[patch] remove pre-install-rbac flag and rename the permission mode to admin mode

docs/commands/pre-install.md

@@ -7,7 +7,7 @@ Usage information can be obtained using `mas pre-install --help`
 
 ```
 usage: mas pre-install [-i MAS_INSTANCE_ID] [--mas-channel MAS_CHANNEL]
-                       [--permission-mode {cluster,namespaced}]
+                       [--admin-mode {cluster,namespaced}]
                        [--apps APPS] [--no-confirm] [-h]
 
 IBM Maximo Application Suite Admin CLI v21.3.0
@@ -24,8 +24,8 @@ Specify the target cluster and MAS instance for which pre-install RBAC should be
                         The MAS instance ID for which pre-install RBAC will be set up
   --mas-channel MAS_CHANNEL
                         The MAS channel used to select pre-install RBAC manifests, for example 9.2.x
-  --permission-mode {cluster,namespaced}
-                        The permission mode used to determine which pre-install RBAC manifests are set up
+  --admin-mode {cluster,namespaced}
+                        The admin mode used to determine which pre-install RBAC manifests are set up
   --apps APPS           Comma-separated list of apps used to filter which pre-install RBAC manifests are set up (required for namespaced mode), for example core,manage,iot
 
 More:
@@ -46,25 +46,25 @@ mas pre-install
 ```
 
 ### Non-Interactive Pre-Install for Namespaced Mode
-Set up pre-install RBAC for a MAS instance using namespaced permission mode (apps are required):
+Set up pre-install RBAC for a MAS instance using namespaced admin mode (apps are required):
 
 ```bash
 mas pre-install \
   --mas-instance-id prod1 \
   --mas-channel 9.2.x \
-  --permission-mode namespaced \
+  --admin-mode namespaced \
   --apps core,manage,iot \
   --no-confirm
 ```
 
 ### Pre-Install for Cluster Mode
-Set up pre-install RBAC for cluster permission mode (apps are not required - automatically uses ibm-mas operator):
+Set up pre-install RBAC for cluster admin mode (apps are not required - automatically uses ibm-mas operator):
 
 ```bash
 mas pre-install \
   --mas-instance-id test1 \
   --mas-channel 9.2.x \
-  --permission-mode cluster \
+  --admin-mode cluster \
   --no-confirm
 ```
 
@@ -75,43 +75,48 @@ Set up pre-install RBAC for multiple MAS applications:
 mas pre-install \
   --mas-instance-id prod1 \
   --mas-channel 9.2.x \
-  --permission-mode namespaced \
+  --admin-mode namespaced \
   --apps core,manage,monitor,iot,predict,visualinspection \
   --no-confirm
 ```
 
-Notes
+
+Understanding MAS 9.2 Permission Model Changes
 -------------------------------------------------------------------------------
 
-### Pre-Install Process
-The pre-install command performs the following operations:
+Starting with MAS 9.2, there are significant changes to the permissions model used by Maximo Application Suite related to the ability of MAS to act as a delegated OpenShift administrator.
 
-1. **Validates cluster administrator permissions** - Ensures you have the required permissions to create RBAC resources
-2. **Validates MAS channel** - Confirms the channel is 9.2.x or later
-3. **Validates application selection** - Ensures all specified applications are supported (only in namespaced mode)
-4. **Applies RBAC manifests** - Creates ClusterRoles, ClusterRoleBindings, Roles and RoleBindings based on permission mode and selected applications
+**By default, MAS operator packages operate in minimal permissions mode.** Compared to previous MAS releases, this means MAS has:
 
-### When to Use Pre-Install
+- **No ClusterRoles** - No cluster-wide permissions to access resources across all namespaces
+- **No permissions to create namespaces** - Cannot create new application namespaces
+- **No permissions in openshift-marketplace** - Cannot list PackageManifests, CatalogSources, or manage Subscriptions
+- **Limited cross-namespace access** - Only essential namespace-scoped roles for specific operations (e.g., reading Secrets and ConfigMaps in application namespaces for binding)
 
-The `mas pre-install` command is used to grant necessary RBAC permissions.
+In this minimal permission mode, when you install Maximo Application Suite applications, each application operator will grant MAS only the **essential namespace-scoped permissions** required for basic operation (such as binding configuration). This means that the **non-essential** capabilities (installing new applications, managing application lifecycle, and viewing application status outside the core namespace) of the MAS administrative API and UI that were previously enabled by default are now **disabled by default**.
 
-**If you have cluster administrator permissions:**
-- Run `mas install` directly - it will automatically handle the pre-install RBAC setup
+**To enable these administrative capabilities**, you must explicitly configure one of the elevated admin modes (**cluster** or **namespaced**). If you have cluster administrator permissions, you can specify `--admin-mode cluster` or `--admin-mode namespaced` when running `mas install` and the necessary RBAC will be applied automatically. If you do not have cluster administrator permissions, a cluster administrator must first run `mas pre-install` to set up the required RBAC, then you can proceed with `mas install`.
 
-**If you do NOT have cluster administrator permissions:**
-- A cluster administrator must run `mas pre-install` to grant the necessary permissions
-- Then you can run `mas install --skip-preinstall-rbac` to proceed with installation
 
-### Permission Modes
+### Admin Modes
 
-The following permission modes are supported with `mas pre-install`:
+MAS 9.2 and later supports three admin modes that control the level of permissions granted to the MAS:
 
-| Permission Mode | Description | Apps Required |
+| Admin Mode | Description | Apps Required |
 |----------------|-------------|---------------|
 | **cluster** | MAS has cluster-level access to manage its applications and resources across the cluster. ClusterRoles are installed for the ibm-mas operator only. | No - automatically uses ibm-mas operator |
 | **namespaced** | No ClusterRoles are installed. MAS can manage resources only in namespaces prepared by the OpenShift admin. Roles are created for selected applications. | Yes - must specify apps |
 
-**Note:** In minimal permission mode, essential roles are installed by each operator during installation, so `mas pre-install` is not required.
+**Note:** If the cluster is intended to run in minimal mode, `mas pre-install` is not required as essential roles are installed by each operator during installation.
+
+### When to Use Pre-Install
+
+The `mas pre-install` command sets up RBAC (Role-Based Access Control) permissions for your MAS instance by creating ClusterRoles, Roles, and RoleBindings based on the selected admin mode and applications. This is required when you do not have cluster administrator permissions and want to use **cluster** or **namespaced** mode.
+
+When you run `mas install` with **cluster** or **namespaced** mode and you don't have cluster administrator permissions, `mas install` cannot create the required RBAC for these modes. A cluster administrator must first run `mas pre-install` to set up these permissions, then you can proceed with `mas install`.
+
+If you have cluster administrator permissions, you can skip `mas pre-install` and run `mas install` directly - it will automatically handle the RBAC setup for **cluster** or **namespaced** mode. For **minimal** mode, `mas pre-install` is not required as essential roles are installed by operators during installation.
+
 
 ### Supported Applications
 
@@ -130,63 +135,11 @@ The following applications are supported for pre-install RBAC setup:
 
 You can specify multiple applications as a comma-separated list (e.g., `core,manage,iot`).
 
-### Integration with MAS Install
-
-After running `mas pre-install`, proceed with the MAS installation using the `--skip-preinstall-rbac` flag to avoid re-applying the RBAC resources. Use the same permission mode that was used during pre-install for issuerKind selection:
-
-```bash
-mas install \
-  --mas-instance-id prod1 \
-  --permission-mode namespaced \
-  --skip-preinstall-rbac \
-  ... other install parameters ...
-```
-
-### Workflow Example
-
-**Step 1: Cluster Administrator runs `mas pre-install`**
-```bash
-mas pre-install \
-  --mas-instance-id prod1 \
-  --mas-channel 9.2.x \
-  --permission-mode namespaced \
-  --apps core,manage,iot \
-  --no-confirm
-```
-
-**Step 2: MAS Installer (with limited permissions) runs `mas install`**
-```bash
-mas install \
-  --mas-instance-id prod1 \
-  --permission-mode namespaced \
-  --skip-preinstall-rbac \
-  ... other parameters ...
-```
-
 ### Requirements
 
 - OpenShift cluster administrator permissions
 - MAS channel 9.2.x or later
 - Access to the target OpenShift cluster
 
 !!! warning "Administrator Permissions Required"
-    The `mas pre-install` command requires cluster administrator permissions. If you do not have these permissions, the command will fail with an error message. Only a cluster administrator can set up pre-install RBAC for MAS.
-
-### Interactive Mode
-
-When running without all required options, the command enters interactive mode and will prompt for:
-
-1. Target OpenShift cluster connection
-2. MAS instance ID
-3. MAS channel (for example 9.2.x)
-4. Permission mode (cluster or namespaced)
-5. Applications to include (comma-separated list) - **only for namespaced mode**
-
-The command will display a summary of your selections and ask for confirmation before applying the RBAC resources.
-
-**Note:** In cluster mode, applications are not prompted as the ibm-mas operator is automatically used.
