Add support for Kubernetes and OpenShift-type DevWorkspace components

[amisevsk]

What does this PR do?

Add support for components of type Kubernetes and OpenShift to the DevWorkspace Operator, with the caveats

• deployByDefault=false components are ignored
• Only inlined components are permitted, to allow to checking RBAC (so that user can't effectively impersonate the controller serviceaccount)
• RBAC objects/DevWorkspaces/DevWorkspaceTemplates are not allowed

What issues does this PR fix or reference?

Closes #798

Is it tested? How?

Test by creating DevWorkspaces that use kubernetes components, e.g.:

kind: DevWorkspace
apiVersion: workspace.devfile.io/v1alpha2
metadata:
  name: test-dw
spec:
  started: true
  template:
    attributes:
      controller.devfile.io/storage-type: ephemeral
    components:
      - name: terminal
        container:
          image: quay.io/wto/web-terminal-tooling:next
          memoryLimit: 512Mi
          mountSources: true
          command:
           - "tail"
           - "-f"
           - "/dev/null"
      - name: test-service
        kubernetes:
          deployByDefault: true
          inlined: |
            apiVersion: v1
            kind: Service
            metadata:
              name: test-service
              labels:
                testing: "true"
            spec:
              selector:
                test: test-app
              ports:
              - port: 8080
                targetPort: 8081
      - name: test-pod
        openshift:
          deployByDefault: true
          inlined: |
            apiVersion: v1
            kind: Pod
            metadata:
              name: test-pod
              labels:
                test: test-app
            spec:
              containers:
              - name: test-container
                image: quay.io/wto/web-terminal-tooling:next
                resources:
                  limits:
                    memory: "128Mi"
                    cpu: "500m"
                ports:
                  - containerPort: 8080
                command:
                  - "tail"
                  - "-f"
                  - "/dev/null"

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[AObuchow]

Looks good to me so far, did some testing on OpenShift 4.11 and seems to work as expected 👍

[ibuziuk]

design question, my undestanding that for k8s / openshift components user explicitly need to set deployByDefault=true?
As a developer, I'm wondering about the use-case when I craft a devfile, add the k8s component, and do not want it to be applied. For me it is not really clear the necessity of the DeployByDefault field in general

[amisevsk]

IIRC the idea behind deployByDefault = false is that an apply command could be used to create the resource on demand -- e.g. I run a VSCode task that creates a service/deployment on the cluster. I believe it's more relevant to the odo use case than it is for DWO, since in our case you could just store the yaml to apply in the repo itself. The original devfile/api issue is devfile/api#693.

One potential use case could be for creating resources without worrying about DWO's serviceAccount having the correct permissions.

[dkwon17]

Does it return true, false, because everything else is immutable/should not be changed?

[amisevsk]

Yes, most pod fields are technically immutable:

Forbidden: pod updates may not change fields other than `spec.containers[*].image`, 
`spec.initContainers[*].image`, `spec.activeDeadlineSeconds`, `spec.tolerations` (only 
additions to existing tolerations) or `spec.terminationGracePeriodSeconds` (allow it 
to be set to 1 if it was previously negative)

Using deployments obscures this fact by deleting + recreating pods when their .spec.template is updated, so those same fields are mutable there.

[ibuziuk]

no n&N

[ibuziuk]

👍

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisevsk, AObuchow, ibuziuk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [amisevsk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[codecov]

Codecov Report

Base: 54.11% // Head: 47.60% // Decreases project coverage by -6.51% ⚠️

Coverage data is based on head (d864400) compared to base (249ff61).
Patch coverage: 45.06% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #961      +/-   ##
==========================================
- Coverage   54.11%   47.60%   -6.52%     
==========================================
  Files          44       60      +16     
  Lines        2770     3504     +734     
==========================================
+ Hits         1499     1668     +169     
- Misses       1135     1693     +558     
- Partials      136      143       +7     

Impacted Files	Coverage Δ
webhook/workspace/handler/kubernetes.go	0.00% <0.00%> (ø)
webhook/workspace/handler/template.go	0.00% <0.00%> (ø)
webhook/workspace/handler/workspace.go	0.00% <0.00%> (ø)
pkg/library/kubernetes/errors.go	33.33% <33.33%> (ø)
pkg/library/kubernetes/deserialize.go	76.47% <76.47%> (ø)
pkg/library/kubernetes/provision.go	80.39% <80.39%> (ø)
pkg/library/kubernetes/util.go	92.85% <92.85%> (ø)
webhook/workspace/handler/warning.go	100.00% <100.00%> (ø)
webhook/workspace/handler/metadata.go	0.00% <0.00%> (ø)
webhook/workspace/handler/immutable.go	0.00% <0.00%> (ø)
... and 7 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.