Use edit role for Che SA

[ghost]

What does this PR do?

It looks like Che service account may have edit role to be able to create workspaces in the same namespace with Che server pod

What issues does this PR fix or reference?

#11142

[ghost]

ci-test

[sleshchenko]

LGTM

Please change PR title to make clear that it affects OpenShift deployment only

[sleshchenko]

maybe it makes describe in the documentation that CHE_INFRA_OPENSHIFT_PROJECT must be set to:

1. the same with Che Server namespace
2. empty value then oauth provider must be used
3. any value different from Che Server namespace then cluster admin roles should be bound to Che service account (not sure that we need this way of configuration)

[ghost]

Currently Che service account does not have cluster wide privileges so it is a general documentation improvement not really related to this particular PR. But good point.

[garagatyi]

Will we use the same role to create namespaces for workspaces?

[ghost]

In this case, a cluster admin should grant Che SA cluster-admin privileges:

oc adm policy add-cluster-role-to-user self-provisioner system:serviceaccount:eclipse-che:che

For k8s we do that out of the box: https://github.com/eclipse/che/blob/master/deploy/kubernetes/helm/che/templates/cluster-role-binding.yaml#L16

And this makes it possible to set this env to empty string by default and things work out of the box.

So, to sum it up - on OpenShift we NEVER granted Che SA cluster-admin role while it was true for Kubernetes Helm charts. Hence, if we do the same change for k8s, then, https://github.com/eclipse/che/blob/master/deploy/kubernetes/helm/che/values.yaml#L47 should be namespace where Che SA has been created. And if a cluster admin wants Che to create workspaces in individual namespaces, Che SA is granted a cluster-admin role and https://github.com/eclipse/che/blob/master/deploy/kubernetes/helm/che/values.yaml#L47 becomes an empty string.

[garagatyi]

Does it mean that we don't have right now an OS deployment option where Che creates namespaces?

[l0rd]

@garagatyi this option should be supported when Che is configured to use users tokens. Giving cluster-admin privileges to Che is something that we should not support: you can do it at your own risk :-)

[riuvshin]

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:11177
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

[ghost]

ci-test

[riuvshin]

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:11177
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.