feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator by tolusha · Pull Request #2228 · eclipse-che/che-operator

tolusha · 2026-10-14T14:52:12Z

What does this PR do?

Moves workspace NetworkPolicy provisioning from Che Operator to the DevWorkspace Operator, and reworks the NetworkPolicies Che Operator creates for its own components.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

devfile/devworkspace-operator#1710

How to test this PR?

Deploy Eclipse Che (next version + DWO next version)

chectl update next
chectl server:deploy -p openshift

Enable NetworkPolicy provisioning in CheCluster CR

spec:
  networking:
    networkPolicy:
      enabled: true

Open dashboard

chectl dashboard:open

Check NetworkPolicy existance

$ oc get networkpolicies.networking.k8s.io -n kubeadmin-che # or another usernamespace
NAME                               POD-SELECTOR   AGE
allow-all-egress                   <none>         7s
allow-from-devworkspace-operator   <none>         7s
allow-from-eclipse-che             <none>         7s
allow-from-openshift-ingress       <none>         7s
allow-from-openshift-monitoring    <none>         7s
allow-from-same-namespace          <none>         7s

$ oc get networkpolicies.networking.k8s.io -n eclipse-che
NAME                              POD-SELECTOR                                AGE
allow-all-egress                  app.kubernetes.io/part-of=che.eclipse.org   27s
allow-from-che-operator           app.kubernetes.io/part-of=che.eclipse.org   27s
allow-from-openshift-ingress      app.kubernetes.io/part-of=che.eclipse.org   27s
allow-from-openshift-monitoring   app.kubernetes.io/part-of=che.eclipse.org   27s
allow-from-same-namespace         app.kubernetes.io/part-of=che.eclipse.org   27s
allow-from-workspaces             app.kubernetes.io/part-of=che.eclipse.org   27s

Update Eclipse Che using the CatalogSource quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-<arch>
Start a DevWorkspace (check you can clone the project, install plugins)
Check NetworkPolicy existance

$ oc get networkpolicies.networking.k8s.io -n kubeadmin-che                     
NAME                                      POD-SELECTOR                                                      AGE
workspace4c7e31b873dd4ad9-networkpolicy   controller.devfile.io/devworkspace_id=workspace4c7e31b873dd4ad9   7s

$ oc get networkpolicies.networking.k8s.io -n eclipse-che     
NAME                                POD-SELECTOR                                AGE
allow-all-egress                    app.kubernetes.io/part-of=che.eclipse.org   10m
allow-from-che-operator             app.kubernetes.io/part-of=che.eclipse.org   10m
allow-from-openshift-host-network   app.kubernetes.io/part-of=che.eclipse.org   103s
allow-from-openshift-ingress        app.kubernetes.io/part-of=che.eclipse.org   10m
allow-from-openshift-monitoring     app.kubernetes.io/part-of=che.eclipse.org   10m
allow-from-same-namespace           app.kubernetes.io/part-of=che.eclipse.org   10m
allow-from-workspaces               app.kubernetes.io/part-of=che.eclipse.org   10m

Common Test Scenarios

Deploy Eclipse Che
Start an empty workspace
Open terminal and build/run an image
Stop a workspace
Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Network policies are now reconciled on both Kubernetes and OpenShift. OpenShift policies allow required platform, workspace, and Che traffic; Kubernetes policies allow ingress and egress.
- Workspace network-policy settings now inherit Che-wide enablement when unspecified and use default ingress and egress rules when custom rules aren’t provided.
Bug Fixes
- Missing network-policy configuration now uses the documented default setting.
- Disabling network policies removes managed policies from the Che namespace.

…perator Workspace NetworkPolicies are now provisioned by the DevWorkspace Operator, configured through spec.devEnvironments.networking.networkPolicy. Legacy policies previously created by Che Operator in user namespaces are removed. NetworkPolicies for Che operands are now supported on Kubernetes as well. Assisted-by: Claude Opus 5.5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

openshift-ci · 2026-10-14T14:52:19Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-10-14T14:52:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 7acfe9c3-db63-4f6b-a787-8f1943bc079e

📥 Commits

Reviewing files that changed from the base of the PR and between 6c84368 and 375c31e.

