From b1083e52962f10cb2236a4d62ee236b8397752d7 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 13:59:50 +0200 Subject: [PATCH 1/7] ci: build and push operator image on PRs targeting main Add a docker-build job to the PR check workflow that builds a multi-arch operator image (linux/amd64, linux/arm64, linux/s390x), pushes it to quay.io/eclipse/che-operator:pr-, and comments on the PR with the image tag and a kubectl patch command. Assisted-by: Claude Sonnet 4.6 --- .github/workflows/pr-check.yml | 52 ++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 51ae27151..8ba40769a 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -124,3 +124,55 @@ jobs: - name: Check dependencies if: steps.go-mod-check.outputs.changed == 'true' run: build/scripts/clear-defined-test.sh + docker-build: + needs: unit-tests + runs-on: ubuntu-24.04 + if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }} + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + with: + platforms: linux/amd64,linux/arm64,linux/s390x + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push multi-arch image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64,linux/arm64,linux/s390x + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + const patchCommand = `kubectl set image deployment/che-operator che-operator="${operatorImage}" -n eclipse-che`; + const text = ` + Docker image **${operatorImage}** is available (linux/amd64, linux/arm64, linux/s390x) +
+ kubectl patch command + + \`\`\`bash + ${patchCommand} + \`\`\` + +
+ `; + github.rest.issues.createComment({ issue_number, owner, repo, body: text }); From 3cb31906640b81582183384420d1f35c6882ecb8 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 14:15:44 +0200 Subject: [PATCH 2/7] fixup Signed-off-by: Anatolii Bazko --- .github/workflows/pr-check.yml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 8ba40769a..3136fba8c 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -12,6 +12,8 @@ name: PR check on: pull_request +permissions: + contents: read jobs: unit-tests: runs-on: ubuntu-24.04 @@ -126,6 +128,9 @@ jobs: run: build/scripts/clear-defined-test.sh docker-build: needs: unit-tests + permissions: + contents: read + issues: write runs-on: ubuntu-24.04 if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} env: @@ -163,16 +168,4 @@ jobs: script: | const { issue: { number: issue_number }, repo: { owner, repo } } = context; const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; - const patchCommand = `kubectl set image deployment/che-operator che-operator="${operatorImage}" -n eclipse-che`; - const text = ` - Docker image **${operatorImage}** is available (linux/amd64, linux/arm64, linux/s390x) -
- kubectl patch command - - \`\`\`bash - ${patchCommand} - \`\`\` - -
- `; - github.rest.issues.createComment({ issue_number, owner, repo, body: text }); + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); From 8be233e90a24b6e2eaa32d0b84274c3a40fb479c Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 14:45:20 +0200 Subject: [PATCH 3/7] fixup Signed-off-by: Anatolii Bazko --- .github/workflows/pr-check.yml | 133 +++++++++++++++++++-------------- 1 file changed, 75 insertions(+), 58 deletions(-) diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 3136fba8c..9a9e85cbd 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -26,24 +26,84 @@ jobs: go-version: 1.26.5 - name: Run unit tests run: make test - multiplatform-image-build: - strategy: - fail-fast: false - matrix: - runners: ['ubuntu-24.04', 'ubuntu-24.04-arm'] - runs-on: ${{matrix.runners}} + image-build-amd64: + needs: unit-tests + permissions: + contents: read + issues: write + runs-on: ubuntu-24.04 + if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 + ORGANIZATION: quay.io/eclipse steps: - name: Checkout source code uses: actions/checkout@v4 - - name: Set arch environment variable - run: | - if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then - echo arch="amd64" >> $GITHUB_ENV - else - echo arch="arm64" >> $GITHUB_ENV - fi - - name: Build image - run: docker buildx build --platform linux/${{env.arch}} . + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push amd64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); + image-build-arm64: + needs: unit-tests + permissions: + contents: read + issues: write + runs-on: ubuntu-24.04-arm + if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-arm64 + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push arm64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/arm64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); source-code-validation: