[tolusha]

What does this PR do?

Adds the OpenShift console namespace to the default NetworkPolicy ingress, so the OpenShift console can reach workspaces. This is needed for WebTerminal.

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/WTO-598

Is it tested? How?

1. Install current versions DWO and WTO.
2. Create DWOC

apiVersion: controller.devfile.io/v1alpha1
kind: DevWorkspaceOperatorConfig
metadata:
  name: devworkspace-operator-config
  namespace: openshift-operators
config:
  workspace:
    networkPolicy:
      enabled: true

3. Try to open web terminal.
4. Connection error but pod is running.

5. Stop DW
6. Update devworkspace CSV by using image built from this PR (quay.io/abazko/operator:dw-1724)
7. Ensure web terminal is accessible
8. Check NetworkPolicy created in the namespace (openshift-terminal).

    - from:
        - namespaceSelector:
            matchLabels:
              network.openshift.io/policy-group: console

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

🤖 Generated with Claude Code

Summary by CodeRabbit

• Updates
  • The default OpenShift ingress network policy now allows ingress from namespaces labeled for the console, including WebTerminal traffic. This changes the default network access permitted by the policy.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cc8aa5ca-44f9-405f-8917-843696776fc0

📥 Commits

Reviewing files that changed from the base of the PR and between 49eaaab and 9101583.

📒 Files selected for processing: 1

• pkg/config/defaults.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The default OpenShift ingress network policy now allows ingress from namespaces labeled network.openshift.io/policy-group=console. A comment identifies the rule as needed for WebTerminal.

Changes: OpenShift ingress policy

Layer / File(s)	Summary
Add console namespace ingress rule pkg/config/defaults.go	The default ingress policy includes a rule for namespaces labeled network.openshift.io/policy-group=console. The comment identifies WebTerminal.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 91015

The change provides the intended console ingress access without an established merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title names the primary change: allowing OpenShift console ingress in the default NetworkPolicy so WebTerminal workspaces are reachable. The raw summary confirms pkg/config/defaults.go adds an ing…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Title check

Explanation

The title names the primary change: allowing OpenShift console ingress in the default NetworkPolicy so WebTerminal workspaces are reachable. The raw summary confirms pkg/config/defaults.go adds an ingress rule for namespaces labeled network.openshift.io/policy-group=console, with a WebTerminal comment. The objectives state the same goal. The title is specific and matches the changeset. The 78-character length is slightly long but acceptable.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant claude — Run a free-form instruction on this PR
• /che-ai-assistant help — Show this help message

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia, tolusha
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment