From 75dae0e9bdc69c5b3883757f8aea94b438e45b07 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Jun 2026 04:25:55 +0000 Subject: [PATCH] chore(deps): bump github.com/devfile/devworkspace-operator Bumps [github.com/devfile/devworkspace-operator](https://github.com/devfile/devworkspace-operator) from 0.41.0 to 0.42.0. - [Changelog](https://github.com/devfile/devworkspace-operator/blob/main/CHANGELOG.md) - [Commits](https://github.com/devfile/devworkspace-operator/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: github.com/devfile/devworkspace-operator dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 4 +- go.sum | 4 +- .../devworkspaceoperatorconfig_types.go | 25 ++++++++++- .../v1alpha1/zz_generated.deepcopy.go | 30 +++++++++++++ .../devworkspacerouting_controller.go | 6 ++- .../pkg/config/defaults.go | 44 +++++++++++++++++-- .../devworkspace-operator/pkg/config/sync.go | 26 ++++++++++- vendor/modules.txt | 4 +- 8 files changed, 129 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index d64ba1a3c1..fad6945cf4 100644 --- a/go.mod +++ b/go.mod @@ -1,11 +1,11 @@ module github.com/eclipse-che/che-operator -go 1.25.7 +go 1.26.0 require ( github.com/che-incubator/kubernetes-image-puller-operator v0.0.0-20250214104625-65e5ec32f521 github.com/devfile/api/v2 v2.3.1-alpha.0.20250521155908-5c3d7b99d252 - github.com/devfile/devworkspace-operator v0.41.0 + github.com/devfile/devworkspace-operator v0.42.0 github.com/go-logr/logr v1.4.3 github.com/google/go-cmp v0.7.0 github.com/openshift/api v0.0.0-20260325070019-86893981287e diff --git a/go.sum b/go.sum index 8be2ae5e65..c6c531ab7d 100644 --- a/go.sum +++ b/go.sum @@ -62,8 +62,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/devfile/api/v2 v2.3.1-alpha.0.20250521155908-5c3d7b99d252 h1:C6DNKt+GHWe7vVD2ic73lR10UlC8egbxAY28U7A5IZA= github.com/devfile/api/v2 v2.3.1-alpha.0.20250521155908-5c3d7b99d252/go.mod h1:ZdlwgS98m5O+i5H+q/COJt4PAe2ZGoAq8tJ7+s0UmAU= -github.com/devfile/devworkspace-operator v0.41.0 h1:Oc3rzy3bBYMe8hpoihLlYXsIItvegRlpFf2/uj3FlR0= -github.com/devfile/devworkspace-operator v0.41.0/go.mod h1:8SyQtuUsznciSPKBWsgbIyNEsbvzWSiIpvd6ATefb8Q= +github.com/devfile/devworkspace-operator v0.42.0 h1:6+ENMy3aunbRIERrasaumWxRetP8oJ3sd9VNmz8z0iw= +github.com/devfile/devworkspace-operator v0.42.0/go.mod h1:TwZlVUb+/wwXaxJ6gadRiJKZ+JRKdniO8p+2KSZCqkI= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM= diff --git a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go index 60a2df5d4f..680a2abd01 100644 --- a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go +++ b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go @@ -1,5 +1,5 @@ // -// Copyright (c) 2019-2025 Red Hat, Inc. +// Copyright (c) 2019-2026 Red Hat, Inc. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at @@ -146,6 +146,24 @@ type RoutingConfig struct { TLSCertificateConfigmapRef *ConfigmapReference `json:"tlsCertificateConfigmapRef,omitempty"` } +// OverrideConfig defines configuration options for controlling which fields are restricted +// in `container-overrides` and `pod-overrides` DevWorkspace attributes. +// Entries support value-level restrictions: "fieldName" restricts the field entirely, +// while "fieldName=value" restricts only that specific value (other values remain allowed). +type OverrideConfig struct { + // RestrictedContainerOverrideFields defines a list of container-level fields that are restricted + // in `container-overrides` attributes. Note that the following fields are always implicitly + // restricted and cannot be permitted: `name`, `image`, `command`, `args`, `ports`, `env`. + // +kubebuilder:validation:Optional + RestrictedContainerOverrideFields []string `json:"restrictedContainerOverrideFields,omitempty"` + + // RestrictedPodOverrideFields defines a list of pod-level fields that are restricted + // in `pod-overrides` attributes. Note that the following fields are always implicitly + // restricted and cannot be permitted: `containers`, `initContainers`. + // +kubebuilder:validation:Optional + RestrictedPodOverrideFields []string `json:"restrictedPodOverrideFields,omitempty"` +} + type WorkspaceConfig struct { // ProjectCloneConfig defines configuration related to the project clone init container // that is used to clone git projects into the DevWorkspace. @@ -230,7 +248,7 @@ type WorkspaceConfig struct { SchedulerName string `json:"schedulerName,omitempty"` // DefaultContainerResources defines the resource requirements (memory/cpu limit/request) used for // container components that do not define limits or requests. In order to not set a field by default, - // the value "0" should be used. By default, the memory limit is 128Mi and the memory request is 64Mi. + // the value "0" should be used. By default, the memory limit is 256Mi and the memory request is 128Mi. // No CPU limit or request is added by default. DefaultContainerResources *corev1.ResourceRequirements `json:"defaultContainerResources,omitempty"` // ContainerResourceCaps defines the maximum resource requirements enforced for workspace @@ -264,6 +282,9 @@ type WorkspaceConfig struct { // InitContainers defines a list of Kubernetes init containers that are automatically injected into all workspace pods. // Typical uses cases include injecting organization tools/configs, initializing persistent home, etc. InitContainers []corev1.Container `json:"initContainers,omitempty"` + // Overrides defines configuration options for `container-overrides` and + // `pod-overrides` DevWorkspace attributes. + Overrides *OverrideConfig `json:"overrides,omitempty"` } type WebhookConfig struct { diff --git a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/zz_generated.deepcopy.go index f795f3d439..0c3e6e4f97 100644 --- a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/zz_generated.deepcopy.go @@ -515,6 +515,31 @@ func (in *OrasConfig) DeepCopy() *OrasConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OverrideConfig) DeepCopyInto(out *OverrideConfig) { + *out = *in + if in.RestrictedContainerOverrideFields != nil { + in, out := &in.RestrictedContainerOverrideFields, &out.RestrictedContainerOverrideFields + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.RestrictedPodOverrideFields != nil { + in, out := &in.RestrictedPodOverrideFields, &out.RestrictedPodOverrideFields + *out = make([]string, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OverrideConfig. +func (in *OverrideConfig) DeepCopy() *OverrideConfig { + if in == nil { + return nil + } + out := new(OverrideConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *PersistentHomeConfig) DeepCopyInto(out *PersistentHomeConfig) { *out = *in @@ -939,6 +964,11 @@ func (in *WorkspaceConfig) DeepCopyInto(out *WorkspaceConfig) { (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.Overrides != nil { + in, out := &in.Overrides, &out.Overrides + *out = new(OverrideConfig) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceConfig. diff --git a/vendor/github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting/devworkspacerouting_controller.go b/vendor/github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting/devworkspacerouting_controller.go index 367da93d03..e5b6e2ca93 100644 --- a/vendor/github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting/devworkspacerouting_controller.go +++ b/vendor/github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting/devworkspacerouting_controller.go @@ -35,6 +35,7 @@ import ( networkingv1 "k8s.io/api/networking/v1" k8sErrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" + "k8s.io/utils/ptr" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/controller" @@ -340,7 +341,10 @@ func (r *DevWorkspaceRoutingReconciler) SetupWithManager(mgr ctrl.Manager) error } bld := ctrl.NewControllerManagedBy(mgr). - WithOptions(controller.Options{MaxConcurrentReconciles: maxConcurrentReconciles}). + WithOptions(controller.Options{ + MaxConcurrentReconciles: maxConcurrentReconciles, + UsePriorityQueue: ptr.To(false), + }). For(&controllerv1alpha1.DevWorkspaceRouting{}). Owns(&corev1.Service{}). Owns(&networkingv1.Ingress{}) diff --git a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go index f28fbb1711..7b299ac385 100644 --- a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go +++ b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go @@ -1,5 +1,5 @@ // -// Copyright (c) 2019-2025 Red Hat, Inc. +// Copyright (c) 2019-2026 Red Hat, Inc. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at @@ -82,10 +82,10 @@ var defaultConfig = &v1alpha1.OperatorConfiguration{ }, DefaultContainerResources: &corev1.ResourceRequirements{ Limits: corev1.ResourceList{ - corev1.ResourceMemory: resource.MustParse("128Mi"), + corev1.ResourceMemory: resource.MustParse("256Mi"), }, Requests: corev1.ResourceList{ - corev1.ResourceMemory: resource.MustParse("64Mi"), + corev1.ResourceMemory: resource.MustParse("128Mi"), }, }, CleanupCronJob: &v1alpha1.CleanupCronJobConfig{ @@ -116,7 +116,31 @@ var ( } defaultKubernetesContainerSecurityContext = &corev1.SecurityContext{} defaultOpenShiftPodSecurityContext = &corev1.PodSecurityContext{} - defaultOpenShiftContainerSecurityContext = &corev1.SecurityContext{ + + defaultOpenShiftOverrideConfig = &v1alpha1.OverrideConfig{ + RestrictedContainerOverrideFields: []string{}, + RestrictedPodOverrideFields: []string{}, + } + defaultKubernetesOverrideConfig = &v1alpha1.OverrideConfig{ + RestrictedContainerOverrideFields: []string{ + "securityContext.privileged=true", + "securityContext.runAsNonRoot=false", + "securityContext.runAsUser=0", + "securityContext.allowPrivilegeEscalation=true", + "securityContext.procMount=Unmasked", + "securityContext.capabilities.add", + }, + RestrictedPodOverrideFields: []string{ + "hostNetwork=true", + "hostPID=true", + "hostIPC=true", + "securityContext.runAsNonRoot=false", + "securityContext.runAsUser=0", + "volumes.hostPath", + }, + } + + defaultOpenShiftContainerSecurityContext = &corev1.SecurityContext{ ReadOnlyRootFilesystem: pointer.Bool(false), RunAsNonRoot: pointer.Bool(true), AllowPrivilegeEscalation: pointer.Bool(false), @@ -157,3 +181,15 @@ func setDefaultContainerSecurityContext() error { } return nil } + +func setDefaultOverrideConfig() error { + if !infrastructure.IsInitialized() { + return fmt.Errorf("can not set default override config, infrastructure not detected") + } + if infrastructure.IsOpenShift() { + defaultConfig.Workspace.Overrides = defaultOpenShiftOverrideConfig + } else { + defaultConfig.Workspace.Overrides = defaultKubernetesOverrideConfig + } + return nil +} diff --git a/vendor/github.com/devfile/devworkspace-operator/pkg/config/sync.go b/vendor/github.com/devfile/devworkspace-operator/pkg/config/sync.go index bf474e986d..8ff0021357 100644 --- a/vendor/github.com/devfile/devworkspace-operator/pkg/config/sync.go +++ b/vendor/github.com/devfile/devworkspace-operator/pkg/config/sync.go @@ -1,5 +1,5 @@ // -// Copyright (c) 2019-2025 Red Hat, Inc. +// Copyright (c) 2019-2026 Red Hat, Inc. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at @@ -101,6 +101,7 @@ func SetGlobalConfigForTesting(testConfig *controller.OperatorConfiguration) { defer configMutex.Unlock() setDefaultPodSecurityContext() setDefaultContainerSecurityContext() + setDefaultOverrideConfig() internalConfig = defaultConfig.DeepCopy() mergeConfig(testConfig, internalConfig) } @@ -115,6 +116,9 @@ func SetupControllerConfig(client crclient.Client) error { if err := setDefaultContainerSecurityContext(); err != nil { return err } + if err := setDefaultOverrideConfig(); err != nil { + return err + } internalConfig = &controller.OperatorConfiguration{} @@ -506,6 +510,18 @@ func mergeConfig(from, to *controller.OperatorConfiguration) { } to.Workspace.InitContainers = initContainersCopy } + + if from.Workspace.Overrides != nil { + if to.Workspace.Overrides == nil { + to.Workspace.Overrides = &controller.OverrideConfig{} + } + if from.Workspace.Overrides.RestrictedContainerOverrideFields != nil { + to.Workspace.Overrides.RestrictedContainerOverrideFields = from.Workspace.Overrides.RestrictedContainerOverrideFields + } + if from.Workspace.Overrides.RestrictedPodOverrideFields != nil { + to.Workspace.Overrides.RestrictedPodOverrideFields = from.Workspace.Overrides.RestrictedPodOverrideFields + } + } } } @@ -777,6 +793,14 @@ func GetCurrentConfigString(currConfig *controller.OperatorConfiguration) string if workspace.HostUsers != nil { config = append(config, fmt.Sprintf("workspace.hostUsers=%t", *workspace.HostUsers)) } + if workspace.Overrides != nil { + if workspace.Overrides.RestrictedContainerOverrideFields != nil { + config = append(config, fmt.Sprintf("workspace.overrides.restrictedContainerOverrideFields=[%s]", strings.Join(workspace.Overrides.RestrictedContainerOverrideFields, ", "))) + } + if workspace.Overrides.RestrictedPodOverrideFields != nil { + config = append(config, fmt.Sprintf("workspace.overrides.restrictedPodOverrideFields=[%s]", strings.Join(workspace.Overrides.RestrictedPodOverrideFields, ", "))) + } + } if len(workspace.InitContainers) > 0 { initContainerNames := make([]string, len(workspace.InitContainers)) for i, container := range workspace.InitContainers { diff --git a/vendor/modules.txt b/vendor/modules.txt index d9be70afd6..5b9e74c3dd 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -24,8 +24,8 @@ github.com/davecgh/go-spew/spew github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2 github.com/devfile/api/v2/pkg/attributes github.com/devfile/api/v2/pkg/devfile -# github.com/devfile/devworkspace-operator v0.41.0 -## explicit; go 1.25.0 +# github.com/devfile/devworkspace-operator v0.42.0 +## explicit; go 1.26.0 github.com/devfile/devworkspace-operator/apis/controller/v1alpha1 github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting/solvers