Use the user's roles for Kubernetes roles in Che workspaces

[johnmcollier]

Description

I'm from the Eclipse Codewind project, and we have a plugin for its integration with Che (https://github.com/eclipse/codewind-che-plugin). On Che, Codewind allows users to create Kubernetes deployments and services for their application. However, the default roles given to the Che workspace aren't enough for that, and we currently tell users to set cheWorkspaceClusterRole (https://github.com/eclipse/che-operator/blob/master/deploy/crds/org_v1_che_cr.yaml#L28) when installing Che, so that Codewind can function properly.

It'd be nice if we had a way for workspaces (maybe via the devfile?), to specify and link to a Kubernetes role that can be used for the workspace. Then, when the workspace was created, a role binding would be created linking to that cluster role. That way, workspaces that require increased cluster roles (such as Codewind), could then be created from a default installation of Che, without additional work needed by the user.

I suppose if this was done, we'd also want something in the UI to tell the user that the workspace they're creating requires hightened roles.

[l0rd]

@johnmcollier I think it may be related to this issue #13488

In other words the best way to solve this problem is to use the current user privileges instead of an hardcoded role that it's set as a che-server property. If we let user define their role in a devfile it would result in a privilege escalation.

[johnmcollier]

@l0rd That's a good point. I'm good with using the current user's privileges, instead of some arbitrary role that users (or plugins) define.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.