chore: Add NetworkPolicy reconciler by tolusha · Pull Request #2169 · eclipse-che/che-operator

tolusha · 2026-07-27T13:22:18Z

What does this PR do?

Introduces operator-managed NetworkPolicy resources for both the Che namespace and user workspace namespaces on OpenShift clusters.

A new spec.networking.networkPolicy.enabled field controls the feature (disabled by default). When enabled, the operator creates fine-grained ingress and egress NetworkPolicy resources to restrict network traffic to only the flows required by Che components and workspaces.

Che namespace policies:

allow-from-same-namespace — allows ingress traffic between Che pods in the same namespace
allow-from-workspaces — allows ingress traffic from user workspace namespaces
allow-from-openshift-ingress — allows ingress traffic from the OpenShift ingress namespace
allow-from-openshift-monitoring — allows ingress traffic from the OpenShift monitoring namespace
allow-from-<flavor>-operator — allows ingress traffic from the operator pod to Che components
allow-all-egress — allows all egress traffic from Che pods

User workspace namespace policies:

allow-from-<che-namespace> — allows ingress traffic from Che namespace pods
allow-from-same-namespace — allows ingress traffic between pods in the same namespace
allow-from-devworkspace-operator — allows ingress traffic from the DevWorkspace operator
allow-from-openshift-monitoring — allows ingress traffic from the OpenShift monitoring namespace
allow-from-openshift-ingress — allows ingress traffic from the OpenShift ingress namespace
allow-all-egress — allows all egress traffic from Che pods

Additional changes:

Refactored DwoNamespaceReconciler into a utility function GetDevWorkspaceOperatorNamespace
Extended cache selector to also watch DevWorkspace operator pods (for namespace lookup)
Added NetworkPolicy diff option, DeleteIgnoreNotFound k8s client method, and related constants

Screenshot/screencast of this PR

N/A — infrastructure change, no UI impact.

What issues does this PR fix or reference?

CRW-10821

How to test this PR?

Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

Enable network policies in the CheCluster CR:

kubectl patch checluster eclipse-che -n eclipse-che --type merge -p '{"spec":{"networking":{"networkPolicy":{"enabled":true}}}}'

Verify NetworkPolicy resources are created in the Che namespace:

kubectl get networkpolicies -n eclipse-che

Expected: 6 NetworkPolicy resources (allow-from-same-namespace, allow-from-workspaces, allow-from-openshift-ingress, allow-from-openshift-monitoring, allow-from-che-operator, allow-all-egress).

Start a workspace and verify NetworkPolicy resources are created in the user namespace:

kubectl get networkpolicies -n <user-namespace>

Expected: 6 NetworkPolicy resources (allow-from-eclipse-che, allow-from-same-namespace, allow-from-devworkspace-operator, allow-from-openshift-monitoring, allow-from-openshift-ingress, allow-all-egress).

Disable network policies and verify cleanup:

kubectl patch checluster eclipse-che -n eclipse-che --type merge -p '{"spec":{"networking":{"networkPolicy":{"enabled":false}}}}'
kubectl get networkpolicies -n eclipse-che
kubectl get networkpolicies -n <user-namespace>

Expected: all Che-managed NetworkPolicy resources are deleted.

Common Test Scenarios

Deploy Eclipse Che
Start an empty workspace
Open terminal and build/run an image
Stop a workspace
GitHub Device authentication
Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

Introduces operator-managed NetworkPolicy resources for both the Che namespace and user workspace namespaces on OpenShift. A new `spec.networking.networkPolicy.enabled` field controls the feature (disabled by default). When enabled, the operator creates fine-grained ingress and egress policies: Che namespace policies: - allow-from-same-namespace: Che-to-Che pod traffic - allow-from-workspaces-namespaces-to-openvsx-registry - allow-from-workspaces-namespaces-to-plugin-registry - allow-from-openshift-ingress - allow-from-openshift-monitoring - allow-from-operator: operator pod to Che components - allow-to-everywhere: all egress from Che pods User workspace namespace policies: - allow-from-<che-namespace>: ingress from Che namespace - allow-from-same-namespace: intra-namespace traffic - allow-from-devworkspace-operator: DWO to workspace pods - allow-from-openshift-monitoring - allow-from-openshift-ingress - allow-to-everywhere: all egress from workspace pods Also refactors DwoNamespaceReconciler into a utility function and extends the cache selector to watch DevWorkspace operator pods. Assisted-by: Claude Opus 4.6 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

rohanKanojia · 2026-07-28T16:40:42Z

I tested these changes and can confirm it works as expected. ✔️

After installing Eclipse Che based on these changes, and enabling Network Policies I could see NetworkPolicies getting created:

kubectl get networkpolicies -n eclipse-che
NAME                              POD-SELECTOR                                                   AGE
allow-all-egress                  app.kubernetes.io/part-of=che.eclipse.org                      5m11s
allow-from-openshift-ingress      app.kubernetes.io/part-of=che.eclipse.org                      5m11s
allow-from-openshift-monitoring   app.kubernetes.io/part-of=che.eclipse.org                      5m11s
allow-from-operator               app.kubernetes.io/part-of=che.eclipse.org                      5m11s
allow-from-same-namespace         app.kubernetes.io/part-of=che.eclipse.org                      5m11s
allow-from-workspaces             app.kubernetes.io/part-of=che.eclipse.org                      5m11s
eclipse-che-grpc-server           olm.catalogSource=eclipse-che,olm.managed=true                 63m
eclipse-che-unpack-bundles        olm.managed in (true),operatorframework.io/bundle-unpack-ref   63m

