openshift · tmshort · Jul 2, 2026 · Jul 2, 2026 · Jul 3, 2026 · Jul 3, 2026
diff --git a/.gitignore b/.gitignore
@@ -54,6 +54,9 @@ vendor/
 # documentation website asset folder
 site
 
+# generated demo asciicast recordings
+docs/demos/
+
 .tiltbuild/
 .catalogd-tmp/
 .vscode

diff --git a/Makefile b/Makefile
@@ -145,10 +145,6 @@ lint-custom: custom-linter-build #EXHELP Call custom linter for the project
 lint-api-diff: $(GOLANGCI_LINT) #HELP Validate API changes using kube-api-linter with diff-aware analysis
 	hack/api-lint-diff/run.sh
 
-.PHONY: k8s-pin
-k8s-pin: #EXHELP Pin k8s staging modules based on k8s.io/kubernetes version (in go.mod or from K8S_IO_K8S_VERSION env var) and run go mod tidy.
-	K8S_IO_K8S_VERSION='$(K8S_IO_K8S_VERSION)' go run hack/tools/k8smaintainer/main.go
-
 .PHONY: tidy #HELP Run go mod tidy.
 tidy:
 	go mod tidy
@@ -210,7 +206,7 @@ generate: $(CONTROLLER_GEN) generate-mocks #EXHELP Generate code containing Deep
 	done
 
 .PHONY: verify
-verify: k8s-pin kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date. Runs k8s-pin instead of just tidy.
+verify: tidy kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date.
 	git diff --exit-code
 
 .PHONY: verify-bingo
@@ -404,7 +400,6 @@ else
 endif
 
 .PHONY: e2e-run-%
-e2e-run-%: E2E_TIMEOUT ?= 20m
 e2e-run-%: GODOG_ARGS ?=
 e2e-run-%: prometheus-%
 ifeq ($(strip $(GODOG_ARGS)),)
@@ -414,11 +409,11 @@ ifeq ($(strip $(GODOG_ARGS)),)
 	set +e; \
 	KUBECONFIG=$(E2E_KUBECONFIG) \
 	PROMETHEUS_URL=http://localhost:$$E2E_PROMETHEUS_PORT \
-	go test -count=1 -v ./test/e2e/features_test.go -timeout $(E2E_TIMEOUT) -args --godog.tags="~@Serial" --godog.concurrency=100; \
+	go test -count=1 -v ./test/e2e/features_test.go -timeout $(or $(E2E_TIMEOUT),20m) -args --godog.tags="~@Serial && ~@demo" --godog.concurrency=100; \
 	parallelExit=$$?; \
 	KUBECONFIG=$(E2E_KUBECONFIG) \
 	PROMETHEUS_URL=http://localhost:$$E2E_PROMETHEUS_PORT \
-	go test -count=1 -v ./test/e2e/features_test.go -timeout $(E2E_TIMEOUT) -args --godog.tags="@Serial" --godog.concurrency=1; \
+	go test -count=1 -v ./test/e2e/features_test.go -timeout $(or $(E2E_TIMEOUT),20m) -args --godog.tags="@Serial && ~@demo" --godog.concurrency=1; \
 	serialExit=$$?; \
 	if [[ $$parallelExit -ne 0 ]] || [[ $$serialExit -ne 0 ]]; then \
 		echo "e2e tests failed: parallel=$$parallelExit serial=$$serialExit"; \
@@ -429,7 +424,7 @@ else
 	if [[ -z "$$E2E_PROMETHEUS_PORT" ]]; then echo "error: failed to extract prometheus hostPort from $(KIND_CONFIG)" >&2; exit 1; fi; \
 	KUBECONFIG=$(E2E_KUBECONFIG) \
 	PROMETHEUS_URL=http://localhost:$$E2E_PROMETHEUS_PORT \
-	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(E2E_TIMEOUT) -args $(GODOG_ARGS)
+	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(or $(E2E_TIMEOUT),20m) -args $(GODOG_ARGS)
 endif
 
 .PHONY: e2e-coverage-%
@@ -697,13 +692,33 @@ deploy-docs: venv
 	. $(VENV)/activate; \
 	mkdocs gh-deploy --force --strict
 
