Chapter 9. Configure networking

Procedure

1. Create an allow-from-openshift-devspaces.yaml file. The allow-from-openshift-devspaces NetworkPolicy allows incoming traffic from the OpenShift Dev Spaces namespace to all Pods in the user project.

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
       name: allow-from-openshift-devspaces
   spec:
       ingress:
       - from:
           - namespaceSelector:
               matchLabels:
                   kubernetes.io/metadata.name: openshift-devspaces
       podSelector: {}
       policyTypes:
       - Ingress

   where:

   kubernetes.io/metadata.name: openshift-devspaces

   Selects traffic from the OpenShift Dev Spaces namespace. The default namespace is openshift-devspaces.

   podSelector: {}

   The empty podSelector selects all Pods in the project.

2. Apply the allow-from-openshift-devspaces NetworkPolicy to each user project:

   oc apply -f allow-from-openshift-devspaces.yaml -n <user_namespace>

3. Optional: If you configured multitenant isolation with network policy, create and apply the allow-from-openshift-apiserver and allow-from-workspaces-namespaces NetworkPolicies to openshift-devspaces. The allow-from-openshift-apiserver NetworkPolicy allows incoming traffic from the openshift-apiserver namespace to the devworkspace-webhook-server, enabling webhooks. The allow-from-workspaces-namespaces NetworkPolicy allows incoming traffic from each user project to the che-gateway pod.

   1. Create an allow-from-openshift-apiserver.yaml file:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-openshift-apiserver
        namespace: openshift-devspaces
      spec:
        podSelector:
          matchLabels:
            app.kubernetes.io/name: devworkspace-webhook-server
        ingress:
          - from:
              - podSelector: {}
                namespaceSelector:
                  matchLabels:
                    kubernetes.io/metadata.name: openshift-apiserver
        policyTypes:
          - Ingress

      where:

      namespace: openshift-devspaces

      The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

      app.kubernetes.io/name: devworkspace-webhook-server

      The podSelector only selects devworkspace-webhook-server pods.

   2. Create an allow-from-workspaces-namespaces.yaml file:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-workspaces-namespaces
        namespace: openshift-devspaces
      spec:
        podSelector: {}
        ingress:
          - from:
              - podSelector: {}
                namespaceSelector:
                  matchLabels:
                    app.kubernetes.io/component: workspaces-namespace
        policyTypes:
          - Ingress

      where:

      namespace: openshift-devspaces

      The OpenShift Dev Spaces namespace. The default is openshift-devspaces.

      podSelector: {}

      The empty podSelector selects all pods in the OpenShift Dev Spaces namespace.

   3. Apply both NetworkPolicies:

      oc apply -f allow-from-openshift-apiserver.yaml -n openshift-devspaces
      oc apply -f allow-from-workspaces-namespaces.yaml -n openshift-devspaces

Procedure

1. Pre-create a project for OpenShift Dev Spaces:

   $ oc create project openshift-devspaces

2. Create a TLS secret:

   $ oc create secret tls <tls_secret_name> \
   --key <key_file> \
   --cert <cert_file> \
   -n openshift-devspaces

   where:

   <tls_secret_name>

   The TLS secret name.

   --key

   A file with the private key.

   --cert

   A file with the certificate.

3. Add the required labels to the secret:

   $ oc label secret <tls_secret_name> \
   app.kubernetes.io/part-of=che.eclipse.org -n openshift-devspaces

   where:

   <tls_secret_name>

   The TLS secret name.

4. Configure the CheCluster Custom Resource:

   spec:
     networking:
       hostname: <hostname>
       tlsSecretName: <secret>

   where:

   <hostname>

   Custom Red Hat OpenShift Dev Spaces server hostname.

   <secret>

   The TLS secret name.

5. If OpenShift Dev Spaces is already deployed, wait for the rollout of all OpenShift Dev Spaces components to complete.

Procedure

1. Concatenate all CA chains PEM files to import, into the custom-ca-certificates.pem file, and remove the return character that is incompatible with the Java truststore.

   $ cat ca-cert-for-devspaces-*.pem | tr -d '\r' > custom-ca-certificates.pem

2. Create the custom-ca-certificates ConfigMap with the required TLS certificates:

   $ oc create configmap custom-ca-certificates \
       --from-file=custom-ca-certificates.pem \
       --namespace=openshift-devspaces

3. Label the custom-ca-certificates ConfigMap:

   $ oc label configmap custom-ca-certificates \
       app.kubernetes.io/component=ca-bundle \
       app.kubernetes.io/part-of=che.eclipse.org \
       --namespace=openshift-devspaces

4. Deploy OpenShift Dev Spaces if it has not been deployed before. Otherwise, wait until the rollout of OpenShift Dev Spaces components finishes.
5. Restart running workspaces for the changes to take effect.

