Add support for overriding any pod spec field in DevWorkspace deployment

Makefile

@@ -29,7 +29,7 @@ export PROJECT_CLONE_IMG ?= quay.io/devfile/project-clone:next
 export PULL_POLICY ?= Always
 export DEFAULT_ROUTING ?= basic
 export KUBECONFIG ?= ${HOME}/.kube/config
-export DEVWORKSPACE_API_VERSION ?= 32cae1f8e42c22035138ef6ee93080bc47d751c6
+export DEVWORKSPACE_API_VERSION ?= 2609b3576ec912b955a5b4a7398ce48f8e39e879
 
 # Enable using Podman instead of Docker
 export DOCKER ?= docker

build/make/deploy.mk

@@ -77,9 +77,9 @@ _check_controller_running:
 ### install: Install controller in the configured Kubernetes cluster in ~/.kube/config
 install: _print_vars _check_cert_manager _init_devworkspace_crds _create_namespace generate_deployment
   ifeq ($(PLATFORM),kubernetes)
-	  $(K8S_CLI) apply -f deploy/current/kubernetes/combined.yaml
+	  $(K8S_CLI) apply -f deploy/current/kubernetes/combined.yaml --server-side=true --force-conflicts
   else
-	  $(K8S_CLI) apply -f deploy/current/openshift/combined.yaml
+	  $(K8S_CLI) apply -f deploy/current/openshift/combined.yaml --server-side=true --force-conflicts
   endif
   # Can't pipe into $(K8S_CLI) as stdin is closed.
 	cat deploy/default-config.yaml | envsubst > deploy/default-config.temp.yaml

deploy/generate-deployment.sh

@@ -115,7 +115,7 @@ if $USE_DEFAULT_ENV; then
   export PROJECT_CLONE_IMG=${PROJECT_CLONE_IMG:-"quay.io/devfile/project-clone:next"}
   export PULL_POLICY=Always
   export DEFAULT_ROUTING=basic
-  export DEVWORKSPACE_API_VERSION=32cae1f8e42c22035138ef6ee93080bc47d751c6
+  export DEVWORKSPACE_API_VERSION=2609b3576ec912b955a5b4a7398ce48f8e39e879
   export ROUTING_SUFFIX='""'
   export FORCE_DEVWORKSPACE_CRDS_UPDATE=true
 fi

go.mod

@@ -3,7 +3,7 @@ module github.com/devfile/devworkspace-operator
 go 1.16
 
 require (
-	github.com/devfile/api/v2 v2.0.0-20220414122024-32cae1f8e42c
+	github.com/devfile/api/v2 v2.0.0-20220920140505-2609b3576ec9
 	github.com/go-git/go-git/v5 v5.2.0
 	github.com/go-logr/logr v0.4.0
 	github.com/google/go-cmp v0.5.5

go.sum

@@ -106,8 +106,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/daviddengcn/go-colortext v0.0.0-20160507010035-511bcaf42ccd/go.mod h1:dv4zxwHi5C/8AeI+4gX4dCWOIvNi7I6JCSX0HvlKPgE=
-github.com/devfile/api/v2 v2.0.0-20220414122024-32cae1f8e42c h1:yyidoxal8ngJWDxRuVZMNh4PBwqDIzOkTeOagtmRiy0=
-github.com/devfile/api/v2 v2.0.0-20220414122024-32cae1f8e42c/go.mod h1:kLX/nW93gigOHXK3NLeJL2fSS/sgEe+OHu8bo3aoOi4=
+github.com/devfile/api/v2 v2.0.0-20220920140505-2609b3576ec9 h1:NVUmwuoo8wF7HUmqtn7pWQ75MrRAvZvLK7R/QdUL1wY=
+github.com/devfile/api/v2 v2.0.0-20220920140505-2609b3576ec9/go.mod h1:dN7xFrOVG+iPqn4UKGibXLd5oVsdE8XyK9OEb5JL3aI=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=