After creating a workspace, I could see NetworkPolicies in user namespace:

kubectl get networkpolicies -nkubeadmin-che
NAME                               POD-SELECTOR   AGE
allow-all-egress                   <none>         26s
allow-from-devworkspace-operator   <none>         26s
allow-from-eclipse-che             <none>         26s
allow-from-openshift-ingress       <none>         26s
allow-from-openshift-monitoring    <none>         26s
allow-from-same-namespace          <none>         26s

After disabling Network Policies I could see created NetworkPolicies getting cleaned up:

kubectl patch checluster eclipse-che -n eclipse-che --type merge -p '{"spec":{"networking":{"networkPolicy":{"enabled":false}}}}'
checluster.org.eclipse.che/eclipse-che patched

kubectl get networkpolicies -n eclipse-che
NAME                         POD-SELECTOR                                                   AGE
eclipse-che-grpc-server      olm.catalogSource=eclipse-che,olm.managed=true                 68m
eclipse-che-unpack-bundles   olm.managed in (true),operatorframework.io/bundle-unpack-ref   68m

che-operator : $ kubectl get networkpolicies -nkubeadmin-che
No resources found in kubeadmin-che namespace.

openshift-ci · 2026-07-28T17:15:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tolusha · 2026-07-29T11:04:13Z

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
/che-ai-assistant claude — Run a free-form instruction on this PR
/che-ai-assistant help — Show this help message

tolusha · 2026-07-29T11:04:14Z

⚠️ Warning: IDE/tool configuration files detected

This PR contains changes to files in directories that are typically not intended to be committed:

.claude/rules/api-types.md
.claude/rules/build-and-test.md
.claude/rules/code-style.md
.claude/rules/k8s-client.md
.claude/rules/kubebuilder-defaults.md
.claude/rules/pull-requests.md
.claude/rules/reconcilers.md
.claude/rules/redhat-compliance.md
.claude/rules/resource-naming.md
.claude/rules/testing.md

Please verify these changes are intentional.

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

openshift-ci · 2026-07-30T08:52:15Z

New changes are detected. LGTM label has been removed.

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha · 2026-07-30T14:44:57Z

/test v19-devworkspace-happy-path

dkwon17 · 2026-07-30T22:02:10Z

Core functionality seems to be working as expected. I've successfully verified steps 2 through 5 above.

I also created a regular user and workspace starts / workspace samples / plugin installation was working as expected:

tolusha requested review from SDawley, dkwon17, ibuziuk and mkuznyetsov as code owners July 27, 2026 13:22

openshift-ci Bot added the needs-rebase label Jul 27, 2026

tolusha and others added 3 commits July 27, 2026 15:31

chore: Add NetworkPolicy reconciler

fcd6d3a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

chore: Add NetworkPolicy reconciler

9824465

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha force-pushed the CRW-10821-3 branch from cf7c5c0 to 2462897 Compare July 27, 2026 13:39

openshift-ci Bot removed the needs-rebase label Jul 27, 2026

commit .claude/rules/pull-requests.md

4b5408d

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha changed the title ~~chore: Add NetworkPolicy reconciler~~ chore: Add NetworkPolicy reconciler Jul 27, 2026

chore: fixup

fa5682f

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha requested review from akurinnoy and rohanKanojia July 27, 2026 15:36

chore: fixup

9cb67c5

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

rohanKanojia reviewed Jul 28, 2026

View reviewed changes

Comment thread controllers/usernamespace/usernamespace_controller.go Outdated

tolusha changed the title ~~chore: Add NetworkPolicy reconciler~~ chore: Add NetworkPolicy reconciler Jul 28, 2026

Rename allow-all-ingress -> allow-all-egress

09b928a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

This comment was marked as outdated.

Sign in to view

rohanKanojia reviewed Jul 28, 2026

View reviewed changes

Comment thread controllers/usernamespace/usernamespace_controller_network_policies_test.go

rohanKanojia approved these changes Jul 28, 2026

View reviewed changes

openshift-ci Bot assigned rohanKanojia Jul 28, 2026

openshift-ci Bot added the lgtm label Jul 28, 2026

This comment was marked as outdated.

Sign in to view

chore: fixup

e7b319e

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha added 4 commits July 29, 2026 16:56

chore: fixup

a2c1d8a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

chore: fixup

614c5a0

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

chore: fixup

065c8eb

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

chore: fixup

f18b65a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

openshift-ci Bot removed the lgtm label Jul 30, 2026

This comment was marked as outdated.

Sign in to view

tolusha mentioned this pull request Jul 30, 2026

docs: Document operator-managed network policies eclipse-che/che-docs#3175

Merged

5 tasks

chore: fixup

146a6a9

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha mentioned this pull request Jul 30, 2026

docs: document operator-managed network policies eclipse-che/che-docs#3176

Closed

3 tasks

This comment was marked as resolved.

Sign in to view

tolusha merged commit 7a3abeb into main Jul 31, 2026
45 of 51 checks passed

tolusha deleted the CRW-10821-3 branch July 31, 2026 07:58

Uh oh!

Conversation

tolusha commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

OpenShift

Common Test Scenarios

PR Checklist

Reviewers

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

rohanKanojia commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

tolusha commented Jul 29, 2026

Uh oh!

tolusha commented Jul 29, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as resolved.

Uh oh!

tolusha commented Jul 30, 2026

Uh oh!

dkwon17 commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tolusha commented Jul 27, 2026 •

edited

Loading