Skip to content

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator - #2228

Draft
tolusha wants to merge 4 commits into
mainfrom
np2
Draft

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator#2228
tolusha wants to merge 4 commits into
mainfrom
np2

Conversation

@tolusha

@tolusha tolusha commented Oct 14, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Moves workspace NetworkPolicy provisioning from Che Operator to the DevWorkspace Operator, and reworks the NetworkPolicies Che Operator creates for its own components.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

How to test this PR?

  1. Deploy the operator:

OpenShift

oc create namespace devworkspace-controller
oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml

OPERATOR_IMAGE=<...>
sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f  -
oc wait --for=condition=Ready pod -l app.kubernetes.io/component=che-operator -n eclipse-che --timeout=60s
oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active   --timeout=120s

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

TODO

Common Test Scenarios

  • Deploy Eclipse Che
  • Start an empty workspace
  • Open terminal and build/run an image
  • Stop a workspace
  • Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features
    • Added configurable network policies for DevWorkspaces, including custom ingress and egress rules alongside operator-provided defaults.
    • Network policies now apply to Che pods in the CheCluster namespace on both Kubernetes and OpenShift.
  • Bug Fixes
    • Network policies default to the configured default when the setting is omitted.
    • OpenShift workspace namespaces are cleaned up of legacy operator-managed network policies.

tolusha and others added 2 commits October 14, 2026 16:51
@tolusha @claude
feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace O…
7769430 
…perator

Workspace NetworkPolicies are now provisioned by the DevWorkspace Operator,
configured through spec.devEnvironments.networking.networkPolicy. Legacy
policies previously created by Che Operator in user namespaces are removed.
NetworkPolicies for Che operands are now supported on Kubernetes as well.

Assisted-by: Claude Opus 5.5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@tolusha
fixup
f10ff75 
Signed-off-by: Anatolii Bazko <abazko@redhat.com>
@openshift-ci

openshift-ci Bot commented Oct 14, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@tolusha
tolusha marked this pull request as draft October 14, 2026 14:54
@tolusha

tolusha commented Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

  • /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
  • /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
  • /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
  • /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
  • /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
  • /che-ai-assistant claude — Run a free-form instruction on this PR
  • /che-ai-assistant help — Show this help message

@tolusha
fixup
af01c7d 
Signed-off-by: Anatolii Bazko <abazko@redhat.com>
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🐳 New images available:

  • quay.io/eclipse/che-operator:pr-2228-amd64
  • quay.io/eclipse/che-operator:pr-2228-arm64
  • quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
  • quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

@tolusha
fixup
2f96152 
Signed-off-by: Anatolii Bazko <abazko@redhat.com>
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

🐳 New images available:

  • quay.io/eclipse/che-operator:pr-2228-amd64
  • quay.io/eclipse/che-operator:pr-2228-arm64
  • quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
  • quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SDawley SDawley Awaiting requested review from SDawley SDawley is a code owner
@ibuziuk ibuziuk Awaiting requested review from ibuziuk ibuziuk is a code owner
@mkuznyetsov mkuznyetsov Awaiting requested review from mkuznyetsov mkuznyetsov is a code owner
@dkwon17 dkwon17 Awaiting requested review from dkwon17 dkwon17 is a code owner

Assignees

No one assigned

Labels

do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tolusha