Skip to content

Commit 7437917

Browse files
tolushathemr0c
tolusha
and
themr0c
authored
fix: Update article to configure a user namespace (#2807)
* fix: Update article to configure a user namespace Signed-off-by: Anatolii Bazko <abazko@redhat.com> * fixup Signed-off-by: Anatolii Bazko <abazko@redhat.com> * fixup Signed-off-by: Anatolii Bazko <abazko@redhat.com> * Update modules/administration-guide/pages/configuring-a-user-namespace.adoc Co-authored-by: Fabrice Flore-Thébault <ffloreth@redhat.com> --------- Signed-off-by: Anatolii Bazko <abazko@redhat.com> Co-authored-by: Fabrice Flore-Thébault <ffloreth@redhat.com>
1 parent c851903 commit 7437917

File tree

3 files changed

+94
-13
lines changed

3 files changed

+94
-13
lines changed

‎modules/administration-guide/nav.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
** xref:configuring-namespace-provisioning.adoc[]
3838
*** xref:configuring-workspace-target-namespace.adoc[]
3939
*** xref:provisioning-namespaces-in-advance.adoc[]
40+
*** xref:configuring-a-user-namespace.adoc[]
4041
** xref:configuring-server-components.adoc[]
4142
*** xref:mounting-a-secret-as-a-file-or-an-environment-variable-into-a-container.adoc[]
4243
*** xref:advanced-configuration-options-for-the-che-server-component.adoc[]
@@ -50,7 +51,6 @@
5051
*** xref:deploying-che-with-support-for-git-repositories-with-self-signed-certificates.adoc[]
5152
*** xref:configuring-workspaces-nodeselector.adoc[]
5253
*** xref:configuring-the-open-vsx-registry-url.adoc[]
53-
*** xref:configuring-a-user-namespace.adoc[]
5454
*** xref:configuring-allowed-urls-for-cloud-development-environments.adoc[]
5555
** xref:caching-images-for-faster-workspace-start.adoc[]
5656
*** xref:installing-kubernetes-image-puller.adoc[]

‎modules/administration-guide/pages/configuring-a-user-namespace.adoc

Lines changed: 92 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@
88
= Configuring a user namespace
99

1010
This procedure walks you through the process of using {prod-short}
11-
to replicate `ConfigMaps`, `Secrets` and `PersistentVolumeClaim` from `{prod-namespace}` namespace to numerous
12-
user-specific namespaces. The {prod-short} automates the synchronization of important configuration
13-
data such as shared credentials, configuration files, and certificates to user namespaces.
11+
to replicate `ConfigMaps`, `Secrets`, `PersistentVolumeClaim` and other {kubernetes} objects from `{prod-namespace}` namespace to numerous user-specific namespaces. The {prod-short} automates the synchronization of important configuration data such as shared credentials, configuration files, and certificates to user namespaces.
1412

1513
If you make changes to a {kubernetes} resource in an {prod-namespace} namespace,
1614
{prod-short} will immediately replicate the changes across all users namespaces.
@@ -29,7 +27,7 @@ for other possible labels and annotations.
2927
kind: ConfigMap
3028
apiVersion: v1
3129
metadata:
32-
name: user-configmap
30+
name: {prod-id-short}-user-configmap
3331
namespace: {prod-namespace}
3432
labels:
3533
app.kubernetes.io/part-of: che.eclipse.org
@@ -45,7 +43,7 @@ data:
4543
kind: ConfigMap
4644
apiVersion: v1
4745
metadata:
48-
name: user-settings-xml
46+
name: {prod-id-short}-user-configmap
4947
namespace: {prod-namespace}
5048
labels:
5149
app.kubernetes.io/part-of: che.eclipse.org
@@ -73,7 +71,7 @@ for other possible labels and annotations.
7371
kind: Secret
7472
apiVersion: v1
7573
metadata:
76-
name: user-secret
74+
name: {prod-id-short}-user-secret
7775
namespace: {prod-namespace}
7876
labels:
7977
app.kubernetes.io/part-of: che.eclipse.org
@@ -89,7 +87,7 @@ data:
8987
kind: Secret
9088
apiVersion: v1
9189
metadata:
92-
name: user-certificates
90+
name: {prod-id-short}-user-secret
9391
namespace: {prod-namespace}
9492
labels:
9593
app.kubernetes.io/part-of: che.eclipse.org
@@ -113,7 +111,7 @@ See the link:https://devfile.io/docs/{devfile-api-version}/adding-event-bindings
113111
kind: Secret
114112
apiVersion: v1
115113
metadata:
116-
name: user-env
114+
name: {prod-id-short}-user-secret
117115
namespace: {prod-namespace}
118116
labels:
119117
app.kubernetes.io/part-of: che.eclipse.org
@@ -132,14 +130,14 @@ To enhance the configurability, you can customize the `PersistentVolumeClaim` by
132130
See the link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
133131
for other possible labels and annotations.
134132
+
135-
To modify the 'PersistentVolumeClaim', delete it and create a new one in {prod-namespace} namespace.
133+
To modify the `PersistentVolumeClaim`, delete it and create a new one in {prod-namespace} namespace.
136134
+
137135
[source,yaml,subs="+attributes,+quotes"]
138136
----
139137
apiVersion: v1
140138
kind: PersistentVolumeClaim
141139
metadata:
142-
name: user-pvc
140+
name: {prod-id-short}-user-pvc
143141
namespace: {prod-namespace}
144142
labels:
145143
app.kubernetes.io/part-of: che.eclipse.org
@@ -155,7 +153,7 @@ spec:
155153
apiVersion: v1
156154
kind: PersistentVolumeClaim
157155
metadata:
158-
name: user-pvc
156+
name: {prod-id-short}-user-pvc
159157
namespace: {prod-namespace}
160158
labels:
161159
app.kubernetes.io/part-of: che.eclipse.org
@@ -174,9 +172,91 @@ spec:
174172
----
175173
====
176174

175+
. To leverage the OpenShift Kubernetes Engine, you can create a `Template` object to replicate all resources defined within the template across each user {namespace}.
176+
+
177+
Aside from the previously mentioned `ConfigMap`, `Secret`, and `PersistentVolumeClaim`, `Template` objects can include:
178+
+
179+
* `LimitRange`
180+
* `NetworkPolicy`
181+
* `ResourceQuota`
182+
* `Role`
183+
* `RoleBinding`
184+
+
185+
[source,yaml,subs="+attributes,+quotes"]
186+
----
187+
apiVersion: template.openshift.io/v1
188+
kind: Template
189+
metadata:
190+
name: {prod-id-short}-user-namespace-configurator
191+
namespace: {prod-namespace}
192+
labels:
193+
app.kubernetes.io/part-of: che.eclipse.org
194+
app.kubernetes.io/component: workspaces-config
195+
objects:
196+
...
197+
parameters:
198+
- name: PROJECT_NAME
199+
- name: PROJECT_ADMIN_USER
200+
201+
----
202+
+
203+
The `parameters` are optional and define which parameters can be used. Currently, only `PROJECT_NAME` and `PROJECT_ADMIN_USER` are supported. `PROJECT_NAME` is the name of the {prod-short} {namespace}, while `PROJECT_ADMIN_USER` is the {prod-short} user of the {namespace}.
204+
+
205+
The {namespace} name in objects will be replaced with the user's {namespace} name during synchronization.
206+
+
207+
.Replicating {kubernetes} resources to a user namespace:
208+
====
209+
[source,yaml,subs="+attributes,+quotes"]
210+
----
211+
apiVersion: template.openshift.io/v1
212+
kind: Template
213+
metadata:
214+
name: {prod-id-short}-user-namespace-configurator
215+
namespace: {prod-namespace}
216+
labels:
217+
app.kubernetes.io/part-of: che.eclipse.org
218+
app.kubernetes.io/component: workspaces-config
219+
objects:
220+
- apiVersion: v1
221+
kind: ResourceQuota
222+
metadata:
223+
name: {prod-id-short}-user-resource-quota
224+
spec:
225+
...
226+
- apiVersion: v1
227+
kind: LimitRange
228+
metadata:
229+
name: {prod-id-short}-user-resource-constraint
230+
spec:
231+
...
232+
- apiVersion: rbac.authorization.k8s.io/v1
233+
kind: Role
234+
metadata:
235+
name: {prod-id-short}-user-roles
236+
rules:
237+
...
238+
- apiVersion: rbac.authorization.k8s.io/v1
239+
kind: RoleBinding
240+
metadata:
241+
name: {prod-id-short}-user-rolebinding
242+
roleRef:
243+
apiGroup: rbac.authorization.k8s.io
244+
kind: Role
245+
name: {prod-id-short}-user-roles
246+
subjects:
247+
- kind: User
248+
apiGroup: rbac.authorization.k8s.io
249+
name: $\{PROJECT_ADMIN_USER}
250+
parameters:
251+
- name: PROJECT_ADMIN_USER
252+
----
253+
NOTE: Creating Template Kubernetes resources is supported only on OpenShift.
254+
====
255+
177256
.Additional resources
178257
* xref:end-user-guide:mounting-configmaps.adoc[]
179258
* xref:end-user-guide:mounting-secrets.adoc[]
180259
* xref:end-user-guide:requesting-persistent-storage-for-workspaces.adoc[]
181260
* link:https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.adoc#automatically-mounting-volumes-configmaps-and-secrets[Automatically mounting volumes, configmaps, and secrets]
182-
261+
* link:https://docs.openshift.com/container-platform/latest/rest_api/template_apis/template-template-openshift-io-v1.html[OpenShift API reference for `Template`]
262+
* link:https://docs.openshift.com/container-platform/latest/applications/projects/configuring-project-creation.html[Configuring OpenShift project creation]

‎modules/administration-guide/pages/configuring-namespace-provisioning.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ You can modify {prod-short} behavior by:
1515

1616
* xref:configuring-workspace-target-namespace.adoc[]
1717
* xref:provisioning-namespaces-in-advance.adoc[]
18+
* xref:configuring-a-user-namespace.adoc[]

0 commit comments

Comments
 (0)