-# The demo script requires to install asciinema with: brew install asciinema to run on mac os envs.
-# Please ensure that all demos are named with the demo name and the suffix -demo-script.sh
-.PHONY: update-demos #EXHELP Validate demo recordings.
-update-demos:
-	@for script in hack/demo/*-demo-script.sh; do \
-	  nm=$$(basename $$script -script.sh); \
-	  ./hack/demo/generate-asciidemo.sh -n $$nm $$(basename $$script); \
+DEMO_OUTPUT_DIR ?= $(ROOT_DIR)/docs/demos
+
+.PHONY: update-demos
+update-demos: SOURCE_MANIFEST := $(EXPERIMENTAL_E2E_MANIFEST)
+update-demos: export MANIFEST := $(EXPERIMENTAL_RELEASE_MANIFEST)
+update-demos: export DEFAULT_CATALOG := $(CATALOGS_MANIFEST)
+update-demos: export INSTALL_DEFAULT_CATALOGS := true
+update-demos: export CATALOG_WAIT_TIMEOUT := 5m
+update-demos: wait-operator-controller-experimental-e2e demo-e2e demo-svg experimental-e2e-teardown #EXHELP Record demo scenarios as asciicast and SVG files.
+
+.PHONY: demo-e2e
+demo-e2e:
+	@command -v curl >/dev/null 2>&1 || { echo "Error: curl not found in PATH."; exit 1; }
+	@command -v jq >/dev/null 2>&1 || { echo "Error: jq not found in PATH."; exit 1; }
+	@mkdir -p $(DEMO_OUTPUT_DIR)
+	KUBECONFIG=$(KUBECONFIG_DIR)/operator-controller-experimental-e2e.kubeconfig \
+	DEMO_OUTPUT_DIR=$(DEMO_OUTPUT_DIR) go test -count=1 -v ./test/e2e/features_test.go -timeout 30m \
+	  -args --godog.tags="@demo" --godog.concurrency=1
+
+.PHONY: demo-svg
+demo-svg: #EXHELP Convert asciicast recordings to SVG.
+	@command -v docker >/dev/null 2>&1 || { echo "Error: docker not found in PATH."; exit 1; }
+	@for cast in $(DEMO_OUTPUT_DIR)/*.cast; do \
+	  svg=$${cast%.cast}.svg; \
+	  echo "Converting $$(basename $$cast) -> $$(basename $$svg)"; \
+	  docker run --rm -v $(DEMO_OUTPUT_DIR):/data node:alpine \
+	    npx --yes svg-term-cli --in /data/$$(basename $$cast) --out /data/$$(basename $$svg) --window; \
 	done
 
 include Makefile.venv
diff --git a/README.md b/README.md
@@ -34,7 +34,7 @@ To get started with OLM v1, please see our [Getting Started](https://operator-fr
 
 ### Quickstart DEMO
 
-[![asciicast](https://asciinema.org/a/682344.svg)](https://asciinema.org/a/682344)
+[![ClusterCatalog Demo](https://operator-framework.github.io/operator-controller/demos/clustercatalog-quickstart.svg)](https://operator-framework.github.io/operator-controller/)
 
 ### ClusterCatalog Quickstart Steps
 

diff --git a/api/v1/clusterextension_types.go b/api/v1/clusterextension_types.go
@@ -50,8 +50,7 @@ const (
 // ClusterExtensionSpec defines the desired state of ClusterExtension
 type ClusterExtensionSpec struct {
 	// namespace specifies a Kubernetes namespace.
-	// This is the namespace where the provided ServiceAccount must exist.
-	// It also designates the default namespace where namespace-scoped resources for the extension are applied to the cluster.
+	// It designates the default namespace where namespace-scoped resources for the extension are applied to the cluster.
 	// Some extensions may contain namespace-scoped resources to be applied in other namespaces.
 	// This namespace must exist.
 	//
@@ -67,14 +66,15 @@ type ClusterExtensionSpec struct {
 	// +required
 	Namespace string `json:"namespace"`
 
