feat: Manage OpenVSX as Che operand by svor · Pull Request #2130 · eclipse-che/che-operator

svor · 2026-06-08T12:34:33Z

What does this PR do?

Deploy and manage a dedicated OpenVSX server and PostgreSQL database as Che operands,
enabled via spec.components.openVSX.enable
Expose OpenVSX via a dedicated Ingress (not the Che gateway), supporting both OpenShift
and Kubernetes
Auto-seed the database with a privileged user and admin PAT via a one-shot Job
Support publishing extensions from a user-editable openvsx-extensions ConfigMap
Persist extension storage on a PVC (default 3Gi, configurable via
spec.components.openVSX.server.claimSize)
Make openvsx-server-config ConfigMap user-editable with automatic pod rollout on
changes

New CRD fields

spec.components.openVSX.enable — enables the OpenVSX operand (default is false)
spec.components.openVSX.server.claimSize — PVC size for extension storage (default:
3Gi)
spec.components.openVSX.server.deployment — deployment overrides
spec.components.openVSX.database.claimSize — PVC size for PostgreSQL data (default:
1Gi)
spec.components.openVSX.database.deployment — deployment overrides
status.openVSXURL — URL of the managed OpenVSX instance

Resources created when enabled

openvsx-database: Deployment, Service, PVC, credentials Secret
openvsx-server: Deployment, Service, PVC, ConfigMap (application config), ConfigMap
(extensions list)
openvsx-user-setup: one-shot Job to seed DB users and PATs
openvsx-extension-publish: Job to publish extensions from the extensions ConfigMap
openvsx: Ingress with platform-appropriate TLS and annotations

All resources are cleaned up when openVSX.enable is set to false.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://issues.redhat.com/browse/CRW-10323

How to test this PR?

Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

Common Test Scenarios

Enable OpenVSX operand and verify all resources are created
Publish extensions via openvsx-extensions ConfigMap

Verify extensions survive pod restart (PVC persistence)
Update openvsx-server-config ConfigMap and verify pod rollout

Resize PVC via claimSize and verify expansion
Disable OpenVSX operand and verify all resources are deleted
Verify Ingress works on both OpenShift and Kubernetes

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

openshift-ci · 2026-06-08T12:34:37Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-06-08T12:34:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: svor

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tolusha · 2026-06-08T12:35:58Z

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant help — Show this help message

Co-authored-by: Anatolii Bazko <abazko@redhat.com>

When OpenVSX.Enable=true, the managed operand provides the registry. Disable the embedded OpenVSX in the plugin registry and override the dashboard's OpenVSX URL with Status.OpenVSXURL. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rename secret keys to be more descriptive (e.g. user→db-user, userPAT→publisher-token). Add OpenVSXSecret field to allow users to provide their own credentials secret. Make JDBC database name configurable via PGDATABASE env var instead of hardcoded value. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The cached client only tracks operator-managed secrets, so user-created secrets were not visible during reconciliation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace shell variable interpolation with psql -v variables and heredoc input to prevent SQL injection from user-provided secret values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

…2151) * Route OpenVSX through the Che gateway instead of a dedicated Ingress Replace the dedicated Ingress/Route (openvsx-<cheHost>) with a Traefik gateway path (<cheHost>/openvsx), eliminating the extra DNS record and TLS certificate per deployment. Use Spring Boot server.servlet.context-path so the server natively serves under /openvsx without StripPrefix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Set resource limits for the OpenVSX publisher job pod The publisher container had no resource requests or limits, which could lead to scheduling issues and OOM kills when uploading large VSIXes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Enable forward-headers-strategy for OpenVSX behind Traefik Spring Boot needs to process X-Forwarded-Proto/Host headers from the reverse proxy so API response URLs use the correct external scheme and host instead of internal http://host:8080. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Update CSV bundle version to 7.120.0-1030.next Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Reset reconciler state on disable and revert publisher resource limits Reset databaseProvisioned and extensionsVersion flags when the OpenVSX operand is disabled, so that re-enabling properly re-runs provisioning jobs. Remove explicit resource limits from the publisher job pod. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Prevent publisher Job failures from timing and label conflicts - Add isServerReady() guard to ensure the publisher Job is only created after the OpenVSX server deployment has available replicas - Use distinct labels for publisher Job pods so the openvsx-server Service does not route traffic to non-server pods - Move syncOpenVSXURLStatus before extensions sync to match the old reconciler ordering Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * update openvsx server expose Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com> * update openvsx to v1.0.1 Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com> * Log error on legacy Ingress cleanup instead of discarding it Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix build Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com> * Remove unnecessary legacy Ingress cleanup There was no prior Ingress-based OpenVSX deployment to migrate from. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com>

openshift-ci Bot added the do-not-merge/work-in-progress label Jun 8, 2026

svor marked this pull request as ready for review June 8, 2026 12:58

svor requested review from SDawley, dkwon17, ibuziuk, mkuznyetsov and tolusha as code owners June 8, 2026 12:58

openshift-ci Bot removed the do-not-merge/work-in-progress label Jun 8, 2026

This comment was marked as outdated.

Sign in to view

This comment was marked as resolved.

Sign in to view

This comment was marked as outdated.

Sign in to view

tolusha mentioned this pull request Jun 8, 2026

procedures: Add documentation for operator-managed OpenVSX registry eclipse-che/che-docs#3122

Closed

5 tasks