Skip to content

Commit f1d91dc

Browse files
tolushatolusha
authored
chore: Allow external TLS configuration for ingress/routes (#2025)
* chore: Allow external TLS configuration for ingress/routes Signed-off-by: Anatolii Bazko <[email protected]>
1 parent 0238201 commit f1d91dc

File tree

16 files changed

+596
-107
lines changed

16 files changed

+596
-107
lines changed

‎api/v2/checluster_types.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,9 @@ type CheClusterDevEnvironments struct {
220220
// AllowedSources defines the allowed sources on which workspaces can be started.
221221
// +optional
222222
AllowedSources *AllowedSources `json:"allowedSources,omitempty"`
223+
// Configuration settings related to the workspaces networking.
224+
// +optional
225+
Networking *DevEnvironmentNetworking `json:"networking,omitempty"`
223226
}
224227

225228
// Che components configuration.
@@ -288,6 +291,26 @@ type CheClusterSpecNetworking struct {
288291
Auth Auth `json:"auth"`
289292
}
290293

294+
type DevEnvironmentNetworking struct {
295+
// External TLS configuration.
296+
// +optional
297+
ExternalTLSConfig *ExternalTLSConfig `json:"externalTLSConfig,omitempty"`
298+
}
299+
300+
type ExternalTLSConfig struct {
301+
// Enabled determines whether external TLS configuration is used.
302+
// If set to true, the operator will not set TLS config for ingress/route objects.
303+
// Instead, it ensures that any custom TLS configuration will not be reverted on synchronization.
304+
// +optional
305+
Enabled *bool `json:"enabled"`
306+
// Labels to be applied to ingress/route objects when external TLS is enabled.
307+
// +optional
308+
Labels map[string]string `json:"labels,omitempty"`
309+
// Annotations to be applied to ingress/route objects when external TLS is enabled.
310+
// +optional
311+
Annotations map[string]string `json:"annotations,omitempty"`
312+
}
313+
291314
// Container registry configuration.
292315
// +k8s:openapi-gen=true
293316
type CheClusterContainerRegistry struct {
@@ -1089,3 +1112,9 @@ func (c *CheCluster) IsDisableWorkspaceCaBundleMount() bool {
10891112
c.Spec.DevEnvironments.TrustedCerts.DisableWorkspaceCaBundleMount != nil &&
10901113
*c.Spec.DevEnvironments.TrustedCerts.DisableWorkspaceCaBundleMount
10911114
}
1115+
1116+
func (c *CheCluster) IsDevEnvironmentExternalTLSConfigEnabled() bool {
1117+
return c.Spec.DevEnvironments.Networking != nil &&
1118+
c.Spec.DevEnvironments.Networking.ExternalTLSConfig != nil &&
1119+
*c.Spec.DevEnvironments.Networking.ExternalTLSConfig.Enabled
1120+
}

‎api/v2/zz_generated.deepcopy.go‎

Lines changed: 59 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ metadata:
8686
categories: Developer Tools
8787
certified: "false"
8888
containerImage: quay.io/eclipse/che-operator:next
89-
createdAt: "2025-08-12T12:15:28Z"
89+
createdAt: "2025-08-13T09:20:10Z"
9090
description: A Kube-native development solution that delivers portable and collaborative
9191
developer workspaces.
9292
features.operators.openshift.io/cnf: "false"
@@ -108,7 +108,7 @@ metadata:
108108
operatorframework.io/arch.amd64: supported
109109
operatorframework.io/arch.arm64: supported
110110
operatorframework.io/os.linux: supported
111-
name: eclipse-che.v7.108.0-937.next
111+
name: eclipse-che.v7.108.0-939.next
112112
namespace: placeholder
113113
spec:
114114
apiservicedefinitions: {}
@@ -1141,7 +1141,7 @@ spec:
11411141
name: gateway-authorization-sidecar-k8s
11421142
- image: quay.io/che-incubator/header-rewrite-proxy:latest
11431143
name: gateway-header-sidecar
1144-
version: 7.108.0-937.next
1144+
version: 7.108.0-939.next
11451145
webhookdefinitions:
11461146
- admissionReviewVersions:
11471147
- v1

