chore: Add hostUsers field to DWOC

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -196,6 +196,13 @@ type WorkspaceConfig struct {
 	// If not specified or "0", the timeout is disabled.
 	// +kubebuilder:validation:Optional
 	PostStartTimeout string `json:"postStartTimeout,omitempty"`
+	// Controls whether the Pod uses the host's user namespace.
+	// If true (or omitted), the Pod runs in the host's user namespace.
+	// If false, a new user namespace is created for the Pod.
+	// This field is only used when the UserNamespacesSupport feature is enabled.
+	// If the feature is disabled, setting this field may cause an endless workspace start loop.
+	// +kubebuilder:validation:Optional
+	HostUsers *bool `json:"hostUsers,omitempty"`
 }
 
 type WebhookConfig struct {

pkg/config/defaults.go

@@ -82,6 +82,11 @@ var defaultConfig = &v1alpha1.OperatorConfiguration{
 			RetainTime: pointer.Int32(2592000),
 			Schedule:   "0 0 1 * *",
 		},
+		// Do not declare a default value for this field.
+		// Setting a default leads to an endless reconcile loop when UserNamespacesSupport is disabled,
+		// because in that case the field is ignored and always set to nil.
+		// See: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/
+		// HostUsers: pointer.Bool(true),
 	},
 }
 

pkg/config/sync.go

@@ -435,6 +435,10 @@ func mergeConfig(from, to *controller.OperatorConfiguration) {
 		if from.Workspace.PostStartTimeout != "" {
 			to.Workspace.PostStartTimeout = from.Workspace.PostStartTimeout
 		}
+
+		if from.Workspace.HostUsers != nil {
+			to.Workspace.HostUsers = from.Workspace.HostUsers
+		}
 	}
 }
 
@@ -680,6 +684,9 @@ func GetCurrentConfigString(currConfig *controller.OperatorConfiguration) string
 				config = append(config, fmt.Sprintf("workspace.cleanupCronJob.cronJobScript=%s", workspace.CleanupCronJob.Schedule))
 			}
 		}
+		if workspace.HostUsers != nil {
+			config = append(config, fmt.Sprintf("workspace.hostUsers=%t", *workspace.HostUsers))
+		}
 	}
 	if currConfig.EnableExperimentalFeatures != nil && *currConfig.EnableExperimentalFeatures {
 		config = append(config, "enableExperimentalFeatures=true")

pkg/provision/workspace/deployment.go

@@ -211,6 +211,7 @@ func getSpecDeployment(
 					ServiceAccountName:            saName,
 					AutomountServiceAccountToken:  nil,
 					RuntimeClassName:              workspace.Config.Workspace.RuntimeClassName,
+					HostUsers:                     workspace.Config.Workspace.HostUsers,
 				},
 			},
 		},