kubectl apply -f https://raw.githubusercontent.com/operator-framework/operator-controller/main/config/samples/olm_v1_clusterextension.yaml
 ```
 
@@ -94,20 +92,9 @@ kubectl delete clusterextension/argocd
 
 ### Cleanup
 
-Extension installation requires the creation of a namespace, an installer service account, and its RBAC. Once the
-extension is uninstalled, these resources can be cleaned up.
+Extension installation requires the creation of a namespace. Once the extension is uninstalled, the namespace can be removed.
 
 ```bash
-# Delete namespace, and by extension, the installer service account, Role, and RoleBinding
+# Delete the namespace
 kubectl delete namespace argocd
 ```
-
-```bash
-# Delete installer service account cluster roles
-kubectl delete clusterrole argocd-installer-clusterrole && kubectl delete clusterrole argocd-installer-rbac-clusterrole
-```
-
-```bash
-# Delete installer service account cluster role bindings
-kubectl delete clusterrolebinding argocd-installer-binding && kubectl delete clusterrolebinding argocd-installer-rbac-binding
-```