Skip to content

Commit fbfd367

Browse files
tolushadeerskindoll
tolusha
and
deerskindoll
authored
feat: configuring a user namespace (#2674)
* feat: configuring a user namespace Signed-off-by: Anatolii Bazko <abazko@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc * Improvements Signed-off-by: Anatolii Bazko <abazko@redhat.com> * fixups Signed-off-by: Anatolii Bazko <abazko@redhat.com> * fixups Signed-off-by: Anatolii Bazko <abazko@redhat.com> --------- Signed-off-by: Anatolii Bazko <abazko@redhat.com> Co-authored-by: Jana Vrbkova <jvrbkova@redhat.com>
1 parent de00aae commit fbfd367

File tree

2 files changed

+183
-0
lines changed

2 files changed

+183
-0
lines changed

‎modules/administration-guide/nav.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
*** xref:deploying-che-with-support-for-git-repositories-with-self-signed-certificates.adoc[]
4343
*** xref:configuring-workspaces-nodeselector.adoc[]
4444
*** xref:configuring-the-open-vsx-registry-url.adoc[]
45+
*** xref:configuring-a-user-namespace.adoc[]
4546
** xref:caching-images-for-faster-workspace-start.adoc[]
4647
*** xref:defining-the-list-of-images-to-pull.adoc[]
4748
*** xref:defining-the-memory-parameters-for-the-image-puller.adoc[]

‎modules/administration-guide/pages/configuring-a-user-namespace.adoc

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
:_content-type: PROCEDURE
2+
:description: Configuring a user namespace
3+
:keywords: administration guide, configuring, user, namespace
4+
:navtitle: Configuring a user namespace
5+
:page-aliases:
6+
7+
[id="configuring-a-user-namespace"]
8+
= Configuring a user namespace
9+
10+
This procedure walks you through the process of using {prod-short}
11+
to replicate `ConfigMaps`, `Secrets` and `PersistentVolumeClaim` from `{prod-namespace}` namespace to numerous
12+
user-specific namespaces. The {prod-short} automates the synchronization of important configuration
13+
data such as passwords, SSH keys, and certificates to user namespaces.
14+
15+
If you make changes to a {kubernetes} resource in an {prod-namespace} namespace,
16+
{prod-short} will immediately replicate the changes across all users namespaces.
17+
In reverse, if a {kubernetes} resource is modified in a user namespace,
18+
{prod-short} will immediately revert the changes.
19+
20+
.Procedure
21+
22+
. Create the `ConfigMap` below to replicate it to every user namespace.
23+
To enhance the configurability, you can customize the `ConfigMap` by adding additional labels and annotations.
24+
See the link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
25+
for other possible labels and annotations.
26+
+
27+
[source,yaml,subs="+attributes,+quotes"]
28+
----
29+
kind: ConfigMap
30+
apiVersion: v1
31+
metadata:
32+
name: user-configmap
33+
namespace: {prod-namespace}
34+
labels:
35+
app.kubernetes.io/part-of: che.eclipse.org
36+
app.kubernetes.io/component: workspaces-config
37+
data:
38+
...
39+
----
40+
+
41+
.Mounting a `settings.xml` file to a user workspace:
42+
====
43+
[source,yaml,subs="+attributes,+quotes"]
44+
----
45+
kind: ConfigMap
46+
apiVersion: v1
47+
metadata:
48+
name: user-settings-xml
49+
namespace: {prod-namespace}
50+
labels:
51+
app.kubernetes.io/part-of: che.eclipse.org
52+
app.kubernetes.io/component: workspaces-config
53+
annotations:
54+
controller.devfile.io/mount-as: subpath
55+
controller.devfile.io/mount-path: /home/user/.m2
56+
data:
57+
settings.xml: |
58+
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
59+
<localRepository>/home/user/.m2/repository</localRepository>
60+
<interactiveMode>true</interactiveMode>
61+
<offline>false</offline>
62+
</settings>
63+
----
64+
====
65+
66+
. Create the `Secret` below to replicate it to every user namespace.
67+
To enhance the configurability, you can customize the `Secret` by adding additional labels and annotations.
68+
See the link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
69+
for other possible labels and annotations.
70+
+
71+
[source,yaml,subs="+attributes,+quotes"]
72+
----
73+
kind: Secret
74+
apiVersion: v1
75+
metadata:
76+
name: user-secret
77+
namespace: {prod-namespace}
78+
labels:
79+
app.kubernetes.io/part-of: che.eclipse.org
80+
app.kubernetes.io/component: workspaces-config
81+
data:
82+
...
83+
----
84+
+
85+
.Mounting certificates to a user workspace:
86+
====
87+
[source,yaml,subs="+attributes,+quotes"]
88+
----
89+
kind: Secret
90+
apiVersion: v1
91+
metadata:
92+
name: user-certificates
93+
namespace: {prod-namespace}
94+
labels:
95+
app.kubernetes.io/part-of: che.eclipse.org
96+
app.kubernetes.io/component: workspaces-config
97+
annotations:
98+
controller.devfile.io/mount-as: subpath
99+
controller.devfile.io/mount-path: /etc/pki/ca-trust/source/anchors
100+
stringData:
101+
trusted-certificates.crt: |
102+
...
103+
----
104+
NOTE: Run `update-ca-trust` command on workspace startup to import certificates.
105+
It can be achieved manually or by adding this command to a `postStart` event in a devfile.
106+
See the link:https://devfile.io/docs/2.2.2/adding-event-bindings#post-start-object[Adding event bindings in a devfile].
107+
====
108+
+
109+
.Mounting environment variables to a user workspace:
110+
====
111+
[source,yaml,subs="+attributes,+quotes"]
112+
----
113+
kind: Secret
114+
apiVersion: v1
115+
metadata:
116+
name: user-env
117+
namespace: {prod-namespace}
118+
labels:
119+
app.kubernetes.io/part-of: che.eclipse.org
120+
app.kubernetes.io/component: workspaces-config
121+
annotations:
122+
controller.devfile.io/mount-as: env
123+
stringData:
124+
ENV_VAR_1: value_1
125+
ENV_VAR_2: value_2
126+
----
127+
====
128+
129+
. Create the `PersistentVolumeClaim` below to replicate it to every user namespace.
130+
+
131+
To enhance the configurability, you can customize the `PersistentVolumeClaim` by adding additional labels and annotations.
132+
See the link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
133+
for other possible labels and annotations.
134+
+
135+
To modify the 'PersistentVolumeClaim', delete it and create a new one in {prod-namespace} namespace.
136+
+
137+
[source,yaml,subs="+attributes,+quotes"]
138+
----
139+
apiVersion: v1
140+
kind: PersistentVolumeClaim
141+
metadata:
142+
name: user-pvc
143+
namespace: {prod-namespace}
144+
labels:
145+
app.kubernetes.io/part-of: che.eclipse.org
146+
app.kubernetes.io/component: workspaces-config
147+
spec:
148+
...
149+
----
150+
+
151+
.Mounting a `PersistentVolumeClaim` to a user workspace:
152+
====
153+
[source,yaml,subs="+attributes,+quotes"]
154+
----
155+
apiVersion: v1
156+
kind: PersistentVolumeClaim
157+
metadata:
158+
name: user-pvc
159+
namespace: {prod-namespace}
160+
labels:
161+
app.kubernetes.io/part-of: che.eclipse.org
162+
app.kubernetes.io/component: workspaces-config
163+
controller.devfile.io/mount-to-devworkspace: 'true'
164+
annotations:
165+
controller.devfile.io/mount-path: /home/user/data
166+
controller.devfile.io/read-only: 'true'
167+
spec:
168+
accessModes:
169+
- ReadWriteOnce
170+
resources:
171+
requests:
172+
storage: 5Gi
173+
volumeMode: Filesystem
174+
----
175+
====
176+
177+
.Additional resources
178+
* xref:end-user-guide:mounting-configmaps.adoc[]
179+
* xref:end-user-guide:mounting-secrets.adoc[]
180+
* xref:end-user-guide:requesting-persistent-storage-for-workspaces.adoc[]
181+
* link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
182+

0 commit comments

Comments
 (0)