Skip to content

Commit 2c0259d

Browse files
tolushatolusha
authored
fix: Update fields descriptions to reflect OpenShift external OIDC support (#2112)
Signed-off-by: Anatolii Bazko <abazko@redhat.com>
1 parent 45b9a4e commit 2c0259d

9 files changed

Lines changed: 192 additions & 145 deletions

‎api/v2/checluster_types.go‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -594,44 +594,49 @@ type WorkspaceSecurityConfig struct {
594594
// Authentication settings.
595595
type Auth struct {
596596
// Public URL of the Identity Provider server.
597+
// For OpenShift with built-in OAuth, this field is not used, as OpenShift provides its own OAuth server.
597598
// +optional
598599
IdentityProviderURL string `json:"identityProviderURL,omitempty"`
599-
// Name of the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
600+
// Defined the OIDC client id.
601+
// For OpenShift with built-in OAuth, this is the name of the `OAuthClient` resource used to set up identity federation.
600602
// +optional
601603
OAuthClientName string `json:"oAuthClientName,omitempty"`
602-
// Name of the secret set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
603-
// For Kubernetes, this can either be the plain text oAuthSecret value, or the name of a kubernetes secret which contains a
604-
// key `oAuthSecret` and the value is the secret. NOTE: this secret must exist in the same namespace as the `CheCluster`
605-
// resource and contain the label `app.kubernetes.io/part-of=che.eclipse.org`.
604+
// Defines the OAuth client secret.
605+
// It can either be a plain text secret value or the name of a Kubernetes secret
606+
// containing a key `oAuthSecret` with the secret value. The Kubernetes secret must exist in the same namespace
607+
// as the `CheCluster` resource and have the label `app.kubernetes.io/part-of=che.eclipse.org`.
608+
// For OpenShift with built-in OAuth, this is the secret set in the `OAuthClient` resource used to set up identity federation.
606609
// +optional
607610
OAuthSecret string `json:"oAuthSecret,omitempty"`
608-
// Access Token Scope.
609-
// This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
611+
// Defines the scope requested from the OIDC provider.
612+
// For OpenShift with built-in OAuth, the scope `user:full` is used by default.
610613
// +optional
611614
OAuthScope string `json:"oAuthScope,omitempty"`
612-
// Inactivity timeout for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
615+
// Inactivity timeout for tokens in seconds.
616+
// This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
613617
// 0 means tokens for this client never time out.
614618
// +optional
615619
OAuthAccessTokenInactivityTimeoutSeconds *int32 `json:"oAuthAccessTokenInactivityTimeoutSeconds,omitempty"`
616-
// Access token max age for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
620+
// Access token max age in seconds.
621+
// This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
617622
// 0 means no expiration.
618623
// +optional
619624
OAuthAccessTokenMaxAgeSeconds *int32 `json:"oAuthAccessTokenMaxAgeSeconds,omitempty"`
620-
// Identity token to be passed to upstream. There are two types of tokens supported: `id_token` and `access_token`.
621-
// Default value is `id_token`.
622-
// This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
625+
// Identity token type to be passed to upstream services. Defaults to `id_token`.
626+
// For OpenShift with built-in OAuth, defaults to `access_token`.
623627
// +optional
624628
// +kubebuilder:validation:Enum=id_token;access_token
625629
IdentityToken string `json:"identityToken,omitempty"`
626630
// Gateway settings.
627631
// +optional
628632
// +kubebuilder:default:={configLabels: {app: che, component: che-gateway-config}}
629633
Gateway Gateway `json:"gateway,omitempty"`
630-
// Advance authorization settings. Determines which users and groups are allowed to access Che.
631-
// User is allowed to access Che if he/she is either in the `allowUsers` list or is member of group from `allowGroups` list
632-
// and not in neither the `denyUsers` list nor is member of group from `denyGroups` list.
634+
// Advanced authorization settings. Determines which users and groups are allowed to access Che.
635+
// A user is allowed to access Che if the user is in the `allowUsers` list or is a member of a group in the `allowGroups` list,
636+
// and is not in the `denyUsers` list nor a member of a group in the `denyGroups` list.
633637
// If `allowUsers` and `allowGroups` are empty, then all users are allowed to access Che.
634-
// if `denyUsers` and `denyGroups` are empty, then no users are denied to access Che.
638+
// If `denyUsers` and `denyGroups` are empty, then no users are denied access to Che.
639+
// Note: group-based authorization (`allowGroups` and `denyGroups`) is currently supported on OpenShift only.
635640
// +optional
636641
AdvancedAuthorization *AdvancedAuthorization `json:"advancedAuthorization,omitempty"`
637642
}

