chore: Add hostUsers field to DWOC

[tolusha]

What does this PR do?

Add hostUsers field to DWOC

What issues does this PR fix or reference?

#1492

Is it tested? How?

OpenShift

1. Enable UserNamespacesSupport feature on the cluster

oc patch FeatureGate cluster --type merge --patch '{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["UserNamespacesSupport", "UserNamespacesPodSecurityStandards"]}}}'

Wait for a while (sleep 15m)

2. Deploy DWO

oc create namespace devworkspace-controller
sed 's#quay.io/devfile/devworkspace-controller:next#quay.io/abazko/devworkspace-controller:1492#g' deploy/deployment/openshift/combined.yaml | oc apply -f -

3. Create DWOC

oc apply -f - <<EOF
apiVersion: controller.devfile.io/v1alpha1
kind: DevWorkspaceOperatorConfig
metadata:
  name: devworkspace-operator-config
  namespace: devworkspace-controller
config:
  workspace:
    hostUsers: false
    podSecurityContext:
      runAsGroup: 1001  # 65536 is a max id inside a user namespace
      runAsUser: 1001    # 65536 is a max id inside a user namespace
    serviceAccount:
      serviceAccountName: user-sa
EOF

4. Create SCC

oc apply -f - <<EOF
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: user-namespace
priority: null
allowPrivilegeEscalation: true
fsGroup:          
  type: MustRunAs     
  ranges:          
  - min: 1000             
    max: 65534
runAsUser:       
  type: MustRunAsRange                                                                     
  uidRangeMin: 1000
  uidRangeMax: 65534 
seLinuxContext:              
  type: MustRunAs     
  seLinuxOptions:                      
    type: container_engine_t
supplementalGroups:
  type: MustRunAs
  ranges:
  - min: 1000
    max: 65534                
userNamespaceLevel: RequirePodLevel
EOF

5. Create a user namespace

oc create namespace test

6. Create RBAC

oc create role user-sa-scc --verb=use --resource=scc --resource-name=user-namespace -n test
oc create rolebinding user-sa-scc --role=user-sa-scc --serviceaccount=test:user-sa --namespace=test

oc create clusterrole dw-scc --verb=use,get,update --resource=scc --resource-name=user-namespace 
oc create clusterrolebinding dw-scc --clusterrole=dw-scc --serviceaccount=devworkspace-controller:devworkspace-controller-serviceaccount

7. Create DW

oc apply -f - <<EOF
kind: DevWorkspace
apiVersion: workspace.devfile.io/v1alpha2
metadata:
  name: test
  namespace: test
spec:
  started: true
  template:
    attributes:
      controller.devfile.io/storage-type: ephemeral
    components:
      - name: tooling-container
        container:
          image: quay.io/devfile/universal-developer-image:ubi9-latest
          cpuLimit: 100m
          cpuRequest: 100m
EOF

8. Check that pod is up and running
9. Check hostUsers field

% oc get pod -n test -o yaml -o jsonpath="{.items[0].spec.hostUsers}"
false

10. Stop DW

oc patch devworkspace test --type merge --patch '{"spec":{"started":false}}' -n test

11. Update DWOC

oc replace -f - <<EOF
apiVersion: controller.devfile.io/v1alpha1
kind: DevWorkspaceOperatorConfig
metadata:
  name: devworkspace-operator-config
  namespace: devworkspace-controller
config:
  workspace:
    hostUsers: true
    serviceAccount:
      serviceAccountName: user-sa
EOF

12. Start DW

oc patch devworkspace test --type merge --patch '{"spec":{"started":true}}' -n test

13. Check hostUsers field

% oc get pod -n test -o yaml -o jsonpath="{.items[0].spec.hostUsers}"
true

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[dkwon17]

LGTM, just a small comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy, rohanKanojia, tolusha
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment