As an OpenShift Dedicated Platform SRE we need a way to block certain operators from being installed to OpenShift Dedicated and ROSA clusters from OperatorHub.

Specifically, the metallb operator - This operator is available from the Red Hat OperatorHub and can be installed with just a few clicks, but can ultimately result in the customer completely losing access to their cluster.  The Metallb docs explicitly state that this operator is not for use with cloud providers.

Having the ability to deny specific operators from OperatorHub for install on managed products can help prevent customers from accidentally losing access to their cluster.

We've asked the customer who has most recently lost access because of this operator to share steps to reproduce. I was not able to reproduce successfully on a test cluster, but I also don't have much knowledge of MetalLB and don't know if there's a specific configuration that it's breaking on.

1.
2.
3.