chore: Configure DWO with tlsCertificateConfigmapRef when certificates imported to che-operator (#2146)

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

Author: tolusha

bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml

@@ -86,7 +86,7 @@ metadata:
     categories: Developer Tools
     certified: "false"
     containerImage: quay.io/eclipse/che-operator:next
-    createdAt: "2026-06-16T14:03:55Z"
+    createdAt: "2026-06-23T10:08:27Z"
     description: A Kube-native development solution that delivers portable and collaborative
       developer workspaces.
     features.operators.openshift.io/cnf: "false"
@@ -108,7 +108,7 @@ metadata:
     operatorframework.io/arch.amd64: supported
     operatorframework.io/arch.arm64: supported
     operatorframework.io/os.linux: supported
-  name: eclipse-che.v7.119.0-990.next
+  name: eclipse-che.v7.120.0-991.next
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -1153,7 +1153,7 @@ spec:
       name: gateway-authorization-sidecar
     - image: quay.io/che-incubator/header-rewrite-proxy:latest
       name: gateway-header-sidecar
-  version: 7.119.0-990.next
+  version: 7.120.0-991.next
   webhookdefinitions:
     - admissionReviewVersions:
         - v1

controllers/workspaceconfig/workspaces_config_controller_test.go

@@ -18,8 +18,6 @@ import (
 	"testing"
 
 	"github.com/eclipse-che/che-operator/controllers/namespacecache"
-	"github.com/eclipse-che/che-operator/pkg/common/diffs"
-	"github.com/google/go-cmp/cmp"
 	"k8s.io/apimachinery/pkg/api/errors"
 
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -84,10 +82,9 @@ func TestCreate(t *testing.T) {
 	assert.NoError(t, err)
 
 	dstCm := &corev1.ConfigMap{}
-	exists, err := deploy.Get(ctx, types.NamespacedName{Namespace: "user-che", Name: "test"}, dstCm)
+	err = ctx.ClusterAPI.Client.Get(context.TODO(), types.NamespacedName{Namespace: "user-che", Name: "test"}, dstCm)
 
 	assert.NoError(t, err)
-	assert.True(t, exists)
 	assert.Equal(t, 1, len(dstCm.Data))
 	assert.Equal(t, "new-value", dstCm.Data["key"])
 }
@@ -141,7 +138,8 @@ func TestUpdate(t *testing.T) {
 	err = ctx.ClusterAPI.Client.Get(context.TODO(), types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, srcCm)
 
 	assert.NoError(t, err)
-	assert.True(t, cmp.Equal(dstCm, srcCm, diffs.ConfigMap([]string{constants.KubernetesPartOfLabelKey, constants.KubernetesComponentLabelKey}, nil)))
+	assert.Equal(t, srcCm.Labels[constants.KubernetesPartOfLabelKey], dstCm.Labels[constants.KubernetesPartOfLabelKey])
+	assert.Equal(t, srcCm.Labels[constants.KubernetesComponentLabelKey], dstCm.Labels[constants.KubernetesComponentLabelKey])
 
 	// update source and destination config maps
 

pkg/common/diffs/diffs.go

@@ -51,18 +51,19 @@ var ConfigMapEnsureLabels = cmp.Options{
 	}),
 }
 
-func ConfigMap(labels []string, annotations []string) cmp.Options {
+// ConfigMap respects existed labels and annotations
+func ConfigMap(labelKeys []string, annotationKeys []string) cmp.Options {
 	return cmp.Options{
 		cmpopts.IgnoreFields(corev1.ConfigMap{}, "TypeMeta"),
-		objectMetaComparator(labels, annotations),
+		cmpMetadata(labelKeys, annotationKeys),
 	}
 }
 
 var ServiceMonitor = cmp.Options{
 	cmpopts.IgnoreFields(monitoringv1.ServiceMonitor{}, "TypeMeta", "ObjectMeta"),
 }
 
-func objectMetaComparator(labels []string, annotations []string) cmp.Option {
+func cmpMetadata(labels []string, annotations []string) cmp.Option {
 	return cmp.Comparer(func(x, y metav1.ObjectMeta) bool {
 		for _, label := range labels {
 			if x.Labels[label] != y.Labels[label] {

pkg/deploy/devworkspace/dev_workspace_config.go

@@ -13,6 +13,7 @@
 package devworkspace
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"maps"
@@ -26,10 +27,12 @@ import (
 	"github.com/eclipse-che/che-operator/pkg/common/reconciler"
 	"github.com/eclipse-che/che-operator/pkg/common/utils"
 	"github.com/eclipse-che/che-operator/pkg/deploy"
+	"github.com/eclipse-che/che-operator/pkg/deploy/tls"
 	v1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
@@ -123,6 +126,10 @@ func updateWorkspaceConfig(ctx *chetypes.DeployContext, operatorConfig *controll
 
 	updateInitContainers(devEnvironments, operatorConfig.Workspace)
 
+	if err := updateTLSCertificateConfigmapRef(ctx, operatorConfig); err != nil {
+		return err
+	}
+
 	// If the CheCluster has a configured proxy, or if the Che Operator has detected a proxy configuration,
 	// we need to disable automatic proxy handling in the DevWorkspace Operator as its implementation collides
 	// with ours -- they set environment variables the deployment spec explicitly, which overrides the proxy-settings
@@ -301,6 +308,39 @@ func updateInitContainers(devEnvironments *chev2.CheClusterDevEnvironments, work
 	workspaceConfig.InitContainers = devEnvironments.InitContainers
 }
 
+func updateTLSCertificateConfigmapRef(ctx *chetypes.DeployContext, operatorConfig *controllerv1alpha1.OperatorConfiguration) error {
+	cm := &corev1.ConfigMap{}
+	exists, err := ctx.ClusterAPI.ClientWrapper.GetIgnoreNotFound(
+		context.TODO(),
+		types.NamespacedName{
+			Name:      tls.CheMergedCABundleCertsCMName,
+			Namespace: ctx.CheCluster.Namespace,
+		},
+		cm,
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to get ConfigMap %s: %w", tls.CheMergedCABundleCertsCMName, err)
+	}
+
+	if exists && len(cm.Data) > 0 {
+		if operatorConfig.Routing == nil {
+			operatorConfig.Routing = &controllerv1alpha1.RoutingConfig{}
+		}
+
+		operatorConfig.Routing.TLSCertificateConfigmapRef = &controllerv1alpha1.ConfigmapReference{
+			Name:      tls.CheMergedCABundleCertsCMName,
+			Namespace: ctx.CheCluster.Namespace,
+		}
+	} else {
+		if operatorConfig.Routing != nil {
+			operatorConfig.Routing.TLSCertificateConfigmapRef = nil
+		}
+	}
+
+	return nil
+}
+
 func disableDWOProxy(routingConfig *controllerv1alpha1.RoutingConfig) {
 	// Since we create proxy configmaps to mount proxy settings, we want to disable
 	// proxy handling in DWO; otherwise the env vars added by DWO will override the env