‎bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7134,6 +7134,33 @@ spec:
71347134
format: int64
71357135
minimum: -1
71367136
type: integer
7137+
networking:
7138+
description: Configuration settings related to the workspaces
7139+
networking.
7140+
properties:
7141+
externalTLSConfig:
7142+
description: External TLS configuration.
7143+
properties:
7144+
annotations:
7145+
additionalProperties:
7146+
type: string
7147+
description: Annotations to be applied to ingress/route
7148+
objects when external TLS is enabled.
7149+
type: object
7150+
enabled:
7151+
description: |-
7152+
Enabled determines whether external TLS configuration is used.
7153+
If set to true, the operator will not set TLS config for ingress/route objects.
7154+
Instead, it ensures that any custom TLS configuration will not be reverted on synchronization.
7155+
type: boolean
7156+
labels:
7157+
additionalProperties:
7158+
type: string
7159+
description: Labels to be applied to ingress/route objects
7160+
when external TLS is enabled.
7161+
type: object
7162+
type: object
7163+
type: object
71377164
nodeSelector:
71387165
additionalProperties:
71397166
type: string

‎config/crd/bases/org.eclipse.che_checlusters.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7087,6 +7087,33 @@ spec:
70877087
format: int64
70887088
minimum: -1
70897089
type: integer
7090+
networking:
7091+
description: Configuration settings related to the workspaces
7092+
networking.
7093+
properties:
7094+
externalTLSConfig:
7095+
description: External TLS configuration.
7096+
properties:
7097+
annotations:
7098+
additionalProperties:
7099+
type: string
7100+
description: Annotations to be applied to ingress/route
7101+
objects when external TLS is enabled.
7102+
type: object
7103+
enabled:
7104+
description: |-
7105+
Enabled determines whether external TLS configuration is used.
7106+
If set to true, the operator will not set TLS config for ingress/route objects.
7107+
Instead, it ensures that any custom TLS configuration will not be reverted on synchronization.
7108+
type: boolean
7109+
labels:
7110+
additionalProperties:
7111+
type: string
7112+
description: Labels to be applied to ingress/route objects
7113+
when external TLS is enabled.
7114+
type: object
7115+
type: object
7116+
type: object
70907117
nodeSelector:
70917118
additionalProperties:
70927119
type: string

‎controllers/devworkspace/defaults/defaults.go‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ package defaults
1515
import (
1616
chev2 "github.com/eclipse-che/che-operator/api/v2"
1717
"github.com/eclipse-che/che-operator/pkg/common/constants"
18-
"github.com/eclipse-che/che-operator/pkg/deploy"
19-
ctrl "sigs.k8s.io/controller-runtime"
2018
)
2119

2220
const (
@@ -30,8 +28,6 @@ const (
3028
)
3129

3230
var (
33-
log = ctrl.Log.WithName("defaults")
34-
3531
// If this looks weirdly out of place to you from all other labels, then you're completely right!
3632
// These labels are the default ones used by che-operator and Che7. Let's keep the defaults
3733
// the same for the ease of translation...
@@ -64,13 +60,6 @@ func AddStandardLabelsFromNames(appName string, component string, labels map[str
6460
return labels
6561
}
6662

67-
func GetIngressAnnotations(cluster *chev2.CheCluster) map[string]string {
68-
if len(cluster.Spec.Networking.Annotations) > 0 {
69-
return cluster.Spec.Networking.Annotations
70-
}
71-
return deploy.DefaultIngressAnnotations
72-
}
73-
7463
func GetGatewayWorkspaceConfigMapLabels(cluster *chev2.CheCluster) map[string]string {
7564
if len(cluster.Spec.Networking.Auth.Gateway.ConfigLabels) > 0 {
7665
return cluster.Spec.Networking.Auth.Gateway.ConfigLabels

‎controllers/devworkspace/solver/che_routing.go‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
//
2-
// Copyright (c) 2019-2023 Red Hat, Inc.
2+
// Copyright (c) 2019-2025 Red Hat, Inc.
33
// This program and the accompanying materials are made
44
// available under the terms of the Eclipse Public License 2.0
55
// which is available at https://www.eclipse.org/legal/epl-2.0/
@@ -444,29 +444,33 @@ func normalize(username string) string {
444444
return strings.ToLower(result)
445445
}
446446

447-
func (c *CheRoutingSolver) getInfraSpecificExposer(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceRouting, objs *solvers.RoutingObjects, endpointStrategy EndpointStrategy) (func(info *EndpointInfo), error) {
447+
func (c *CheRoutingSolver) getInfraSpecificExposer(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceRouting, objs *solvers.RoutingObjects, endpointStrategy EndpointStrategy) (func(info *EndpointInfo) error, error) {
448448
if infrastructure.IsOpenShift() {
449449
exposer := &RouteExposer{}
450450
if err := exposer.initFrom(context.TODO(), c.client, cheCluster, routing); err != nil {
451451
return nil, err
452452
}
453-
return func(info *EndpointInfo) {
454-
route := exposer.getRouteForService(info, endpointStrategy)
455-
objs.Routes = append(objs.Routes, route)
453+
return func(info *EndpointInfo) error {
454+
route, err := exposer.getRouteForService(context.TODO(), info, endpointStrategy, c.client, cheCluster)
455+
if route != nil {
456+
objs.Routes = append(objs.Routes, *route)
457+
}
458+
return err
456459
}, nil
457460
} else {
458461
exposer := &IngressExposer{}
459-
if err := exposer.initFrom(context.TODO(), c.client, cheCluster, routing, dwdefaults.GetIngressAnnotations(cheCluster)); err != nil {
462+
if err := exposer.initFrom(context.TODO(), c.client, cheCluster, routing); err != nil {
460463
return nil, err
461464
}
462-
return func(info *EndpointInfo) {
463-
ingress := exposer.getIngressForService(info, endpointStrategy)
465+
return func(info *EndpointInfo) error {
466+
ingress := exposer.getIngressForService(info, endpointStrategy, cheCluster)
464467
objs.Ingresses = append(objs.Ingresses, ingress)
468+
return nil
465469
}, nil
466470
}
467471
}
468472

469-
func exposeAllEndpoints(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceRouting, objs *solvers.RoutingObjects, ingressExpose func(*EndpointInfo), endpointStrategy EndpointStrategy) (*corev1.ConfigMap, error) {
473+
func exposeAllEndpoints(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceRouting, objs *solvers.RoutingObjects, ingressExpose func(*EndpointInfo) error, endpointStrategy EndpointStrategy) (*corev1.ConfigMap, error) {
470474
wsRouteConfig := gateway.CreateEmptyTraefikConfig()
471475

472476
commonService := getCommonService(objs, routing.Spec.DevWorkspaceId)
@@ -503,7 +507,7 @@ func exposeAllEndpoints(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceR
503507
if err != nil {
504508
return nil, err
505509
}
506-
ingressExpose(&EndpointInfo{
510+
err = ingressExpose(&EndpointInfo{
507511
order: order,
508512
componentName: componentName,
509513
endpointName: e.Name,
@@ -512,6 +516,9 @@ func exposeAllEndpoints(cheCluster *chev2.CheCluster, routing *dwo.DevWorkspaceR
512516
service: service,
513517
annotations: e.Annotations,
514518
})
519+
if err != nil {
520+
return nil, err
521+
}
515522
order = order + 1
516523
}
517524
}

0 commit comments

Comments
 (0)