new.cabundle

@@ -0,0 +1,2 @@
+LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVVENDQWptZ0F3SUJBZ0lJZTkzTUx6VEJocUV3RFFZSktvWklodmNOQVFFTEJRQXdOakUwTURJR0ExVUUKQXd3cmIzQmxibk5vYVdaMExYTmxjblpwWTJVdGMyVnlkbWx1WnkxemFXZHVaWEpBTVRZMk16Y3dORGd4TlRBZQpGdzB5TWpBNU1qQXlNREV6TXpWYUZ3MHlOREV4TVRneU1ERXpNelphTURZeE5EQXlCZ05WQkFNTUsyOXdaVzV6CmFHbG1kQzF6WlhKMmFXTmxMWE5sY25acGJtY3RjMmxuYm1WeVFERTJOak0zTURRNE1UVXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3lqeERnM1pvVGNqMnhoam0vRzBoQ0dpNGxENXNPa2I1YQpwczZSeGJ5emNoNE41RVRNaUZXUGxqRVdEMzVONjRJMEJyM1FKLzYwbHY3VVRvUU1Pc2dBVjJDZldmdFJka09FCm9PbWx5Qk41VEJ6eEJXdjhJZitGVTJSQUZLR1VSYkJDSlBzZUlDV20zMXBZREowUUYzQUQvaWREMTRWeUlNcGkKT3A2SVY3TkFJMzJNa3UyMGFPQlNFSFV4dmxFQzlTdXJRbzdCTWpLQWgrOUgxQ3IvVHZieHBYM293MzZsSFRqUwpBNkJZWjJiZytmcTMyemZyWHUrYjhmUU1qY3FDNHdHRHhXYklTdWI0MFl0cHNsbGk5ZVFpbi9LTERHYk1MNXVHCkpZRGRBYWp6Uk1hZlIxdlpxeVpIYktzZUtHUHIyaDJWYk1TTVhaT3pMNzRoR3h2V2ppbFBBZ01CQUFHall6QmgKTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFUMDJ1QQpwc2c4YTRNQkFrVVdab0NCejhXN3dUQWZCZ05WSFNNRUdEQVdnQlFUMDJ1QXBzZzhhNE1CQWtVV1pvQ0J6OFc3CndUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFmMzhwZnU1d3BJUEhrNzZuY1FjaUpzQ3RCSmU5NXdseHZWRmgKVHBVV1lrY2pPQitZK1F0N0V6MmdYaHA2TGllOUhUdkVZRFpFY2NBSzZSS1o4dTRLSmd4QUVoN20xR2Z1NitRcgo0SXE2c05EMUlRb1hzcTh3RllPNURMT1U0N3NWSERITEhmb1JOTFNMd1BWaThNbDlpczJqU3RiZkVZK04yZlM5CnZFL1BFN2MwN0JrUDRxRFF4eDYwMjBqdXVSY1FFMFZrNmRTTWV3Ri9HRGd0MVd5SWIrR2YxbmVXK1RDMWJBT2EKQTMwMG41QnhkYTBjQ29pYjVFUXM3N0E2dmwwQWtNUUpVODJWSkI3Q0dkNy9iQ081ekovZkdTSlhONFo5ZHpiMwowUlpWck0wa1BVejN0dlhyTlRCWVJHZU5BNXMwRVJLK1h1NmU0MTcxSG9BK2xJTmFSQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+...

old.cabundle

@@ -0,0 +1,2 @@
+LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVVENDQWptZ0F3SUJBZ0lJZTkzTUx6VEJocUV3RFFZSktvWklodmNOQVFFTEJRQXdOakUwTURJR0ExVUUKQXd3cmIzQmxibk5vYVdaMExYTmxjblpwWTJVdGMyVnlkbWx1WnkxemFXZHVaWEpBTVRZMk16Y3dORGd4TlRBZQpGdzB5TWpBNU1qQXlNREV6TXpWYUZ3MHlOREV4TVRneU1ERXpNelphTURZeE5EQXlCZ05WQkFNTUsyOXdaVzV6CmFHbG1kQzF6WlhKMmFXTmxMWE5sY25acGJtY3RjMmxuYm1WeVFERTJOak0zTURRNE1UVXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3lqeERnM1pvVGNqMnhoam0vRzBoQ0dpNGxENXNPa2I1YQpwczZSeGJ5emNoNE41RVRNaUZXUGxqRVdEMzVONjRJMEJyM1FKLzYwbHY3VVRvUU1Pc2dBVjJDZldmdFJka09FCm9PbWx5Qk41VEJ6eEJXdjhJZitGVTJSQUZLR1VSYkJDSlBzZUlDV20zMXBZREowUUYzQUQvaWREMTRWeUlNcGkKT3A2SVY3TkFJMzJNa3UyMGFPQlNFSFV4dmxFQzlTdXJRbzdCTWpLQWgrOUgxQ3IvVHZieHBYM293MzZsSFRqUwpBNkJZWjJiZytmcTMyemZyWHUrYjhmUU1qY3FDNHdHRHhXYklTdWI0MFl0cHNsbGk5ZVFpbi9LTERHYk1MNXVHCkpZRGRBYWp6Uk1hZlIxdlpxeVpIYktzZUtHUHIyaDJWYk1TTVhaT3pMNzRoR3h2V2ppbFBBZ01CQUFHall6QmgKTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFUMDJ1QQpwc2c4YTRNQkFrVVdab0NCejhXN3dUQWZCZ05WSFNNRUdEQVdnQlFUMDJ1QXBzZzhhNE1CQWtVV1pvQ0J6OFc3CndUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFmMzhwZnU1d3BJUEhrNzZuY1FjaUpzQ3RCSmU5NXdseHZWRmgKVHBVV1lrY2pPQitZK1F0N0V6MmdYaHA2TGllOUhUdkVZRFpFY2NBSzZSS1o4dTRLSmd4QUVoN20xR2Z1NitRcgo0SXE2c05EMUlRb1hzcTh3RllPNURMT1U0N3NWSERITEhmb1JOTFNMd1BWaThNbDlpczJqU3RiZkVZK04yZlM5CnZFL1BFN2MwN0JrUDRxRFF4eDYwMjBqdXVSY1FFMFZrNmRTTWV3Ri9HRGd0MVd5SWIrR2YxbmVXK1RDMWJBT2EKQTMwMG41QnhkYTBjQ29pYjVFUXM3N0E2dmwwQWtNUUpVODJWSkI3Q0dkNy9iQ081ekovZkdTSlhONFo5ZHpiMwowUlpWck0wa1BVejN0dlhyTlRCWVJHZU5BNXMwRVJLK1h1NmU0MTcxSG9BK2xJTmFSQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+...

