diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 64a0a4e3d1..972daa595f 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -25,23 +25,15 @@ che-operator Development Guide: https://github.com/eclipse-che/che-operator/#dev #### OpenShift ```bash -./build/scripts/olm/test-catalog-from-sources.sh -``` - -or +oc create namespace devworkspace-controller +oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml -```bash -build/scripts/docker-run.sh /bin/bash -c " - oc login \ - --token=<...> \ - --server=<...> \ - --insecure-skip-tls-verify=true && \ - build/scripts/olm/test-catalog-from-sources.sh -" +OPERATOR_IMAGE=<...> +sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f - +oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml +oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active --timeout=120s ``` -2. - #### on Minikube ```bash diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 51ae271514..3c416697c6 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -12,6 +12,8 @@ name: PR check on: pull_request +permissions: + contents: read jobs: unit-tests: runs-on: ubuntu-24.04 @@ -24,24 +26,6 @@ jobs: go-version: 1.26.5 - name: Run unit tests run: make test - multiplatform-image-build: - strategy: - fail-fast: false - matrix: - runners: ['ubuntu-24.04', 'ubuntu-24.04-arm'] - runs-on: ${{matrix.runners}} - steps: - - name: Checkout source code - uses: actions/checkout@v4 - - name: Set arch environment variable - run: | - if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then - echo arch="amd64" >> $GITHUB_ENV - else - echo arch="arm64" >> $GITHUB_ENV - fi - - name: Build image - run: docker buildx build --platform linux/${{env.arch}} . source-code-validation: runs-on: ubuntu-24.04 steps: diff --git a/.github/workflows/pr-image-build.yml b/.github/workflows/pr-image-build.yml new file mode 100644 index 0000000000..4155cac848 --- /dev/null +++ b/.github/workflows/pr-image-build.yml @@ -0,0 +1,88 @@ +# +# Copyright (c) 2019-2026 Red Hat, Inc. +# This program and the accompanying materials are made +# available under the terms of the Eclipse Public License 2.0 +# which is available at https://www.eclipse.org/legal/epl-2.0/ +# +# SPDX-License-Identifier: EPL-2.0 +# +# Contributors: +# Red Hat, Inc. - initial API and implementation +# + +name: PR Image Build +on: pull_request +permissions: + contents: read + pull-requests: write +jobs: + image-build-amd64: + runs-on: ubuntu-24.04 + if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push amd64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); + image-build-arm64: + runs-on: ubuntu-24.04-arm + if: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-arm64 + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push arm64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/arm64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); diff --git a/Makefile b/Makefile index 04f0d95de6..52587be8ac 100644 --- a/Makefile +++ b/Makefile @@ -21,12 +21,14 @@ else K8S_CLI := oc endif -# Detect image tool +# Detect image tool: prefer docker, fall back to podman ifeq ($(IMAGE_TOOL),) -ifneq (,$(shell which docker)) +ifneq (,$(shell command -v docker 2>/dev/null)) IMAGE_TOOL := docker -else +else ifneq (,$(shell command -v podman 2>/dev/null)) IMAGE_TOOL := podman +else + $(warning Neither docker nor podman found in PATH; set IMAGE_TOOL= to run image-related targets) endif endif diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index 6777dd070f..b95ae1e2ff 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-08-19T17:44:00Z" + createdAt: "2026-08-24T13:35:51Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.122.0-1058.next + name: eclipse-che.v7.122.0-1062.next namespace: placeholder spec: apiservicedefinitions: {} @@ -1173,7 +1173,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.122.0-1058.next + version: 7.122.0-1062.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/config/kubernetes/kustomization.yaml b/config/kubernetes/kustomization.yaml index 7017a6f0d1..e2e101e311 100644 --- a/config/kubernetes/kustomization.yaml +++ b/config/kubernetes/kustomization.yaml @@ -22,7 +22,7 @@ resources: patchesStrategicMerge: - patches/cainjection_in_checlusters.yaml - patches/cainjection_in_webhook.yaml - - patches/service_cert_patch.yaml + - patches/deployment_cert_patch.yaml - patches/manager_pod_security_context.yaml vars: diff --git a/config/kubernetes/patches/service_cert_patch.yaml b/config/kubernetes/patches/deployment_cert_patch.yaml similarity index 100% rename from config/kubernetes/patches/service_cert_patch.yaml rename to config/kubernetes/patches/deployment_cert_patch.yaml diff --git a/config/openshift/kustomization.yaml b/config/openshift/kustomization.yaml index 87fe039c77..2afec5b553 100644 --- a/config/openshift/kustomization.yaml +++ b/config/openshift/kustomization.yaml @@ -20,4 +20,5 @@ resources: patchesStrategicMerge: - patches/cainjection_in_checlusters.yaml - patches/cainjection_in_webhook.yaml + - patches/deployment_cert_patch.yaml - patches/service_cert_patch.yaml \ No newline at end of file diff --git a/config/openshift/patches/deployment_cert_patch.yaml b/config/openshift/patches/deployment_cert_patch.yaml new file mode 100644 index 0000000000..3c9d0d0ab9 --- /dev/null +++ b/config/openshift/patches/deployment_cert_patch.yaml @@ -0,0 +1,31 @@ +# +# Copyright (c) 2019-2026 Red Hat, Inc. +# This program and the accompanying materials are made +# available under the terms of the Eclipse Public License 2.0 +# which is available at https://www.eclipse.org/legal/epl-2.0/ +# +# SPDX-License-Identifier: EPL-2.0 +# +# Contributors: +# Red Hat, Inc. - initial API and implementation +# + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: che-operator + namespace: eclipse-che +spec: + template: + spec: + containers: + - name: che-operator + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert diff --git a/deploy/deployment/openshift/combined.yaml b/deploy/deployment/openshift/combined.yaml index ae765fc941..247ebb5308 100644 --- a/deploy/deployment/openshift/combined.yaml +++ b/deploy/deployment/openshift/combined.yaml @@ -29044,12 +29044,21 @@ spec: - ALL privileged: false readOnlyRootFilesystem: false + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true hostIPC: false hostNetwork: false hostPID: false restartPolicy: Always serviceAccountName: che-operator terminationGracePeriodSeconds: 20 + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert --- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration diff --git a/deploy/deployment/openshift/objects/che-operator.Deployment.yaml b/deploy/deployment/openshift/objects/che-operator.Deployment.yaml index c69c2cf14b..808c1370d1 100644 --- a/deploy/deployment/openshift/objects/che-operator.Deployment.yaml +++ b/deploy/deployment/openshift/objects/che-operator.Deployment.yaml @@ -151,9 +151,18 @@ spec: - ALL privileged: false readOnlyRootFilesystem: false + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true hostIPC: false hostNetwork: false hostPID: false restartPolicy: Always serviceAccountName: che-operator terminationGracePeriodSeconds: 20 + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert