:_mod-docs-content-type: ASSEMBLY
[id="sd-managed-resources"]
= Red{nbsp}Hat managed resources

include::_attributes/attributes-openshift-dedicated.adoc[]
:context: sd-managed-resources

toc::[]

[role="_abstract"]
The following covers all {product-title} resources that are managed or protected by the Service Reliability Engineering Platform (SRE-P) Team. Customers must not modify these resources because doing so can lead to cluster instability.

[id="sd-managed-resources-overview_{context}"]
== Overview

The following covers all {product-title} resources that are managed or protected by the Service Reliability Engineering Platform (SRE-P) Team. Customers must not modify these resources because doing so can lead to cluster instability.

[id="sd-managed-resources-all_{context}"]
ifdef::openshift-rosa,openshift-dedicated[]
== Hive managed resources

The following list displays the {product-title} resources managed by OpenShift Hive, the centralized fleet configuration management system. These resources are in addition to the OpenShift Container Platform resources created during installation. OpenShift Hive continually attempts to maintain consistency across all {product-title} clusters. Changes to {product-title} resources should be made through {cluster-manager} so that {cluster-manager} and Hive are synchronized. Contact `ocm-feedback@redhat.com` if {cluster-manager} does not support modifying the resources in question.

== List of Hive managed resources
endif::openshift-rosa,openshift-dedicated[]
ifdef::openshift-rosa-hcp[]
== Red{nbsp}Hat managed resources

The following resources are created and managed by the management cluster, which is managed by Red{nbsp}Hat.

.List of Red{nbsp}Hat managed resources
endif::openshift-rosa-hcp[]
[source,yaml]
----
include::https://raw.githubusercontent.com/openshift/managed-cluster-config/master/resources/managed/all-osd-resources.yaml[]
----
//endif::openshift-rosa,openshift-dedicated[]

[id="sd-core-namespaces_{context}"]
== {product-title} core namespaces

{product-title} core namespaces are installed by default during cluster installation.