-
-### Version Compatibility
-
-!!! important
-    This command is only supported for MAS version 9.2 and later. If you specify an earlier mas version, the command will fail with an error message.
+    The `mas pre-install` command requires cluster administrator permissions. If you do not have these permissions, the command will fail with an error message.

image/cli/mascli/functions/internal/save_config

@@ -42,7 +42,7 @@ export MAS_DOMAIN=$MAS_DOMAIN
 export CLUSTER_ISSUER_SELECTION=$CLUSTER_ISSUER_SELECTION
 export MAS_CLUSTER_ISSUER=$MAS_CLUSTER_ISSUER
 
-export MAS_PERMISSION_MODE=$MAS_PERMISSION_MODE
+export MAS_ADMIN_MODE=$MAS_ADMIN_MODE
 
 export MAS_ROUTING_MODE=$MAS_ROUTING_MODE
 export MAS_INGRESS_CONTROLLER_NAME=$MAS_INGRESS_CONTROLLER_NAME

python/src/mas/cli/aiservice/install/app.py

@@ -77,7 +77,7 @@ def evaluatePreInstallRBACAccess(self) -> None:
         if not isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
             return
 
-        if self.skip_preinstall_rbac:
+        if self.admin_mode == "minimal":
             return
 
         permissionResults = permissionCheckForRBAC(self.dynamicClient)
@@ -87,37 +87,42 @@ def evaluatePreInstallRBACAccess(self) -> None:
             self.applyPreInstallMASRBAC = True
             return
 
-        if self.isInteractiveMode:
+        self.printH2("Pre-Install RBAC Configuration")
+        # User does not have permissions to apply RBAC
+        self.printDescription(
+            [
+                f"Admin mod: '{self.admin_mode}'.",
+                "Pre-install RBAC could not be applied automatically (insufficient permissions).",
+            ]
+        )
+
+        if self.noConfirm:
+            self.printDescription(
+                [
+                    f"Installation will continue with the selected '{self.admin_mode}' admin mode.",
+                    "The current user does not have sufficient permissions to apply the pre-install RBAC automatically.",
+                    "With the --no-confirm flag, the installation assumes the required RBAC has already been applied by your OpenShift administrator.",
+                    "If it has not been applied, ensure your OpenShift administrator runs 'mas pre-install' with the same admin mode before the installation proceeds.",
+                ]
+            )
+        else:
             self.printDescription(
                 [
                     "",
-                    f"You selected the '{self.permission_mode}' permission mode.",
-                    "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
                     "This step must be completed by an OpenShift cluster administrator before AI Service installation can continue.",
-                    "Ask your OpenShift administrator to run 'mas pre-install' for this AI Service instance.",
-                    "If that has already been done, you can continue the installation without applying it again.",
+                    "Ask your OpenShift administrator to run 'mas pre-install' for this AI Service instance, channel, admin mode, and selected apps.",
+                    "If that has already been done, you can continue the installation.",
                 ]
             )
 
             if not self.yesOrNo("Has your OpenShift administrator already run 'mas pre-install' for this AI Service installation"):
                 self.fatalError(
-                    "Installation aborted. Ask your OpenShift administrator to run 'mas pre-install' for this AI Service installation and then run 'mas aiservice-install' again with --skip-preinstall-rbac."
+                    "Installation aborted. Ask your OpenShift administrator to run 'mas pre-install' for this AI Service installation and then run 'mas aiservice-install' again using the same admin mode."
                 )
-        else:
-            self.fatalError(
-                "\n".join(
-                    [
-                        f"You selected the '{self.permission_mode}' permission mode.",
-                        "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
-                        "This step must be completed by an OpenShift cluster administrator before AI Service installation can continue.",
-                        "Ask your OpenShift administrator to run 'mas pre-install' for this installation and then rerun 'mas aiservice-install' with --skip-preinstall-rbac.",
-                    ]
-                )
-            )
 
-    def configPermissionMode(self) -> None:
+    def configAdminMode(self) -> None:
         if self.showAdvancedOptions:
-            self.printH1("Configure Permission Mode")
+            self.printH1("Configure Admin Mode")
             self.printDescription(
                 [
                     "Choose how AI Service should be installed with respect to permissions:",
@@ -138,11 +143,11 @@ def configPermissionMode(self) -> None:
                 ]
             )
 
-            permissionModeInt = self.promptForInt("Permission Mode", default=1, min=1, max=3)
-            permissionModeMap = {1: "cluster", 2: "namespaced", 3: "minimal"}
-            self.permission_mode = permissionModeMap[permissionModeInt]
-        elif self.permission_mode == "":
-            self.permission_mode = "cluster"
+            adminModeInt = self.promptForInt("Admin Mode", default=1, min=1, max=3)
+            adminModeMap = {1: "cluster", 2: "namespaced", 3: "minimal"}
+            self.admin_mode = adminModeMap[adminModeInt]
+        elif self.admin_mode == "":
+            self.admin_mode = "cluster"
 
     @logMethodCall
     def processCatalogChoice(self) -> list:
@@ -254,9 +259,8 @@ def interactiveMode(self, simplified: bool, advanced: bool) -> None:
             ["Db2 Universal Operator for v12 onwards requires to add a License activation key", "If you don't have a license press enter to continue."]
