Detect and warn about DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard #1436

olexii4 · 2025-12-31T03:31:45Z

What does this PR do?

This PR implements a feature to detect and warn about DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard.

When an administrator enables container run or build capabilities on the server, workspaces that were created before this change will have a different SCC than the current server configuration. These workspaces will display a warning status with an explanatory tooltip, but can still be started.

Key Changes:

selectCurrentScc selector - Detects the current SCC from server configuration based on container run/build capabilities
getContainerScc method - Retrieves the SCC attribute from a DevWorkspace
containerRunCapabilities branding docs URL - Added documentation link for the tooltip
sccMismatch.ts helper module - Contains:
- SCC_MISMATCH_WARNING_MESSAGE constant - Centralized warning message used across components
- hasSccMismatch function - Determines if there's a mismatch between workspace and server SCC
getSccMismatchTooltip function - Generates the tooltip content with warning message and documentation link
WorkspaceStatusIndicator update - Shows warning triangle icon with tooltip when workspace SCC doesn't match server SCC (only for stopped workspaces)
WorkspaceStatusLabel update - Shows actual status with warning icon and tooltip when SCC mismatch is detected (only for stopped workspaces)
StartingStepStartWorkspace SCC check - Shows warning alert when starting workspace with SCC mismatch (does not block start)
WorkspaceActionsProvider SCC check - Logs warning when starting workspace with SCC mismatch (does not block start)

Behavior:

Scenario	currentScc	containerScc	Behavior
Server has no SCC requirement	undefined	any	Show actual status, allow start (no warning)
Both match	defined	same value	Show actual status, allow start (no warning)
Workspace missing SCC	defined	undefined	Show warning icon/tooltip, allow start with warning alert
Different SCC values	defined	different value	Show warning icon/tooltip, allow start with warning alert

Note: SCC mismatch warning is only shown for stopped workspaces. Running or starting workspaces show their actual status.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

fixes eclipse-che/che#23636

Is it tested? How?

Deploy Eclipse-Che with the image from this PR.

Test SCC Mismatch Detection:

Deploy Eclipse-Che with the image from this PR.:

Create a new workspace (without container run capabilities enabled)
Enable container run capabilities on the server. Additional information
Refresh the dashboard

Verify:

Workspace status indicator shows warning triangle icon (not stopped icon)
Workspace status label shows "Stopped" text with warning icon
Tooltip shows the SCC mismatch warning message: "The workspace was created with a different container SCC (Security Context Constraint) than what is currently configured. The workspace may fail to start."
Tooltip includes a clickable "Learn more" link to documentation
Workspace can be started (not blocked)
Warning alert is displayed during start

Test containerScc undefined scenario:

Create a workspace without SCC attribute (containerScc undefined)
Configure server with any SCC value (e.g., enable container run capabilities)

Verify:

Workspace status shows warning icon (mismatch detected)
Tooltip shows SCC mismatch warning
Workspace can be started with warning alert

Test no server SCC requirement:

Create a workspace with any SCC attribute
Ensure server has no container run/build capabilities enabled (currentScc undefined)

Verify:

Workspace status shows actual status (no warning)
Workspace can be started normally without any warning

Test matching SCC:

Enable container run capabilities on server
Create a new workspace (will have matching SCC)

Verify:

Workspace status shows actual status (no warning)
Workspace can be sta

Release Notes

Docs PR

che-bot · 2025-12-31T03:31:54Z

Click here to review and test in web IDE:

github-actions · 2026-01-01T00:14:06Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-01T18:45:30Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-01T22:45:20Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-01T23:10:48Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-02T01:20:19Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-02T01:58:51Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-02T02:01:18Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

tolusha · 2026-01-05T09:40:39Z

Some notes:

Could we move message to a constant, since it used in many places?
If containerScc is undefined, that we should allow workspace to start.
containerScc !== currentScc doesn't mean that container nested capabilities are enabled. Instead, the message should emphasize, that container SCC(s) are different.
I believe that warning is enough, dashaboard should not prevent workspace from starting.
Does documentation link is different for downstream?

olexii4 · 2026-01-05T14:43:39Z

Does documentation link is different for downstream?

Documentation link is different for downstream. We have the MR

github-actions · 2026-01-05T18:17:56Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

This commit adds the ability to detect and prevent starting workspaces with SCC (Security Context Constraint) mismatches. Changes: - Add selectCurrentScc selector to detect current SCC from server config - Add getDefaultEditor helper function for consistency - Add getContainerScc method to WorkspaceAdapter - Add containerRunCapabilities URL to branding docs - Update WorkspaceStatusIndicator to show Failed status with tooltip when workspace SCC doesn't match server SCC - Add SCC mismatch checks in StartWorkspace component to prevent starting - Add SCC mismatch checks in WorkspaceActionsDropdown to disable actions - Add SCC mismatch checks in WorkspaceActionsProvider - Remove SCC injection from createDevWorkspaceTemplate - Remove manageContainerSccAttribute and related methods When container run/build capabilities are enabled on the server, workspaces created before this change will show a Failed status and cannot be started. Signed-off-by: Oleksii Orel <[email protected]>

github-actions · 2026-01-06T16:10:27Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-07T02:17:28Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-07T02:33:27Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-07T02:36:40Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

github-actions · 2026-01-07T02:47:25Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

