Default namespace strategy should be 1 namespace per user

[sunix]

Describe the bug

Following the documentation, https://www.eclipse.org/che/docs/che-7/installation-guide/installing-che-on-google-cloud-platform/
The default namespace strategy was 1 namespace for all che:

This installation was done with chectl nightly-build 2 months ago (September 2020).

Expected behavior

Have a namespace per user strategy by default, something like:

CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT=che-ws-<username>

[sparkoo]

this is mostly operator issue with permissions. IMHO it is duplicate of this #15493 which even has open PR eclipse-che/che-operator#166 which I've started almost a year ago eclipse-che/che-operator#137 :)

I believe it was not done because it works on openshift with oauth and we don't want to have so wide permissions for che-operator. It's probably worth to revisit.

[sunix]

Thanks @sparkoo! Is the procedure with permission documented?

[sparkoo]

Thanks @sparkoo! Is the procedure with permission documented?

I don't think so and I agree that this should be at least documented. Something like "if you want to have namespace per user strategy, grant these cluster permissions ClusterRole blablabla to che SA and set server.workspaceNamespaceDefault:'che-<username>'"...

[sunix]

In my opinion, during installation, chectl should warn the user that namespace per user strategy couldn't be used because of ClusterRole permission. and link to the doc how to do it.
@l0rd WDYT?

[sparkoo]

@sunix I disagree with this. We should set our defaults to work as smooth as possible. Having a installer that by default does not install working product and link me to documentation is big UX flaw. We can add a warning to do some manual steps, but don't set such cases as defaults.

[sunix]

@sparkoo the user is expecting to have 1 namespace for all his workspace. This is recommended, and some features rely on it (for instance using user secrets) and we have to be consistent in all our installations as much as we can.

The installer should:

1. check permission if it can use the 1 namespace per user strategy .
2. If yes set the 1 namespace per user strategy
3. If not, fallback to install the workspace in the che namespace, and warn the user how to do that whatever doc or in the warning message. But we should have it in the doc anyway.

I don't see any UX problem with that.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.

[skabashnyuk]

Already implemented