.List of core namespaces
ifdef::openshift-rosa[]
[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: ocp-namespaces
  namespace: openshift-monitoring
data:
  managed_namespaces.yaml: |
    Resources:
      Namespace:
      - name: dedicated-admin
      - name: default
      - name: kube-node-lease
      - name: kube-public
      - name: kube-system
      - name: openshift
      - name: openshift-addon-operator
      - name: openshift-apiserver
      - name: openshift-apiserver-operator
      - name: openshift-aqua
      - name: openshift-authentication
      - name: openshift-authentication-operator
      - name: openshift-backplane
      - name: openshift-backplane-cee
      - name: openshift-backplane-csa
      - name: openshift-backplane-cse
      - name: openshift-backplane-csm
      - name: openshift-backplane-managed-scripts
      - name: openshift-backplane-mcs-tier-two
      - name: openshift-backplane-mobb
      - name: openshift-backplane-srep
      - name: openshift-backplane-tam
      - name: openshift-catalogd
      - name: openshift-cloud-controller-manager
      - name: openshift-cloud-controller-manager-operator
      - name: openshift-cloud-credential-operator
      - name: openshift-cloud-network-config-controller
      - name: openshift-cloud-platform-infra
      - name: openshift-cluster-csi-drivers
      - name: openshift-cluster-machine-approver
      - name: openshift-cluster-node-tuning-operator
      - name: openshift-cluster-olm-operator
      - name: openshift-cluster-samples-operator
      - name: openshift-cluster-storage-operator
      - name: openshift-cluster-version
      - name: openshift-codeready-workspaces
      - name: openshift-config
      - name: openshift-config-managed
      - name: openshift-config-operator
      - name: openshift-console
      - name: openshift-console-operator
      - name: openshift-console-user-settings
      - name: openshift-controller-manager
      - name: openshift-controller-manager-operator
      - name: openshift-custom-domains-operator
      - name: openshift-customer-monitoring
      - name: openshift-deployment-validation-operator
      - name: openshift-dns
      - name: openshift-dns-operator
      - name: openshift-etcd
      - name: openshift-etcd-operator
      - name: openshift-host-network
      - name: openshift-image-registry
      - name: openshift-infra
      - name: openshift-ingress
      - name: openshift-ingress-canary
      - name: openshift-ingress-operator
      - name: openshift-insights
      - name: openshift-kni-infra
      - name: openshift-kube-apiserver
      - name: openshift-kube-apiserver-operator
      - name: openshift-kube-controller-manager
      - name: openshift-kube-controller-manager-operator
      - name: openshift-kube-scheduler
      - name: openshift-kube-scheduler-operator
      - name: openshift-kube-storage-version-migrator
      - name: openshift-kube-storage-version-migrator-operator
      - name: openshift-logging
      - name: openshift-machine-api
      - name: openshift-machine-config-operator
      - name: openshift-managed-node-metadata-operator
      - name: openshift-managed-upgrade-operator
      - name: openshift-marketplace
      - name: openshift-monitoring
      - name: openshift-multus
      - name: openshift-must-gather-operator
      - name: openshift-network-console
      - name: openshift-network-diagnostics
      - name: openshift-network-node-identity
      - name: openshift-network-operator
      - name: openshift-node
      - name: openshift-nutanix-infra
      - name: openshift-oauth-apiserver
      - name: openshift-observability-operator
      - name: openshift-ocm-agent-operator
      - name: openshift-openstack-infra
      - name: openshift-operator-controller
      - name: openshift-operator-lifecycle-manager
      - name: openshift-operators
      - name: openshift-operators-redhat
      - name: openshift-osd-metrics
      - name: openshift-ovirt-infra
      - name: openshift-ovn-kubernetes
      - name: openshift-package-operator
      - name: openshift-rbac-permissions
      - name: openshift-route-controller-manager
      - name: openshift-route-monitor-operator
      - name: openshift-security
      - name: openshift-service-ca
      - name: openshift-service-ca-operator
      - name: openshift-splunk-forwarder-operator
      - name: openshift-sre-pruning
      - name: openshift-user-workload-monitoring
      - name: openshift-validation-webhook
      - name: openshift-vsphere-infra
----
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: ocp-namespaces
  namespace: openshift-monitoring
data:
  managed_namespaces.yaml: |
    Resources:
      Namespace:
      - name: dedicated-admin
      - name: default
      - name: kube-node-lease
      - name: kube-public
      - name: kube-system
      - name: open-cluster-management-agent
      - name: open-cluster-management-agent-addon
      - name: openshift
      - name: openshift-apiserver
      - name: openshift-apiserver-operator
      - name: openshift-authentication
      - name: openshift-authentication-operator
      - name: openshift-backplane
      - name: openshift-backplane-cee
      - name: openshift-backplane-cse
      - name: openshift-backplane-csm
      - name: openshift-backplane-lpsre
      - name: openshift-backplane-managed-scripts
      - name: openshift-backplane-mcs-tier-two
      - name: openshift-backplane-mobb
      - name: openshift-backplane-srep
      - name: openshift-backplane-tam
      - name: openshift-cloud-controller-manager
      - name: openshift-cloud-credential-operator
      - name: openshift-cloud-network-config-controller
      - name: openshift-cluster-csi-drivers
      - name: openshift-cluster-machine-approver
      - name: openshift-cluster-node-tuning-operator
      - name: openshift-cluster-samples-operator
      - name: openshift-cluster-storage-operator
      - name: openshift-cluster-version
      - name: openshift-config
      - name: openshift-config-managed
      - name: openshift-config-operator
      - name: openshift-console
      - name: openshift-console-operator
      - name: openshift-console-user-settings
      - name: openshift-controller-manager
      - name: openshift-controller-manager-operator
      - name: openshift-customer-monitoring
      - name: openshift-deployment-validation-operator
      - name: openshift-dns
      - name: openshift-dns-operator
      - name: openshift-etcd
      - name: openshift-host-network
      - name: openshift-image-registry
      - name: openshift-infra
      - name: openshift-ingress
      - name: openshift-ingress-canary
      - name: openshift-ingress-operator
      - name: openshift-insights
      - name: openshift-kube-apiserver
      - name: openshift-kube-apiserver-operator
      - name: openshift-kube-controller-manager
      - name: openshift-kube-controller-manager-operator
      - name: openshift-kube-scheduler
      - name: openshift-kube-scheduler-operator
      - name: openshift-kube-storage-version-migrator
      - name: openshift-kube-storage-version-migrator-operator
      - name: openshift-logging
      - name: openshift-machine-api
      - name: openshift-machine-config-operator
      - name: openshift-marketplace
      - name: openshift-monitoring
      - name: openshift-multus
      - name: openshift-must-gather-operator
      - name: openshift-network-console
      - name: openshift-network-diagnostics
      - name: openshift-network-node-identity
      - name: openshift-network-operator
      - name: openshift-node
      - name: openshift-operator-lifecycle-manager
      - name: openshift-operators
      - name: openshift-operators-redhat
      - name: openshift-ovn-kubernetes
      - name: openshift-package-operator
      - name: openshift-route-controller-manager
      - name: openshift-service-ca
      - name: openshift-service-ca-operator
      - name: openshift-user-workload-monitoring
----
endif::openshift-rosa-hcp[]
ifdef::openshift-dedicated[]
[source,yaml]
----
include::https://raw.githubusercontent.com/openshift/managed-cluster-config/master/deploy/osd-managed-resources/ocp-namespaces.ConfigMap.yaml[]
----
endif::openshift-dedicated[]

ifdef::openshift-rosa,openshift-dedicated[]
[id="sd-add-on-managed-namespaces_{context}"]
== {product-title} add-on namespaces

{product-title} add-ons are services available for installation after cluster installation. These additional services include AWS CloudWatch, {openshift-dev-spaces-productname}, Red{nbsp}Hat OpenShift API Management, and Cluster Logging Operator. Any changes to resources within the following namespaces might be overridden by the add-on during upgrades, which can lead to unsupported configurations for the add-on functionality.

.List of add-on managed namespaces
[source,yaml]
----
include::https://raw.githubusercontent.com/openshift/managed-cluster-config/master/resources/addons-namespaces/main.yaml[]
----
endif::openshift-rosa,openshift-dedicated[]

[id="sd-validating-webhooks_{context}"]
== {product-title} validating webhooks

{product-title} validating webhooks are a set of dynamic admission controls maintained by the OpenShift SRE team. These HTTP callbacks, also known as webhooks, are called for various types of requests to ensure cluster stability. The webhooks evaluate each request and either accept or reject them. The following list describes the various webhooks with rules containing the registered operations and resources that are controlled. Any attempt to circumvent these validating webhooks could affect the stability and supportability of the cluster.

.List of validating webhooks
[source,json]
----
include::https://raw.githubusercontent.com/openshift/managed-cluster-validating-webhooks/master/docs/webhooks.json[]
----
