fix: grant workspace users ImageStream read access by akurinnoy · Pull Request #2152 · eclipse-che/che-operator

akurinnoy · 2026-07-09T09:48:47Z

What does this PR do?

Adds image.openshift.io/imagestreams: get, list to the OpenShift-specific rules in the workspace user ClusterRole (e.g. openshift-devspaces-cheworkspaces-clusterrole).

Non-admin Dev Spaces users couldn't list workspace backups stored in the OpenShift internal registry because the ClusterRole lacked ImageStream permissions. The dashboard backup listing failed with 403 Forbidden - the user saw either an empty list (before the companion dashboard fix) or an error notification (after).

This is the server-side companion to eclipse-che/che-dashboard#.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

resolves https://redhat.atlassian.net/browse/CRW-10984

How to test this PR?

Deploy the operator

Ensure the DWOC has backup configured with the OpenShift internal registry:

config:
  workspace:
    backupCronJob:
      enable: true
      oras:
        extraArgs: '--insecure'
      registry:
        path: image-registry.openshift-image-registry.svc:5000
      schedule: '*/5 * * * *'

Login as a non-admin user, create a workspace
Stop the workspace, wait for backup to complete
Navigate to the Backups tab on the Workspaces page
Verify the backup list loads without errors

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Non-admin Dev Spaces users could not list workspace backups stored in the OpenShift internal registry because the workspace ClusterRole lacked image.openshift.io/imagestreams permissions. The dashboard backup listing failed with 403 Forbidden. Add get and list verbs for imagestreams to the OpenShift-specific rules in the workspace user ClusterRole. Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

tolusha · 2026-07-09T09:49:22Z

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant help — Show this help message

openshift-ci · 2026-07-09T13:03:22Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy, rohanKanojia, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tolusha · 2026-07-17T06:34:39Z

/retest

tolusha · 2026-07-17T09:54:24Z

/retest

tolusha · 2026-07-17T12:24:18Z

/che-ai-assistant check-pr-test-failures

Task completed.

tolusha · 2026-07-17T12:36:30Z

PR #2152 -- eclipse-che/che-operator -- fix: grant workspace users ImageStream read access

Check	Category	Status	Duration	CI
ci/prow/v19-devworkspace-happy-path	E2E Tests	FAILED	—	Prow
ci/prow/v19-upgrade-stable-to-next	E2E Tests	FAILED	—	Prow
resources-validation	Validation	FAILED	1m39s	GHA
Analyze (actions)	Static Analysis	PASSED	57s	GHA
Analyze (go)	Static Analysis	PASSED	4m52s	GHA
CodeQL	Static Analysis	PASSED	4s	External
WIP	External	PASSED	—	External
add-web-ide-link	External	PASSED	4s	External
bundle-version-validation	Validation	PASSED	26s	GHA
coverage-report	Unit Tests	PASSED	2m27s	GHA
dependencies-validation	Validation	PASSED	26s	GHA
eclipsefdn/eca	External	PASSED	—	External
helm-on-minikube	Integration Tests	PASSED	23m19s	GHA
multiplatform-image-build (ubuntu-24.04)	Build	PASSED	3m46s	GHA
multiplatform-image-build (ubuntu-24.04-arm)	Build	PASSED	2m53s	GHA
operator-on-minikube (ubuntu-24.04)	Integration Tests	PASSED	19m14s	GHA
operator-on-minikube (ubuntu-24.04-arm)	Integration Tests	PASSED	18m39s	GHA
source-code-validation	Static Analysis	PASSED	3m7s	GHA
unit-tests	Unit Tests	PASSED	2m18s	GHA
upgrade-stable-to-next-on-minikube	Integration Tests	PASSED	22m59s	GHA
workspaces.openshift.com	External	PASSED	—	External

FAILED resources-validation (GHA)

The resources-validation check failed because generated resources are not up to date with the current code. The check detected differences in the generated YAML files and reported: [ERROR] Resources are not up to date. [ERROR] Run 'make update-dev-resources' to update them. This indicates that changes to the code require regenerating the resource files to match.

Log: resources-validation
Rerun: Re-run failed jobs

FAILED ci/prow/v19-devworkspace-happy-path (Prow)

The E2E test failed during Eclipse Che deployment when waiting for the operator to report a valid version. After deploying all required components (operator, dashboard, gateway, devworkspace-controller), the test tried to verify the cheVersion status field was set to "next" but found it empty. The error [ERROR] Failed to deploy Eclipse Che '' version indicates the CheCluster status never populated the expected version field, causing the test to timeout after 500 iterations. This appears to be a deployment/reconciliation issue rather than an infrastructure failure.