-	// serviceAccount specifies a ServiceAccount used to perform all interactions with the cluster
-	// that are required to manage the extension.
-	// The ServiceAccount must be configured with the necessary permissions to perform these interactions.
-	// The ServiceAccount must exist in the namespace referenced in the spec.
-	// The serviceAccount field is required.
+	// serviceAccount is a deprecated field and is completely ignored.
+	// OLMv1 is a single-tenant system where users with ClusterExtension write access are
+	// effectively delegated cluster-admin trust. The operator-controller runs with
+	// cluster-admin privileges and uses its own service account for all cluster interactions.
 	//
-	// +required
-	ServiceAccount ServiceAccountReference `json:"serviceAccount"`
+	// Deprecated: serviceAccount is no longer used and will be removed in a future release.
+	//
+	// +optional
+	ServiceAccount ServiceAccountReference `json:"serviceAccount,omitzero"`
 
 	// source is required and selects the installation source of content for this ClusterExtension.
 	// Set the sourceType field to perform the selection.
@@ -150,7 +150,6 @@ type SourceConfig struct {
 }
 
 // ClusterExtensionInstallConfig is a union which selects the clusterExtension installation config.
-// ClusterExtensionInstallConfig requires the namespace and serviceAccount which should be used for the installation of packages.
 //
 // +kubebuilder:validation:XValidation:rule="has(self.preflight)",message="at least one of [preflight] are required when install is specified"
 // +union
@@ -378,12 +377,15 @@ type CatalogFilter struct {
 	UpgradeConstraintPolicy UpgradeConstraintPolicy `json:"upgradeConstraintPolicy,omitempty"`
 }
 
-// ServiceAccountReference identifies the serviceAccount used fo install a ClusterExtension.
+// ServiceAccountReference is a deprecated type and is completely ignored.
+//
+// Deprecated: ServiceAccountReference is no longer used and will be removed in a future release.
+//
+// +kubebuilder:validation:MinProperties=1
 type ServiceAccountReference struct {
-	// name is a required, immutable reference to the name of the ServiceAccount used for installation
-	// and management of the content for the package specified in the packageName field.
+	// name is a deprecated field and is completely ignored.
 	//
-	// This ServiceAccount must exist in the installNamespace.
+	// Deprecated: name is no longer used and will be removed in a future release.
 	//
 	// The name field follows the DNS subdomain standard as defined in [RFC 1123].
 	// It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.),
@@ -402,11 +404,12 @@ type ServiceAccountReference struct {
 	//
 	// [RFC 1123]: https://tools.ietf.org/html/rfc1123
 	//
+	// +kubebuilder:validation:MinLength:=1
 	// +kubebuilder:validation:MaxLength:=253
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable once set but may be cleared"
 	// +kubebuilder:validation:XValidation:rule="self.matches(\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\")",message="name must be a valid DNS1123 subdomain. It must contain only lowercase alphanumeric characters, hyphens (-) or periods (.), start and end with an alphanumeric character, and be no longer than 253 characters"
-	// +required
-	Name string `json:"name"`
+	// +optional
+	Name string `json:"name,omitempty"`
 }
 
 // PreflightConfig holds the configuration for the preflight checks.  If used, at least one preflight check must be non-nil.

diff --git a/api/v1/validation_test.go b/api/v1/validation_test.go
@@ -23,9 +23,6 @@ func TestValidate(t *testing.T) {
 	}
 	defaultExtensionSpec := func(s *ClusterExtensionSpec) *ClusterExtensionSpec {
 		s.Namespace = "ns"
-		s.ServiceAccount = ServiceAccountReference{
-			Name: "sa",
-		}
 		s.Source = SourceConfig{
 			SourceType: SourceTypeCatalog,
 			Catalog: &CatalogFilter{

diff --git a/applyconfigurations/api/v1/clusterextensioninstallconfig.go b/applyconfigurations/api/v1/clusterextensioninstallconfig.go
diff --git a/applyconfigurations/api/v1/clusterextensionspec.go b/applyconfigurations/api/v1/clusterextensionspec.go
diff --git a/applyconfigurations/api/v1/serviceaccountreference.go b/applyconfigurations/api/v1/serviceaccountreference.go