Chapter 3. Configure projects

Procedure

1. Configure the CheCluster Custom Resource. See Section 2.2, “Use the CLI to configure the CheCluster Custom Resource”.

   spec:
     components:
       devEnvironments:
         defaultNamespace:
           template: <workspace_namespace_template>

   where:

   <workspace_namespace_template>

   The project name template. Must include the <username> or <userid> placeholder.

   Expand

   Table 3.1. User workspaces project name template examples

   User workspaces project name template	Resulting project example
   <username>-devspaces (default)	user1-devspaces
   <userid>-namespace	cge1egvsb2nhba-namespace-ul1411
   <userid>-aka-<username>-namespace	cgezegvsb2nhba-aka-user1-namespace-6m2w2b

   Show more

Procedure

1. Disable automatic namespace provisioning on the CheCluster level:

   devEnvironments:
     defaultNamespace:
       autoProvision: false

2. Create the <project_name> project for <username> user with the following labels and annotations:

   kind: Namespace
   apiVersion: v1
   metadata:
     name: <project_name>
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: workspaces-namespace
     annotations:
       che.eclipse.org/username: <username>

   where:

   <project_name>

   A project name of your choosing.

   <username>

   The username of the OpenShift Dev Spaces user.

Procedure

1. Create the following ConfigMap to mount it into every workspace:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: devspaces-user-configmap
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: workspaces-config
   data:
     ...

   For example, to mount a default SSH configuration into every workspace, create a ConfigMap:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: ssh-config-configmap
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/component: workspaces-config
       app.kubernetes.io/part-of: che.eclipse.org
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /etc/ssh/ssh_config.d/
   data:
     ssh.conf: <ssh_config_content>

   The ConfigMap propagates the SSH configuration as an extension by using Include /etc/ssh/ssh_config.d/*.conf. For details, see Include definition.

   For other labels and annotations, see the mounting volumes, configmaps, and secrets.

2. Optional: To prevent the ConfigMap from being mounted automatically, add these labels:

   controller.devfile.io/watch-configmap: "false"
   controller.devfile.io/mount-to-devworkspace: "false"

3. Optional: To retain the ConfigMap in a user namespace after deletion from openshift-devspaces, add this annotation:

   che.eclipse.org/sync-retain-on-delete: "true"

4. Create the following Secret to mount it into every workspace:

   kind: Secret
   apiVersion: v1
   metadata:
     name: devspaces-user-secret
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: workspaces-config
   stringData:
       ...

   See the mounting volumes, configmaps, and secrets for other possible labels and annotations.

5. Optional: To prevent the Secret from being mounted automatically, add these labels:

   controller.devfile.io/watch-secret: "false"
   controller.devfile.io/mount-to-devworkspace: "false"

6. Optional: To retain the Secret in a user namespace after deletion from openshift-devspaces, add this annotation:

   che.eclipse.org/sync-retain-on-delete: "true"

7. Create the following PersistentVolumeClaim for every user project:

   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     name: devspaces-user-pvc
     namespace: openshift-devspaces
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
       app.kubernetes.io/component: workspaces-config
   spec:
     ...

   See the mounting volumes, configmaps, and secrets for other possible labels and annotations.

8. Optional: By default, deleting a PersistentVolumeClaim from openshift-devspaces does not delete it from a user namespace. To delete the PersistentVolumeClaim from user namespaces as well, add this annotation:

   che.eclipse.org/sync-retain-on-delete: "false"

9. Optional: To use the OpenShift Kubernetes Engine, create a Template object to replicate all resources defined within the template across each user project.

   Aside from the previously mentioned ConfigMap, Secret, and PersistentVolumeClaim, Template objects can include:

   • LimitRange
   • NetworkPolicy
   • ResourceQuota
   • Role

   • RoleBinding

     apiVersion: template.openshift.io/v1
     kind: Template
     metadata:
       name: devspaces-user-namespace-configurator
       namespace: openshift-devspaces
       labels:
         app.kubernetes.io/part-of: che.eclipse.org
         app.kubernetes.io/component: workspaces-config
     objects:
       ...
     parameters:
     - name: PROJECT_NAME
     - name: PROJECT_ADMIN_USER

     The parameters are optional and define which parameters can be used. Currently, only PROJECT_NAME and PROJECT_ADMIN_USER are supported. PROJECT_NAME is the name of the OpenShift Dev Spaces namespace, while PROJECT_ADMIN_USER is the OpenShift Dev Spaces user of the namespace.

     The namespace name in objects is replaced with the user’s namespace name during synchronization.

     For example, a Template that replicates ResourceQuota, LimitRange, Role, and RoleBinding objects:

     apiVersion: template.openshift.io/v1
     kind: Template
     metadata:
       name: devspaces-user-namespace-configurator
       namespace: openshift-devspaces
       labels:
         app.kubernetes.io/part-of: che.eclipse.org
         app.kubernetes.io/component: workspaces-config
     objects:
     - apiVersion: v1
       kind: ResourceQuota
       metadata:
         name: devspaces-user-resource-quota
       spec:
         ...
     - apiVersion: v1
       kind: LimitRange
       metadata:
         name: devspaces-user-resource-constraint
       spec:
         ...
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: Role
       metadata:
         name: devspaces-user-roles
       rules:
         ...
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
       metadata:
         name: devspaces-user-rolebinding
       roleRef:
         apiGroup: rbac.authorization.k8s.io
         kind: Role
         name: devspaces-user-roles
       subjects:
       - kind: User
         apiGroup: rbac.authorization.k8s.io
         name: ${PROJECT_ADMIN_USER}
     parameters:
     - name: PROJECT_ADMIN_USER

     Note

     Creating Template Kubernetes resources is supported only on OpenShift.