runs-on: ubuntu-24.04 steps: @@ -126,46 +186,3 @@ jobs: - name: Check dependencies if: steps.go-mod-check.outputs.changed == 'true' run: build/scripts/clear-defined-test.sh - docker-build: - needs: unit-tests - permissions: - contents: read - issues: write - runs-on: ubuntu-24.04 - if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} - env: - IMAGE_VERSION: pr-${{ github.event.pull_request.number }} - ORGANIZATION: quay.io/eclipse - steps: - - name: Checkout source code - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - with: - platforms: linux/amd64,linux/arm64,linux/s390x - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} - - name: Build and push multi-arch image - uses: docker/build-push-action@v6 - with: - context: . - file: ./Dockerfile - platforms: linux/amd64,linux/arm64,linux/s390x - push: true - provenance: false - tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} - - name: Comment with image name - uses: actions/github-script@v7 - with: - script: | - const { issue: { number: issue_number }, repo: { owner, repo } } = context; - const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; - github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); From 83ac458c2c924d457c8ffd8fa3f6927ecc8ae4b8 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 14:53:46 +0200 Subject: [PATCH 4/7] fixup Signed-off-by: Anatolii Bazko --- .github/workflows/pr-check.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 9a9e85cbd..b87049097 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -60,6 +60,8 @@ jobs: tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} - name: Comment with image name uses: actions/github-script@v7 + env: + "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}" with: script: | const { issue: { number: issue_number }, repo: { owner, repo } } = context; @@ -99,6 +101,8 @@ jobs: tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} - name: Comment with image name uses: actions/github-script@v7 + env: + "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}" with: script: | const { issue: { number: issue_number }, repo: { owner, repo } } = context; From 72be2317ee05f8f4fee9c300a1da6d7e0a196eb2 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 16:30:06 +0200 Subject: [PATCH 5/7] fixup Signed-off-by: Anatolii Bazko --- .github/PULL_REQUEST_TEMPLATE.md | 20 ++--- .github/workflows/pr-check.yml | 82 ----------------- .github/workflows/pr-image-build.yml | 88 +++++++++++++++++++ Makefile | 8 +- .../che-operator.clusterserviceversion.yaml | 6 +- config/kubernetes/kustomization.yaml | 2 +- ..._patch.yaml => deployment_cert_patch.yaml} | 0 config/openshift/kustomization.yaml | 1 + .../patches/deployment_cert_patch.yaml | 31 +++++++ deploy/deployment/openshift/combined.yaml | 9 ++ .../objects/che-operator.Deployment.yaml | 9 ++ 11 files changed, 153 insertions(+), 103 deletions(-) create mode 100644 .github/workflows/pr-image-build.yml rename config/kubernetes/patches/{service_cert_patch.yaml => deployment_cert_patch.yaml} (100%) create mode 100644 config/openshift/patches/deployment_cert_patch.yaml diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 64a0a4e3d..972daa595 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -25,23 +25,15 @@ che-operator Development Guide: https://github.com/eclipse-che/che-operator/#dev #### OpenShift ```bash -./build/scripts/olm/test-catalog-from-sources.sh -``` - -or +oc create namespace devworkspace-controller +oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml -```bash -build/scripts/docker-run.sh /bin/bash -c " - oc login \ - --token=<...> \ - --server=<...> \ - --insecure-skip-tls-verify=true && \ - build/scripts/olm/test-catalog-from-sources.sh -" +OPERATOR_IMAGE=<...> +sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f - +oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml +oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active --timeout=120s ``` -2. - #### on Minikube ```bash diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index b87049097..3c416697c 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -26,88 +26,6 @@ jobs: go-version: 1.26.5 - name: Run unit tests run: make test - image-build-amd64: - needs: unit-tests - permissions: - contents: read - issues: write - runs-on: ubuntu-24.04 - if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} - env: - IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 - ORGANIZATION: quay.io/eclipse - steps: - - name: Checkout source code - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} - - name: Build and push amd64 image - uses: docker/build-push-action@v6 - with: - context: . - file: ./Dockerfile - platforms: linux/amd64 - push: true - provenance: false - tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} - - name: Comment with image name - uses: actions/github-script@v7 - env: - "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}" - with: - script: | - const { issue: { number: issue_number }, repo: { owner, repo } } = context; - const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; - github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); - image-build-arm64: - needs: unit-tests - permissions: - contents: read - issues: write - runs-on: ubuntu-24.04-arm - if: ${{ github.base_ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} - env: - IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-arm64 - ORGANIZATION: quay.io/eclipse - steps: - - name: Checkout source code - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} - - name: Build and push arm64 image - uses: docker/build-push-action@v6 - with: - context: . - file: ./Dockerfile - platforms: linux/arm64 - push: true - provenance: false - tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} - - name: Comment with image name - uses: actions/github-script@v7 - env: - "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}" - with: - script: | - const { issue: { number: issue_number }, repo: { owner, repo } } = context; - const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; - github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); source-code-validation: runs-on: ubuntu-24.04 steps: diff --git a/.github/workflows/pr-image-build.yml b/.github/workflows/pr-image-build.yml new file mode 100644 index 000000000..1a38e6b72 --- /dev/null +++ b/.github/workflows/pr-image-build.yml @@ -0,0 +1,88 @@ +# +# Copyright (c) 2019-2026 Red Hat, Inc. +# This program and the accompanying materials are made +# available under the terms of the Eclipse Public License 2.0 +# which is available at https://www.eclipse.org/legal/epl-2.0/ +# +# SPDX-License-Identifier: EPL-2.0 +# +# Contributors: +# Red Hat, Inc. - initial API and implementation +# + +name: PR Image Build +on: pull_request +permissions: + contents: read + pull-requests: write +jobs: + image-build-amd64: + runs-on: ubuntu-24.04 + if: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push amd64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); + image-build-arm64: + runs-on: ubuntu-24.04-arm + if: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} + env: + IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-arm64 + ORGANIZATION: quay.io/eclipse + steps: + - name: Checkout source code + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + - name: Build and push arm64 image + uses: docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/arm64 + push: true + provenance: false + tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }} + - name: Comment with image name + uses: actions/github-script@v7 + with: + script: | + const { issue: { number: issue_number }, repo: { owner, repo } } = context; + const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}"; + github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` }); diff --git a/Makefile b/Makefile index 04f0d95de..52587be8a 100644 --- a/Makefile +++ b/Makefile @@ -21,12 +21,14 @@ else K8S_CLI := oc endif -# Detect image tool +# Detect image tool: prefer docker, fall back to podman ifeq ($(IMAGE_TOOL),) -ifneq (,$(shell which docker)) +ifneq (,$(shell command -v docker 2>/dev/null)) IMAGE_TOOL := docker -else +else ifneq (,$(shell command -v podman 2>/dev/null)) IMAGE_TOOL := podman +else + $(warning Neither docker nor podman found in PATH; set IMAGE_TOOL= to run image-related targets) endif endif diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index 6777dd070..b95ae1e2f 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-08-19T17:44:00Z" + createdAt: "2026-08-24T13:35:51Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.122.0-1058.next + name: eclipse-che.v7.122.0-1062.next namespace: placeholder spec: apiservicedefinitions: {} @@ -1173,7 +1173,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.122.0-1058.next + version: 7.122.0-1062.