pkg/provision/workspace/deployment.go

@@ -246,6 +246,14 @@ func getSpecDeployment(
 		},
 	}
 
+	if needsPodSpecOverrides(workspace) {
+		patchedDeployment, err := applyPodSpecOverrides(deployment, workspace)
+		if err != nil {
+			return nil, err
+		}
+		deployment = patchedDeployment
+	}
+
 	if podTolerations != nil && len(podTolerations) > 0 {
 		deployment.Spec.Template.Spec.Tolerations = podTolerations
 	}

pkg/provision/workspace/override.go

@@ -0,0 +1,53 @@
+// Copyright (c) 2019-2022 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package workspace
+
+import (
+	"github.com/devfile/devworkspace-operator/pkg/common"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+)
+
+func needsPodSpecOverrides(workspace *common.DevWorkspaceWithConfig) bool {
+	return workspace.Spec.PodSpecOverrides != nil
+}
+
+func applyPodSpecOverrides(deployment *appsv1.Deployment, workspace *common.DevWorkspaceWithConfig) (*appsv1.Deployment, error) {
+	patched := deployment.DeepCopy()
+
+	originalBytes, err := json.Marshal(patched.Spec.Template)
+	if err != nil {
+		return nil, err
+	}
+
+	podSpecOverride := workspace.Spec.PodSpecOverrides
+	patchBytes, err := json.Marshal(podSpecOverride)
+	if err != nil {
+		return nil, err
+	}
+
+	patchedJSON, err := strategicpatch.StrategicMergePatch(originalBytes, patchBytes, &corev1.PodTemplateSpec{})
+	if err != nil {
+		return nil, err
+	}
+
+	patchedPodSpecTemplate := corev1.PodTemplateSpec{}
+	if err := json.Unmarshal(patchedJSON, &patchedPodSpecTemplate); err != nil {
+		return nil, err
+	}
+	patched.Spec.Template = patchedPodSpecTemplate
+	return patched, nil
+}

samples/pod-spec-overrides.yaml

@@ -0,0 +1,37 @@
+kind: DevWorkspace
+apiVersion: workspace.devfile.io/v1alpha2
+metadata:
+  name: theia-next
+spec:
+  started: true
+  podSpecOverride:
+    metadata:
+      annotations:
+        io.openshift.userns: "true"
+        io.kubernetes.cri-o.userns-mode: "auto:size=65536;map-to-root=true"  # <-- user namespace
+        openshift.io/scc: container-build
+    spec:
+      runtimeClassName: kata
+      schedulerName: stork
+  template:
+    projects:
+      - name: web-nodejs-sample
+        git:
+          remotes:
+            origin: "https://github.com/che-samples/web-nodejs-sample.git"
+    components:
+      - name: theia
+        plugin:
+          uri: https://che-plugin-registry-main.surge.sh/v3/plugins/eclipse/che-theia/next/devfile.yaml
+          components:
+            - name: theia-ide
+              container:
+                env:
+                  - name: THEIA_HOST
+                    value: 0.0.0.0
+    commands:
+      - id: say-hello
+        exec:
+          component: theia-ide
+          commandLine: echo "Hello from $(pwd)"
+          workingDir: ${PROJECTS_ROOT}/project/app