⛔ Files ignored due to path filters: 1

go.sum is excluded by !**/*.sum

📒 Files selected for processing: 48

.golangci.yml
api/v2/checluster_types.go
api/v2/zz_generated.deepcopy.go
bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml
bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml
config/crd/bases/org.eclipse.che_checlusters.yaml
config/rbac/cluster_role.yaml
controllers/che/checluster_controller.go
controllers/usernamespace/usernamespace_controller.go
controllers/usernamespace/usernamespace_controller_network_policies_test.go
deploy/deployment/kubernetes/combined.yaml
deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml
deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml
deploy/deployment/openshift/combined.yaml
deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml
deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml
go.mod
helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml
helmcharts/next/templates/che-operator.ClusterRole.yaml
pkg/common/chelabels/labels.go
pkg/common/constants/constants.go
pkg/common/k8s-client/k8s_client.go
pkg/common/k8s-client/k8s_client_types.go
pkg/common/operator-defaults/defaults.go
pkg/common/test/utils.go
pkg/common/utils/slices.go
pkg/deploy/devworkspace/dev_workspace_config.go
pkg/deploy/devworkspace/dev_workspace_config_network_policy.go
pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go
pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go
pkg/deploy/devworkspace/dev_workspace_config_security_test.go
pkg/deploy/devworkspace/dev_workspace_config_storage_test.go
pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go
pkg/deploy/devworkspace/init_test.go
pkg/deploy/networkpolicies/networkpolicies.go
pkg/deploy/networkpolicies/networkpolicies_test.go
pkg/provision/helper.go
pkg/provision/helper_test.go
pkg/provision/networkpolicy.go
pkg/provision/suite_test.go
pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go
pkg/reconciler/networkpolicy/networkpolicy_openshift.go
pkg/reconciler/networkpolicy/networkpolicy_reconciler.go
pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go
pkg/reconciler/networkpolicy/suite_test.go
vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go
vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go
vendor/modules.txt

💤 Files with no reviewable changes: 4

controllers/usernamespace/usernamespace_controller_network_policies_test.go
pkg/provision/suite_test.go
pkg/deploy/networkpolicies/networkpolicies.go
pkg/deploy/networkpolicies/networkpolicies_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request changes Che component network policy reconciliation, adds network policy propagation to DevWorkspace configuration, and removes legacy workspace namespace policy management. It also updates API defaults, policy permissions, vendored DevWorkspace Operator code, and related tests.

Changes: Network policy flow changes

Layer / File(s)	Summary
API and default policy contracts `api/v2/checluster_types.go`, `api/v2/zz_generated.deepcopy.go`, `pkg/common/constants/constants.go`, `go.mod`, `vendor/github.com/devfile/devworkspace-operator/...`, `vendor/modules.txt`	The API documentation describes Che component and workspace policy settings. `IsNetworkPoliciesEnabled` uses the default-disabled constant when configuration or its enabled value is absent. Deep-copy handling includes the workspace policy field. Vendored DevWorkspace Operator code changes policy defaults, serialization, and image pull policy defaults.
DevWorkspace policy propagation `pkg/deploy/devworkspace/dev_workspace_config.go`, `pkg/deploy/devworkspace/dev_workspace_config_network_policy.go`, `pkg/deploy/devworkspace/*_test.go`, `pkg/deploy/devworkspace/init_test.go`	Workspace configuration now receives network policy settings. Missing ingress and egress rules use DevWorkspace Operator defaults, and an unspecified enabled value can inherit Che’s enabled value. Tests cover these rules and values.
Cluster namespace policy reconciler `pkg/common/chelabels/labels.go`, `pkg/common/k8s-client/`, `pkg/common/operator-defaults/defaults.go`, `pkg/common/test/utils.go`, `pkg/common/utils/slices.go`, `pkg/provision/`, `pkg/reconciler/networkpolicy/*`, `.golangci.yml`	The new reconciler builds and syncs Che component policies for Kubernetes or OpenShift, and deletes policies when disabled. Shared provisioning helpers support policy synchronization and bulk deletion. Integration tests cover reconciliation, and Staticcheck excludes the Ginkgo and Gomega dot-import warning.
Controller wiring and legacy cleanup `controllers/che/checluster_controller.go`, `controllers/usernamespace/usernamespace_controller.go`, `controllers/usernamespace/usernamespace_controller_network_policies_test.go`, `pkg/deploy/networkpolicies/`, `config/rbac/cluster_role.yaml`, `deploy/deployment//objects/che-operator.ClusterRole.yaml`, `helmcharts/next/templates/che-operator.ClusterRole.yaml`, `bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml`	The CheCluster controller registers the new reconciler on all platforms. The user namespace controller removes NetworkPolicy watches and deletes legacy workspace policies on OpenShift. The old policy implementation and tests are removed, and RBAC adds `deletecollection` for NetworkPolicies.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CheClusterController
  participant NetworkPoliciesReconciler
  participant provision.NetworkPolicy
  participant KubernetesAPI
  CheClusterController->>NetworkPoliciesReconciler: Reconcile(cheCtx)
  NetworkPoliciesReconciler->>NetworkPoliciesReconciler: Build policies for the current platform
  NetworkPoliciesReconciler->>provision.NetworkPolicy: Sync policies or delete all in the Che namespace
  provision.NetworkPolicy->>KubernetesAPI: Apply or delete NetworkPolicy objects

Merge Risk: ⚪ Minimal · up to 375c3

No confirmed network-policy regression remains that blocks merging.

Security architecture risk: 🟠 High · up to 375c3

The upgrade can remove workspace isolation before replacement policies are installed. On Kubernetes, enabling network policies also adds allow-all rules that can override existing network restrictions. These risks affect configured installations rather than every deployment; the default remains disabled.

Retained concerns

High · security · inferred: On OpenShift upgrades with isolation enabled, the independent user-namespace controller deletes legacy policies without confirming that DWO has installed replacements. Previously it maintained those policies while enabled. Because downstream configuration changes do not enqueue existing DevWorkspaces, cleanup can leave workspace services reachable from previously excluded peers until another workspace reconciliation installs protection. Independent administrator policies may prevent exposure, but configuration success and deletion retries do not provide a safe ownership handover.
High · security · inferred: The newly activated Kubernetes component-policy path creates allow-all ingress and egress policies for Che operand pods when the Che-wide setting is enabled. Standard Kubernetes NetworkPolicies are additive, so administrator deny-all or allowlisted policies cannot narrow these allowances. This can open previously restricted Che endpoints to network-reachable attackers and remove egress containment. The false default and documented permissive intent limit activation, but the documented expectation that administrators can supply restrictions does not resolve this policy-composition conflict.

Security review details

Security Blast Radius

inferred — The handover risk can affect existing workspaces across namespaces recognized by this Che installation. Kubernetes allow-all component policies affect pods carrying the Che operand label in the CheCluster namespace. Neither establishes access to every cluster namespace, credential disclosure, or bypass of application authentication; exposure depends on network reachability and other enforcement.

Security Findings and Attack Paths

inferred — A tenant workload or another network-reachable attacker need not edit CheCluster to benefit from these changes after administrative enablement or upgrade. During an unprotected handover it can attempt connections to workspace listeners previously isolated by the legacy policies. Under the Kubernetes allow-all path, previously excluded peers can attempt connections to Che operand listeners, while a compromised operand loses standard NetworkPolicy egress containment. Actual service compromise is not established.

Trust Boundaries and Controls

observed — Bulk cleanup receives a nonempty target namespace and filters policies by component, managed-by, and part-of labels. The RBAC change adds deletecollection to existing NetworkPolicy authority. This is scoped operator-managed cleanup, not an unfiltered cluster-wide policy deletion. Custom workspace rules are an explicit configuration capability; the inspected code does not establish that unprivileged workspace tenants can edit those settings.