‎bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ metadata:
8686
categories: Developer Tools
8787
certified: "false"
8888
containerImage: quay.io/eclipse/che-operator:next
89-
createdAt: "2026-03-25T12:21:22Z"
89+
createdAt: "2026-04-02T11:48:45Z"
9090
description: A Kube-native development solution that delivers portable and collaborative
9191
developer workspaces.
9292
features.operators.openshift.io/cnf: "false"
@@ -108,7 +108,7 @@ metadata:
108108
operatorframework.io/arch.amd64: supported
109109
operatorframework.io/arch.arm64: supported
110110
operatorframework.io/os.linux: supported
111-
name: eclipse-che.v7.116.0-957.next
111+
name: eclipse-che.v7.117.0-958.next
112112
namespace: placeholder
113113
spec:
114114
apiservicedefinitions: {}
@@ -1144,7 +1144,7 @@ spec:
11441144
name: gateway-authorization-sidecar-k8s
11451145
- image: quay.io/che-incubator/header-rewrite-proxy:latest
11461146
name: gateway-header-sidecar
1147-
version: 7.116.0-957.next
1147+
version: 7.117.0-958.next
11481148
webhookdefinitions:
11491149
- admissionReviewVersions:
11501150
- v1

‎bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -10685,11 +10685,12 @@ spec:
1068510685
properties:
1068610686
advancedAuthorization:
1068710687
description: |-
10688-
Advance authorization settings. Determines which users and groups are allowed to access Che.
10689-
User is allowed to access Che if he/she is either in the `allowUsers` list or is member of group from `allowGroups` list
10690-
and not in neither the `denyUsers` list nor is member of group from `denyGroups` list.
10688+
Advanced authorization settings. Determines which users and groups are allowed to access Che.
10689+
A user is allowed to access Che if the user is in the `allowUsers` list or is a member of a group in the `allowGroups` list,
10690+
and is not in the `denyUsers` list nor a member of a group in the `denyGroups` list.
1069110691
If `allowUsers` and `allowGroups` are empty, then all users are allowed to access Che.
10692-
if `denyUsers` and `denyGroups` are empty, then no users are denied to access Che.
10692+
If `denyUsers` and `denyGroups` are empty, then no users are denied access to Che.
10693+
Note: group-based authorization (`allowGroups` and `denyGroups`) is currently supported on OpenShift only.
1069310694
properties:
1069410695
allowGroups:
1069510696
description: List of groups allowed to access Che (currently
@@ -11101,44 +11102,49 @@ spec:
1110111102
type: object
1110211103
type: object
1110311104
identityProviderURL:
11104-
description: Public URL of the Identity Provider server.
11105+
description: |-
11106+
Public URL of the Identity Provider server.
11107+
For OpenShift with built-in OAuth, this field is not used, as OpenShift provides its own OAuth server.
1110511108
type: string
1110611109
identityToken:
1110711110
description: |-
11108-
Identity token to be passed to upstream. There are two types of tokens supported: `id_token` and `access_token`.
11109-
Default value is `id_token`.
11110-
This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
11111+
Identity token type to be passed to upstream services. Defaults to `id_token`.
11112+
For OpenShift with built-in OAuth, defaults to `access_token`.
1111111113
enum:
1111211114
- id_token
1111311115
- access_token
1111411116
type: string
1111511117
oAuthAccessTokenInactivityTimeoutSeconds:
1111611118
description: |-
11117-
Inactivity timeout for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11119+
Inactivity timeout for tokens in seconds.
11120+
This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
1111811121
0 means tokens for this client never time out.
1111911122
format: int32
1112011123
type: integer
1112111124
oAuthAccessTokenMaxAgeSeconds:
1112211125
description: |-
11123-
Access token max age for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11126+
Access token max age in seconds.
11127+
This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
1112411128
0 means no expiration.
1112511129
format: int32
1112611130
type: integer
1112711131
oAuthClientName:
11128-
description: Name of the OpenShift `OAuthClient` resource
11129-
used to set up identity federation on the OpenShift side.
11132+
description: |-
11133+
Defined the OIDC client id.
11134+
For OpenShift with built-in OAuth, this is the name of the `OAuthClient` resource used to set up identity federation.
1113011135
type: string
1113111136
oAuthScope:
1113211137
description: |-
11133-
Access Token Scope.
11134-
This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
11138+
Defines the scope requested from the OIDC provider.
11139+
For OpenShift with built-in OAuth, the scope `user:full` is used by default.
1113511140
type: string
1113611141
oAuthSecret:
1113711142
description: |-
11138-
Name of the secret set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11139-
For Kubernetes, this can either be the plain text oAuthSecret value, or the name of a kubernetes secret which contains a
11140-
key `oAuthSecret` and the value is the secret. NOTE: this secret must exist in the same namespace as the `CheCluster`
11141-
resource and contain the label `app.kubernetes.io/part-of=che.eclipse.org`.
11143+
Defines the OAuth client secret.
11144+
It can either be a plain text secret value or the name of a Kubernetes secret
11145+
containing a key `oAuthSecret` with the secret value. The Kubernetes secret must exist in the same namespace
11146+
as the `CheCluster` resource and have the label `app.kubernetes.io/part-of=che.eclipse.org`.
11147+
For OpenShift with built-in OAuth, this is the secret set in the `OAuthClient` resource used to set up identity federation.
1114211148
type: string
1114311149
type: object
1114411150
domain:

‎config/crd/bases/org.eclipse.che_checlusters.yaml‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -10635,11 +10635,12 @@ spec:
1063510635
properties:
1063610636
advancedAuthorization:
1063710637
description: |-
10638-
Advance authorization settings. Determines which users and groups are allowed to access Che.
10639-
User is allowed to access Che if he/she is either in the `allowUsers` list or is member of group from `allowGroups` list
10640-
and not in neither the `denyUsers` list nor is member of group from `denyGroups` list.
10638+
Advanced authorization settings. Determines which users and groups are allowed to access Che.
10639+
A user is allowed to access Che if the user is in the `allowUsers` list or is a member of a group in the `allowGroups` list,
10640+
and is not in the `denyUsers` list nor a member of a group in the `denyGroups` list.
1064110641
If `allowUsers` and `allowGroups` are empty, then all users are allowed to access Che.
10642-
if `denyUsers` and `denyGroups` are empty, then no users are denied to access Che.
10642+
If `denyUsers` and `denyGroups` are empty, then no users are denied access to Che.
10643+
Note: group-based authorization (`allowGroups` and `denyGroups`) is currently supported on OpenShift only.
1064310644
properties:
1064410645
allowGroups:
1064510646
description: List of groups allowed to access Che (currently
@@ -11046,44 +11047,49 @@ spec:
1104611047
type: object
1104711048
type: object
1104811049
identityProviderURL:
11049-
description: Public URL of the Identity Provider server.
11050+
description: |-
11051+
Public URL of the Identity Provider server.
11052+
For OpenShift with built-in OAuth, this field is not used, as OpenShift provides its own OAuth server.
1105011053
type: string
1105111054
identityToken:
1105211055
description: |-
11053-
Identity token to be passed to upstream. There are two types of tokens supported: `id_token` and `access_token`.
11054-
Default value is `id_token`.
11055-
This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
11056+
Identity token type to be passed to upstream services. Defaults to `id_token`.
11057+
For OpenShift with built-in OAuth, defaults to `access_token`.
1105611058
enum:
1105711059
- id_token
1105811060
- access_token
1105911061
type: string
1106011062
oAuthAccessTokenInactivityTimeoutSeconds:
1106111063
description: |-
11062-
Inactivity timeout for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11064+
Inactivity timeout for tokens in seconds.
11065+
This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
1106311066
0 means tokens for this client never time out.
1106411067
format: int32
1106511068
type: integer
1106611069
oAuthAccessTokenMaxAgeSeconds:
1106711070
description: |-
11068-
Access token max age for tokens to set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11071+
Access token max age in seconds.
11072+
This field is specific to OpenShift with built-in OAuth. It is set on the `OAuthClient` resource.
1106911073
0 means no expiration.
1107011074
format: int32
1107111075
type: integer
1107211076
oAuthClientName:
11073-
description: Name of the OpenShift `OAuthClient` resource
11074-
used to set up identity federation on the OpenShift side.
11077+
description: |-
11078+
Defined the OIDC client id.
11079+
For OpenShift with built-in OAuth, this is the name of the `OAuthClient` resource used to set up identity federation.
1107511080
type: string
1107611081
oAuthScope:
1107711082
description: |-
11078-
Access Token Scope.
11079-
This field is specific to Che installations made for Kubernetes only and ignored for OpenShift.
11083+
Defines the scope requested from the OIDC provider.
11084+
For OpenShift with built-in OAuth, the scope `user:full` is used by default.
1108011085
type: string
1108111086
oAuthSecret:
1108211087
description: |-
11083-
Name of the secret set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
11084-
For Kubernetes, this can either be the plain text oAuthSecret value, or the name of a kubernetes secret which contains a
11085-
key `oAuthSecret` and the value is the secret. NOTE: this secret must exist in the same namespace as the `CheCluster`
11086-
resource and contain the label `app.kubernetes.io/part-of=che.eclipse.org`.
11088+
Defines the OAuth client secret.
11089+
It can either be a plain text secret value or the name of a Kubernetes secret
11090+
containing a key `oAuthSecret` with the secret value. The Kubernetes secret must exist in the same namespace
11091+
as the `CheCluster` resource and have the label `app.kubernetes.io/part-of=che.eclipse.org`.
11092+
For OpenShift with built-in OAuth, this is the secret set in the `OAuthClient` resource used to set up identity federation.
1108711093
type: string
1108811094
type: object
1108911095
domain:

0 commit comments

Comments
 (0)