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/config/kubernetes/kustomization.yaml b/config/kubernetes/kustomization.yaml index 7017a6f0d..e2e101e31 100644 --- a/config/kubernetes/kustomization.yaml +++ b/config/kubernetes/kustomization.yaml @@ -22,7 +22,7 @@ resources: patchesStrategicMerge: - patches/cainjection_in_checlusters.yaml - patches/cainjection_in_webhook.yaml - - patches/service_cert_patch.yaml + - patches/deployment_cert_patch.yaml - patches/manager_pod_security_context.yaml vars: diff --git a/config/kubernetes/patches/service_cert_patch.yaml b/config/kubernetes/patches/deployment_cert_patch.yaml similarity index 100% rename from config/kubernetes/patches/service_cert_patch.yaml rename to config/kubernetes/patches/deployment_cert_patch.yaml diff --git a/config/openshift/kustomization.yaml b/config/openshift/kustomization.yaml index 87fe039c7..2afec5b55 100644 --- a/config/openshift/kustomization.yaml +++ b/config/openshift/kustomization.yaml @@ -20,4 +20,5 @@ resources: patchesStrategicMerge: - patches/cainjection_in_checlusters.yaml - patches/cainjection_in_webhook.yaml + - patches/deployment_cert_patch.yaml - patches/service_cert_patch.yaml \ No newline at end of file diff --git a/config/openshift/patches/deployment_cert_patch.yaml b/config/openshift/patches/deployment_cert_patch.yaml new file mode 100644 index 000000000..3c9d0d0ab --- /dev/null +++ b/config/openshift/patches/deployment_cert_patch.yaml @@ -0,0 +1,31 @@ +# +# Copyright (c) 2019-2026 Red Hat, Inc. +# This program and the accompanying materials are made +# available under the terms of the Eclipse Public License 2.0 +# which is available at https://www.eclipse.org/legal/epl-2.0/ +# +# SPDX-License-Identifier: EPL-2.0 +# +# Contributors: +# Red Hat, Inc. - initial API and implementation +# + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: che-operator + namespace: eclipse-che +spec: + template: + spec: + containers: + - name: che-operator + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert diff --git a/deploy/deployment/openshift/combined.yaml b/deploy/deployment/openshift/combined.yaml index ae765fc94..247ebb530 100644 --- a/deploy/deployment/openshift/combined.yaml +++ b/deploy/deployment/openshift/combined.yaml @@ -29044,12 +29044,21 @@ spec: - ALL privileged: false readOnlyRootFilesystem: false + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true hostIPC: false hostNetwork: false hostPID: false restartPolicy: Always serviceAccountName: che-operator terminationGracePeriodSeconds: 20 + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert --- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration diff --git a/deploy/deployment/openshift/objects/che-operator.Deployment.yaml b/deploy/deployment/openshift/objects/che-operator.Deployment.yaml index c69c2cf14..808c1370d 100644 --- a/deploy/deployment/openshift/objects/che-operator.Deployment.yaml +++ b/deploy/deployment/openshift/objects/che-operator.Deployment.yaml @@ -151,9 +151,18 @@ spec: - ALL privileged: false readOnlyRootFilesystem: false + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-tls-certs + readOnly: true hostIPC: false hostNetwork: false hostPID: false restartPolicy: Always serviceAccountName: che-operator terminationGracePeriodSeconds: 20 + volumes: + - name: webhook-tls-certs + secret: + defaultMode: 420 + secretName: che-operator-service-cert From 0aa9307ba3e28c0599a870302162413370497c6e Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Mon, 24 Aug 2026 16:44:28 +0200 Subject: [PATCH 6/7] fixup Signed-off-by: Anatolii Bazko --- .github/workflows/pr-image-build.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/pr-image-build.yml b/.github/workflows/pr-image-build.yml index 1a38e6b72..83f0bb63d 100644 --- a/.github/workflows/pr-image-build.yml +++ b/.github/workflows/pr-image-build.yml @@ -18,7 +18,6 @@ permissions: jobs: image-build-amd64: runs-on: ubuntu-24.04 - if: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }} env: IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 ORGANIZATION: quay.io/eclipse From 754041a53b850ca71fa39bece1cdab6be17d375e Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Tue, 25 Aug 2026 09:11:29 +0200 Subject: [PATCH 7/7] fixup Signed-off-by: Anatolii Bazko --- .github/workflows/pr-image-build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/pr-image-build.yml b/.github/workflows/pr-image-build.yml index 83f0bb63d..4155cac84 100644 --- a/.github/workflows/pr-image-build.yml +++ b/.github/workflows/pr-image-build.yml @@ -18,6 +18,7 @@ permissions: jobs: image-build-amd64: runs-on: ubuntu-24.04 + if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }} env: IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64 ORGANIZATION: quay.io/eclipse