Based on code review feedback: - Move SCC mismatch message to a constant (SCC_MISMATCH_WARNING_MESSAGE) - Allow workspace start when containerScc is undefined - Update message to emphasize SCC difference instead of nested capabilities - Change from blocking error to warning - dashboard should not prevent workspace from starting The hasSccMismatch() function now returns false when containerScc is undefined, allowing workspaces created before SCC attribute was added to start normally. Status indicators now show warning icon instead of failed status, and start actions log a warning instead of throwing an error. Signed-off-by: Oleksii Orel <[email protected]>

github-actions · 2026-01-07T03:08:38Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

Remove the early return when currentScc is undefined. This ensures SCC mismatch is detected when workspace has a containerScc value but server has no SCC requirement (currentScc is undefined). Signed-off-by: Oleksii Orel <[email protected]>

github-actions · 2026-01-07T14:21:59Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

Add unit tests to improve coverage for SCC mismatch related changes: - Add SCC mismatch tests to Provider.spec.tsx (WorkspaceActions) - Add SCC mismatch tests to StartWorkspace index.spec.tsx - Add currentScc parameter tests to devWorkspaceClient.spec.ts - Create Header test file with containerScc prop tests Assisted-by: Claude Signed-off-by: Oleksii Orel <[email protected]>

github-actions · 2026-01-07T19:25:22Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1436

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1436", name: che-dashboard}]}}]"

openshift-ci · 2026-01-08T10:43:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olexii4, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

olexii4 requested a review from tolusha December 31, 2025 03:31

olexii4 requested review from akurinnoy and ibuziuk as code owners December 31, 2025 03:31

olexii4 force-pushed the CHE-23636 branch 6 times, most recently from 3a6a875 to e893a6c Compare January 1, 2026 00:03

olexii4 force-pushed the CHE-23636 branch from e893a6c to c2ed092 Compare January 1, 2026 18:35

olexii4 force-pushed the CHE-23636 branch from c2ed092 to 6a85ac5 Compare January 1, 2026 22:35

olexii4 force-pushed the CHE-23636 branch from 6a85ac5 to 4ce76ce Compare January 1, 2026 23:00

olexii4 force-pushed the CHE-23636 branch from 4ce76ce to 3af51ad Compare January 2, 2026 01:10

olexii4 force-pushed the CHE-23636 branch 2 times, most recently from 23c92a8 to 59afc95 Compare January 2, 2026 01:53

olexii4 changed the title ~~Che 23636~~ Detect and prevent starting DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard Jan 2, 2026

svor self-requested a review January 5, 2026 15:30

olexii4 changed the title ~~Detect and prevent starting DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard~~ Detect and warn about DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard Jan 5, 2026

olexii4 force-pushed the CHE-23636 branch from fd768d6 to beb3e2c Compare January 6, 2026 15:59

olexii4 force-pushed the CHE-23636 branch from beb3e2c to 8a377c6 Compare January 7, 2026 02:06

olexii4 force-pushed the CHE-23636 branch 2 times, most recently from f65f966 to 62c26b2 Compare January 7, 2026 02:25

olexii4 force-pushed the CHE-23636 branch from 62c26b2 to edaf631 Compare January 7, 2026 02:36

olexii4 force-pushed the CHE-23636 branch from edaf631 to a24f27f Compare January 7, 2026 02:42

olexii4 force-pushed the CHE-23636 branch from a24f27f to 5e502eb Compare January 7, 2026 02:58

fix: simplify SCC mismatch detection rules

381c3b0

Remove the early return when currentScc is undefined. This ensures SCC mismatch is detected when workspace has a containerScc value but server has no SCC requirement (currentScc is undefined). Signed-off-by: Oleksii Orel <[email protected]>

tolusha approved these changes Jan 8, 2026

View reviewed changes

openshift-ci bot assigned tolusha Jan 8, 2026

openshift-ci bot added the lgtm label Jan 8, 2026

svor requested a review from artaleks9 January 8, 2026 15:09

eclipse-che deleted a comment from codecov bot Jan 9, 2026

Detect and warn about DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard #1436

Are you sure you want to change the base?

Detect and warn about DevWorkspaces with SCC (Security Context Constraint) mismatches in the Eclipse Che Dashboard #1436

Uh oh!

Conversation

olexii4 commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Key Changes:

Behavior:

Screenshot/screencast of this PR

What issues does this PR fix or reference?

Is it tested? How?

Deploy Eclipse-Che with the image from this PR.

Test SCC Mismatch Detection:

Deploy Eclipse-Che with the image from this PR.:

Test containerScc undefined scenario:

Test no server SCC requirement:

Test matching SCC:

Release Notes

Docs PR

Uh oh!

che-bot commented Dec 31, 2025

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 2, 2026

Uh oh!

github-actions bot commented Jan 2, 2026

Uh oh!

github-actions bot commented Jan 2, 2026

Uh oh!

tolusha commented Jan 5, 2026

Uh oh!

olexii4 commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 6, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

openshift-ci bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

olexii4 commented Dec 31, 2025 •

edited

Loading