Log: ci/prow/v19-devworkspace-happy-path
Rerun: Post /test v19-devworkspace-happy-path as a PR comment
Or rerun all failed Prow jobs: /retest

FAILED ci/prow/v19-upgrade-stable-to-next (Prow)

This upgrade test failed with the same root cause as the devworkspace-happy-path test. After successfully upgrading from stable to the "next" version, the test attempted to verify the upgraded deployment by checking the cheVersion status field. However, it found an empty version string instead of "next", resulting in [ERROR] Failed to deploy Eclipse Che '' version. The Eclipse Che operator pods were running, but the CheCluster status reconciliation failed to report the expected version, causing the test to fail after timeout.

Log: ci/prow/v19-upgrade-stable-to-next
Rerun: Post /test v19-upgrade-stable-to-next as a PR comment
Or rerun all failed Prow jobs: /retest

tolusha · 2026-07-17T12:46:34Z

@akurinnoy
You forgot to update cluster_role.yaml

The operator needs image.openshift.io/imagestreams get and list in its own ClusterRole to pass Kubernetes RBAC escalation checks when reconciling the workspace user ClusterRole. Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

openshift-ci · 2026-07-17T16:01:11Z

New changes are detected. LGTM label has been removed.

akurinnoy · 2026-07-17T16:01:50Z

@tolusha fixed

openshift-ci · 2026-07-17T18:27:30Z

@akurinnoy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-devworkspace-happy-path	`e90311a`	link	true	`/test v19-devworkspace-happy-path`
ci/prow/v19-upgrade-stable-to-next	`e90311a`	link	true	`/test v19-upgrade-stable-to-next`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tolusha · 2026-07-20T11:14:02Z

/che-ai-assistant claude Run make update-dev-resources to update operator resources in order to fix PR checks

Task completed.

tolusha · 2026-07-20T11:18:59Z

CI Check Failure: Resources Validation

The resources-validation CI check is failing with the following error:

[ERROR] Resources are not up to date.
[ERROR] Run 'make update-dev-resources' to update them.

Analysis

The PR adds ImageStream RBAC permissions to the OpenShift-specific ClusterRole, but the generated deployment resources (bundle manifests, helm charts, and k8s deployment files) have not been regenerated to reflect this change.

Required Action

Someone with a properly configured development environment needs to run:

make update-dev-resources

This will:

Update UBI8 base image references
Regenerate bundle manifests (make bundle CHANNEL=next)
Regenerate deployment manifests (make gen-deployment)
Update Helm charts (make update-helmcharts CHANNEL=next)
Format the code (make fmt)

Why This Failed

The automated fix attempt failed because the workspace environment lacks the required Go toolchain and other dependencies. The make update-dev-resources target requires:

Go (1.21+)
controller-gen
kustomize
skopeo
jq
addlicense

These tools are available in the quay.io/eclipse/che-operator-dev:latest container specified in the devfile.

Recommendation

Option A (Local): Run make update-dev-resources locally in a dev environment
Option B (DevWorkspace): Use a DevWorkspace with the che-operator devfile which has all required tools pre-installed
Commit and push the generated changes

Once the generated resources are updated and committed, the resources-validation check should pass.

akurinnoy requested review from SDawley, dkwon17, ibuziuk, mkuznyetsov and tolusha as code owners July 9, 2026 09:48

akurinnoy mentioned this pull request Jul 9, 2026

fix: propagate backup listing errors to frontend eclipse-che/che-dashboard#1632

Open

tolusha approved these changes Jul 9, 2026

View reviewed changes

openshift-ci Bot assigned tolusha Jul 9, 2026

openshift-ci Bot added the lgtm label Jul 9, 2026

rohanKanojia approved these changes Jul 9, 2026

View reviewed changes

openshift-ci Bot assigned rohanKanojia Jul 9, 2026

openshift-ci Bot removed the lgtm label Jul 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: grant workspace users ImageStream read access#2152

fix: grant workspace users ImageStream read access#2152
akurinnoy wants to merge 2 commits into
mainfrom
fix/crw-10984-imagestream-rbac

akurinnoy commented Jul 9, 2026

Uh oh!

tolusha commented Jul 9, 2026

Uh oh!

openshift-ci Bot commented Jul 9, 2026

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

tolusha commented Jul 17, 2026 •

edited

Loading

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

akurinnoy commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

tolusha commented Jul 20, 2026 •

edited

Loading

Uh oh!

tolusha commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

akurinnoy commented Jul 9, 2026

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

OpenShift

PR Checklist

Reviewers

Uh oh!

tolusha commented Jul 9, 2026

Uh oh!

openshift-ci Bot commented Jul 9, 2026

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

tolusha commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tolusha commented Jul 17, 2026

FAILED resources-validation (GHA)

FAILED ci/prow/v19-devworkspace-happy-path (Prow)

FAILED ci/prow/v19-upgrade-stable-to-next (Prow)

Uh oh!

tolusha commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

akurinnoy commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

tolusha commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tolusha commented Jul 20, 2026

CI Check Failure: Resources Validation

Analysis

Required Action

Why This Failed

Recommendation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tolusha commented Jul 17, 2026 •

edited

Loading

tolusha commented Jul 20, 2026 •

edited

Loading