Verification

1. Verify that the ConfigMap contains your custom CA certificates. This command returns CA bundle certificates in PEM format:

   oc get configmap \
       --namespace=openshift-devspaces \
       --output='jsonpath={.items[0:].data.custom-ca-certificates\.pem}' \
       --selector=app.kubernetes.io/component=ca-bundle,app.kubernetes.io/part-of=che.eclipse.org

2. Verify in the OpenShift Dev Spaces server logs that the imported certificates count is not null:

   oc logs deploy/devspaces --namespace=openshift-devspaces \
       | grep tls-ca-bundle.pem

3. Start a workspace, get the project name in which it has been created: <workspace_namespace>, and wait for the workspace to be started.

4. Verify that the ca-certs-merged ConfigMap contains your custom CA certificates. This command returns OpenShift Dev Spaces CA bundle certificates in PEM format:

   oc get configmap ca-certs-merged \
       --namespace=<workspace_namespace> \
       --output='jsonpath={.data.tls-ca-bundle\.pem}'

5. Verify that the workspace pod mounts the ca-certs-merged ConfigMap:

   oc get pod \
       --namespace=<workspace_namespace> \
       --selector='controller.devfile.io/devworkspace_name=<workspace_name>' \
       --output='jsonpath={.items[0:].spec.volumes[0:].configMap.name}' \
       | grep ca-certs-merged

6. Get the workspace pod name <workspace_pod_name>:

   oc get pod \
       --namespace=<workspace_namespace> \
       --selector='controller.devfile.io/devworkspace_name=<workspace_name>' \
       --output='jsonpath={.items[0:].metadata.name}'

7. Verify that the workspace container has your custom CA certificates. This command returns OpenShift Dev Spaces CA bundle certificates in PEM format:

   oc exec <workspace_pod_name> \
       --namespace=<workspace_namespace> \
       -- cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

   Or if disableWorkspaceCaBundleMount set to true:

   oc exec <workspace_pod_name> \
       --namespace=<workspace_namespace> \
       -- cat /public-certs/tls-ca-bundle.pem

Procedure

1. Configure the CheCluster Custom Resource. See Section 2.2, “Use the CLI to configure the CheCluster Custom Resource”.

   spec:
     networking:
       labels: <labels>
       domain: <domain>
       annotations: <annotations>

   where:

   <labels>

   An unstructured key value map of labels that the target ingress controller uses to filter the set of Routes to service.

   <domain>

   The DNS name serviced by the target ingress controller.

   <annotations>

   An unstructured key value map stored with a resource.

Procedure

1. Set the CHE_INFRA_OPENSHIFT_ROUTE_HOST_DOMAIN__SUFFIX field in the CheCluster Custom Resource:

   spec:
     components:
       cheServer:
         extraProperties:
           CHE_INFRA_OPENSHIFT_ROUTE_HOST_DOMAIN__SUFFIX: "<base_domain>" 

   1

   1

   Workspace endpoints base domain, for example, my-devspaces.example.com.

2. Apply the change:

   oc patch checluster/devspaces \
       --namespace openshift-devspaces \
       --type='merge' -p \
   '{"spec":
       {"components":
           {"cheServer":
               {"extraProperties":
                   {"CHE_INFRA_OPENSHIFT_ROUTE_HOST_DOMAIN__SUFFIX": "my-devspaces.example.com"}}}}}'

Procedure

1. Optional: Create a Secret in the openshift-devspaces namespace that contains a user and password for a proxy server. The secret must have the app.kubernetes.io/part-of=che.eclipse.org label. Skip this step if the proxy server does not require authentication.

   oc apply -f - <<EOF
   kind: Secret
   apiVersion: v1
   metadata:
     name: devspaces-proxy-credentials
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
   type: Opaque
   stringData:
     user: <user>
     password: <password>
   EOF

   where:

   <user>

   The username for the proxy server.

   <password>

   The password for the proxy server.

2. Configure the proxy or override the cluster-wide proxy configuration for an OpenShift cluster by setting the following properties in the CheCluster custom resource:

   oc patch checluster/devspaces \
       --namespace openshift-devspaces \
       --type='merge' -p \
   '{"spec":
       {"components":
           {"cheServer":
               {"proxy":
                   {"credentialsSecretName" : "<secretName>",
                    "nonProxyHosts"         : ["<host_1>"],
                    "port"                  : "<port>",
                    "url"                   : "<protocol>://<domain>"}}}}}'

   where:

   <secretName>

   The credentials secret name created in the previous step.

   <host_1>

   The list of hosts that can be reached directly, without using the proxy. Use the following form .<DOMAIN> to specify a wildcard domain. OpenShift Dev Spaces Operator automatically adds .svc and Kubernetes service host to the list of non-proxy hosts. In OpenShift, OpenShift Dev Spaces Operator combines the non-proxy host list from the cluster-wide proxy configuration with the custom resource. In some proxy configurations, localhost may not translate to 127.0.0.1. Both localhost and 127.0.0.1 should be specified in this situation.

   <port>

   The port of the proxy server.

   <protocol>://<domain>

   Protocol and domain of the proxy server.

Verification

1. Start a workspace.
2. Verify that the workspace pod contains HTTP_PROXY, HTTPS_PROXY, http_proxy, and https_proxy environment variables, each set to <protocol>://<user>:<password>@<domain>:<port>.
3. Verify that the workspace pod contains NO_PROXY and no_proxy environment variables, each set to a comma-separated list of non-proxy hosts.