Skip to content

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator #2228

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tolusha wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator #2228

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7769430
feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace O…
tolusha Oct 14, 2026
f10ff75
fixup
tolusha Oct 14, 2026
af01c7d
fixup
tolusha Oct 14, 2026
2f96152
fixup
tolusha Oct 15, 2026
dc5ce3b
fixup
tolusha Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,12 @@ linters:
- common-false-positives
- legacy
- std-error-handling
rules:
# Dot imports are allowed.
- linters:
- staticcheck
text: 'ST1001: should not use dot imports'
source: '\. "github\.com/onsi/(ginkgo(/v2)?|gomega)"'
paths:
- third_party$
- builtin$
Expand Down
73 changes: 51 additions & 22 deletions api/v2/checluster_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,23 +347,8 @@ type CheClusterSpecNetworking struct {
// +optional
// +kubebuilder:default:={gateway: {configLabels: {app: che, component: che-gateway-config}}}
Auth Auth `json:"auth"`
// NetworkPolicy configures NetworkPolicy resources for the Che namespace
// and user workspace namespaces. For OpenShift clusters only.
// When enabled, the following policies are created:
// In the Che namespace:
// - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace.
// - allow-from-workspaces: allows ingress traffic from user workspace namespaces.
// - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace.
// - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace.
// - allow-from-<flavor>-operator: allows ingress traffic from the operator pod to Che components.
// - allow-all-egress: allows all egress traffic from Che pods.
// In each user workspace namespace:
// - allow-from-<che-namespace>: allows ingress traffic from the Che namespace.
// - allow-from-same-namespace: allows ingress traffic between pods in the same namespace.
// - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator.
// - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace.
// - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace.
// - allow-all-egress: allows all egress traffic from workspace pods.
// NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components,
// such as the gateway, the server, the dashboard and the registries.
// +optional
NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"`
}
Expand All @@ -372,13 +357,51 @@ type DevEnvironmentNetworking struct {
// External TLS configuration.
// +optional
ExternalTLSConfig *ExternalTLSConfig `json:"externalTLSConfig,omitempty"`
// NetworkPolicy defines configuration options for the NetworkPolicies provisioned
// for each DevWorkspace by the DevWorkspace Operator.
//
// When enabled and no ingress rules are specified, the Operator sets the default
// DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic
// from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the
// CheCluster namespace). If custom ingress rules are specified, only those rules apply
// and the rule allowing traffic from Che operands is not added automatically; if Che
// operands need to communicate with the workspaces, a corresponding ingress rule must be
// explicitly included.
//
// When enabled and no egress rules are specified, the Operator sets the default
// DevWorkspace Operator egress rules. If custom egress rules are specified, only
// those rules apply.
// +kubebuilder:validation:Optional
NetworkPolicy *controllerv1alpha1.NetworkPolicyConfig `json:"networkPolicy,omitempty"`
}

// NetworkPolicy configuration settings.
// NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components,
// such as the gateway, the server, the dashboard and the registries.
// +k8s:openapi-gen=true
type NetworkPolicy struct {
// Enabled controls whether the operator creates NetworkPolicy resources.
// +optional
// Enabled determines whether the NetworkPolicies are provisioned for Eclipse Che.
// The policies are created in the namespace where the `CheCluster` custom resource is created
// and apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` only.
// Disabled by default. When set to `false`, the NetworkPolicies previously created
// by the Operator are removed.
//
// On OpenShift, the following NetworkPolicies are created in the `CheCluster` namespace:
// - `allow-from-same-namespace` : from the Che operands themselves.
// - `allow-from-openshift-ingress` : from the OpenShift ingress controller.
// - `allow-from-openshift-host-network` : from the pods that use the host network, for example
// the OpenShift router.
// - `allow-from-openshift-monitoring` : from the OpenShift monitoring stack, to scrape metrics.
// - `allow-from-workspaces` : from the users' workspace namespaces.
// - `allow-from-che-operator` : from the Operator pods in the Operator namespace.
// - `allow-all-egress` : allows all egress traffic from the Che operands.
//
// On Kubernetes, only the `allow-all-ingress` and `allow-all-egress` NetworkPolicies are created,
// allowing all ingress and egress traffic, since the namespace of the cluster's ingress controller
// is not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic
// by itself: administrators are expected to provision their own NetworkPolicies.
//
// +kubebuilder:default:=false
// +kubebuilder:validation:Optional
Enabled *bool `json:"enabled,omitempty"`

@rohanKanojia rohanKanojia Oct 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with the fallback, spec.networking.networkPolicy.enabled also enables workspace isolation when devEnvironments.networking.networkPolicy.enabled is unset. Could both field docs mention this, so admins know how the two interact (and that devEnvironments...enabled: false opts out)?

}

Expand Down Expand Up @@ -1403,8 +1426,14 @@ func (c *CheCluster) IsDevEnvironmentExternalTLSConfigEnabled() bool {
}

func (c *CheCluster) IsNetworkPoliciesEnabled() bool {
return c.Spec.Networking.NetworkPolicy != nil &&
ptr.Deref(c.Spec.Networking.NetworkPolicy.Enabled, constants.NetworkPolicyEnabled)
if c.Spec.Networking.NetworkPolicy == nil {
return constants.DefaultNetworkPolicyEnabled
}

return ptr.Deref(
c.Spec.Networking.NetworkPolicy.Enabled,
constants.DefaultNetworkPolicyEnabled,
)
}

func (c *CheCluster) IsOAuthProxyImageResolutionFromImageStreamEnabled() bool {
Expand Down
5 changes: 5 additions & 0 deletions api/v2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ metadata:
categories: Developer Tools
certified: "false"
containerImage: quay.io/eclipse/che-operator:next
createdAt: "2026-10-01T12:19:13Z"
createdAt: "2026-10-15T07:13:12Z"
description: A Kube-native development solution that delivers portable and collaborative
developer workspaces.
features.operators.openshift.io/cnf: "false"
Expand All @@ -108,7 +108,7 @@ metadata:
operatorframework.io/arch.amd64: supported
operatorframework.io/arch.arm64: supported
operatorframework.io/os.linux: supported
name: eclipse-che.v7.123.0-1079.next
name: eclipse-che.v7.124.0-1086.next
namespace: placeholder
spec:
apiservicedefinitions: {}
Expand Down Expand Up @@ -931,6 +931,7 @@ spec:
verbs:
- create
- delete
- deletecollection
- get
- update
- patch
Expand Down Expand Up @@ -1201,7 +1202,7 @@ spec:
name: openvsx
- image: quay.io/sclorg/postgresql-16-c9s:20260319
name: openvsx-postgres
version: 7.123.0-1079.next
version: 7.124.0-1086.next
webhookdefinitions:
- admissionReviewVersions:
- v1
Expand Down
Loading
Loading