         )
         self.db2LicenseFileLocal = self.promptForFile("Db2 License file", envVar="DB2_LICENSE_FILE", default="", mustExist=False)
-        # Permission mode prompt (especially in dev mode)
         if isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
-            self.configPermissionMode()
+            self.configAdminMode()
 
     @logMethodCall
     def nonInteractiveMode(self) -> None:
@@ -424,7 +428,6 @@ def nonInteractiveMode(self) -> None:
                 "accept_license",
                 "dev_mode",
                 "skip_pre_check",
-                "skip_preinstall_rbac",
                 "skip_grafana_install",
                 "no_confirm",
                 "help",
@@ -466,12 +469,16 @@ def nonInteractiveMode(self) -> None:
             self.validateCatalogSource()
             self.licensePrompt()
 
-        if self.permission_mode != "" and not isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
-            self.fatalError("--permission-mode is supported only for AI Service releases aligned to MAS 9.2.0 and later")
-
-        # Set default permission_mode for 9.2.0+ if not provided
-        if isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")) and self.permission_mode == "":
-            self.permission_mode = "cluster"
+        # Validate admin mode based on AI Service version
+        if isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
+            # AI Service 9.2+: --admin-mode is REQUIRED
+            if self.admin_mode == "":
+                self.fatalError(
+                    f"--admin-mode is required for MAS version 9.2 or higher (selected channel: {self.getParam('aiservice_channel')}). Valid options: cluster, namespaced, minimal"
+                )
+        else:
+            if self.admin_mode != "":
+                self.fatalError(f"--admin-mode is not supported for MAS version 9.1 and earlier (selected channel: {self.getParam('aiservice_channel')})")
 
     @logMethodCall
     def install(self, argv):
@@ -487,7 +494,7 @@ def install(self, argv):
         self.noConfirm = args.no_confirm
         self.licenseAccepted = args.accept_license
         self.devMode = args.dev_mode
-        self.permission_mode = args.permission_mode if args.permission_mode else ""
+        self.admin_mode = args.admin_mode if args.admin_mode else ""
 
         self.printDescription(
             [
@@ -515,8 +522,6 @@ def install(self, argv):
         if args.skip_pre_check:
             self.setParam("skip_pre_check", "true")
 
-        self.skip_preinstall_rbac = hasattr(args, "skip_preinstall_rbac") and args.skip_preinstall_rbac
-
         if instanceId is None:
             self.printH1("Set Target OpenShift Cluster")
             # Connect to the target cluster
@@ -625,7 +630,7 @@ def install(self, argv):
                         dynClient=self.dynamicClient,
                         masVersion=".".join(self.getParam("aiservice_channel").split(".")[:2]),
                         masInstanceId=self.getParam("aiservice_instance_id"),
-                        permissionMode=self.permission_mode,
+                        adminMode=self.admin_mode,
                         selectedApps=["aiservice"],
                     )
                     h.stop_and_persist(symbol=self.successIcon, text=f"Pre-install RBAC for AI Service is ready for {self.getParam('aiservice_instance_id')}")

python/src/mas/cli/aiservice/install/argBuilder.py

@@ -96,10 +96,8 @@ def buildCommand(self) -> str:
             command += f"  --dev-mode{newline}"
         if self.getParam("skip_pre_check") is True:
             command += f"  --skip-pre-check{newline}"
-        if self.permission_mode != "":
-            command += f'  --permission-mode "{self.permission_mode}"{newline}'
-        if self.skip_preinstall_rbac:
-            command += f"  --skip-preinstall-rbac{newline}"
+        if self.admin_mode != "":
+            command += f'  --admin-mode "{self.admin_mode}"{newline}'
         if self.getParam("image_pull_policy") != "":
             command += f"  --image-pull-policy {self.getParam('image_pull_policy')}{newline}"
         if self.getParam("service_account_name") != "":