Resilience and Maintainability Implications

inferred — Isolation continuity requires confirmation of effective replacement policies, not merely desired configuration. The available downstream contract separates these states, while cleanup records no adoption checkpoint. A stalled or incompatible downstream deployment can therefore prolong the handover gap beyond a single reconciliation attempt.

Hardening Proposals

proposed — Make ownership transfer replacement-first: verify downstream capability, persist configuration, drive affected workspace reconciliation, confirm replacement protection, and only then remove legacy policies. Preserve a recoverable adoption checkpoint. On Kubernetes, avoid operator-generated allow-all policies when administrators own restrictions, or require explicit cluster-specific rules; include removal of permissive resources in rollback.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 30 functions across 29 files. (8 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the primary change: workspace NetworkPolicy provisioning moves to the DevWorkspace Operator.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

Full details: Docstring Coverage

Explanation

Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 30 functions across 29 files. (8 skipped: 8 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

tolusha · 2026-10-14T14:55:43Z

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
/che-ai-assistant claude — Run a free-form instruction on this PR
/che-ai-assistant help — Show this help message

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

github-actions · 2026-10-14T15:03:22Z

🐳 New images available:

quay.io/eclipse/che-operator:pr-2228-amd64
quay.io/eclipse/che-operator:pr-2228-arm64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

github-actions · 2026-10-15T07:20:19Z

🐳 New images available:

quay.io/eclipse/che-operator:pr-2228-amd64
quay.io/eclipse/che-operator:pr-2228-arm64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

github-actions · 2026-10-15T11:32:03Z

🐳 New images available:

quay.io/eclipse/che-operator:pr-2228-amd64
quay.io/eclipse/che-operator:pr-2228-arm64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

github-actions · 2026-10-16T09:18:23Z

🐳 New images available:

quay.io/eclipse/che-operator:pr-2228-amd64
quay.io/eclipse/che-operator:pr-2228-arm64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64

tolusha · 2026-10-19T10:45:26Z

/retest

tolusha · 2026-10-19T15:31:11Z

/retest

openshift-ci · 2026-10-19T17:08:39Z

@tolusha: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-devworkspace-happy-path	`375c31e`	link	true	`/test v19-devworkspace-happy-path`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tolusha and others added 2 commits October 14, 2026 16:51

fixup

f10ff75

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha requested review from SDawley, dkwon17, ibuziuk and mkuznyetsov as code owners October 14, 2026 14:52

tolusha marked this pull request as draft October 14, 2026 14:54

openshift-ci Bot added the do-not-merge/work-in-progress label Oct 14, 2026

fixup

af01c7d

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

fixup

2f96152

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha requested a review from rohanKanojia October 15, 2026 07:38

rohanKanojia reviewed Oct 15, 2026

View reviewed changes

Comment thread controllers/usernamespace/usernamespace_controller.go

fixup

dc5ce3b

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

rohanKanojia reviewed Oct 15, 2026

View reviewed changes

Comment thread api/v2/checluster_types.go

fixup

375c31e

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha marked this pull request as ready for review October 16, 2026 09:26

openshift-ci Bot removed the do-not-merge/work-in-progress label Oct 16, 2026

tolusha changed the title ~~feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator~~ feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator Oct 16, 2026

Navigation Menu

Repository navigation

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator - #2228

feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator #2228
tolusha wants to merge 6 commits into
mainfrom
np2

tolusha commented Oct 14, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Oct 14, 2026

Uh oh!

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

tolusha commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

tolusha commented Oct 19, 2026

Uh oh!

tolusha commented Oct 19, 2026

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tolusha commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

Common Test Scenarios

PR Checklist

Reviewers

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Oct 14, 2026

Uh oh!

coderabbitai Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

tolusha commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

🐳 New images available:

Uh oh!

github-actions Bot commented Oct 15, 2026

🐳 New images available:

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026

🐳 New images available:

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

🐳 New images available:

Uh oh!

tolusha commented Oct 19, 2026

Uh oh!

tolusha commented Oct 19, 2026

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tolusha commented Oct 14, 2026 •

edited

Loading

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading