InstallPlan fails with "updated validation is too restrictive" when:

* Previous CRs and CRDs exist, and 
* Multiple CRD versions are served (ex. v1alpha1 and v1alpha2) 

This is reproducible on the OpenShift 4.15.3 rosa cluster, and not reproducible on 4.14.15 or 4.13.

Always

1.Create the following catalogsource and subscription
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: devworkspace-operator-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/devfile/devworkspace-operator-index:release
  publisher: Red Hat
  displayName: DevWorkspace Operator Catalog
  updateStrategy:
    registryPoll:
      interval: 5m
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  namespace: openshift-operators
  name: devworkspace-operator
spec:
  channel: fast
  installPlanApproval: Manual
  name: devworkspace-operator
  source: devworkspace-operator-catalog
  sourceNamespace: openshift-marketplace

2. Approve the installplan

3. Create a CR instance (DevWorkspace CR):
$ curl https://raw.githubusercontent.com/devfile/devworkspace-operator/main/samples/empty.yaml | kubectl apply -f - 

4. Delete the subscription and csv
$ oc project openshift-operators
$ oc delete sub devworkspace-operator
$ oc get csv
$ oc delete csv devworkspace-operator.v0.26.0 

5. Create the subscription from step 1 again, and approve the installplan

6. View the "updated validation is too restrictive" error in the installplan's status.conditions:
---
error validating existing CRs against new CRD's schema for "devworkspaces.workspace.devfile.io": error validating workspace.devfile.io/v1alpha1, Kind=DevWorkspace "openshift-operators/empty-devworkspace": updated validation is too restrictive: [].status.workspaceId: Required value
---    

InstallPlan fails and the operator is not installed

InstallPlan succeeds

For this specific scenario, a workaround is to temporarily un-serve the v1alpha1 version before approving the installplan:


$ oc patch crd devworkspacetemplates.workspace.devfile.io --type='json' -p='[{"op": "replace", "path": "/spec/versions/0/served", "value": false}]'
$ oc patch crd devworkspaces.workspace.devfile.io --type='json' -p='[{"op": "replace", "path": "/spec/versions/0/served", "value": false}]'

Another workaround is to delete the existing CR before approving the new installplan.