Use che.infrastructure.kubernetes.namespace.default during workspace namespace resolution

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

@@ -377,31 +377,33 @@ che.infra.kubernetes.server_strategy=default-host
 # Used to generate domain for a server in a workspace in case property `che.infra.kubernetes.server_strategy` is set to `multi-host`
 che.infra.kubernetes.ingress.domain=
 
+# DEPRECATED - please do not change the value of this property otherwise the existing workspaces will loose data. Do not
+# set it on new installations.
+#
 # Defines Kubernetes namespace in which all workspaces will be created.
 # If not set, every workspace will be created in a new namespace, where namespace = workspace id
 # It's possible to use <username> and <userid> placeholders (e.g.: che-workspace-<username>).
 # In that case, new namespace will be created for each user. Service account with permission
 # to create new namespace must be used.
 #
 # Ignored for OpenShift infra. Use `che.infra.openshift.project` instead
+#
+# If the namespace pointed to by this property exists, it will be used for all workspaces. If it does not exist,
+# the namespace specified by the che.infra.kubernetes.namespace.default will be created and used.
 che.infra.kubernetes.namespace=
 
 # Defines Kubernetes default namespace in which user's workspaces are created
 # if user does not override it.
-# It's possible to use <username> and <userid> placeholders (e.g.: che-workspace-<username>).
-# In that case, new namespace will be created for each user.
+# It's possible to use <username>, <userid> and <workspaceid> placeholders (e.g.: che-workspace-<username>).
+# In that case, new namespace will be created for each user (or workspace).
 # Is used by OpenShift infra as well to specify Project
-#
-# BETA It's not fully supported by infra.
-# Use che.infra.kubernetes.namespace to configure workspaces' namespace
 che.infra.kubernetes.namespace.default=<username>-che
 
 # Defines if a user is able to specify Kubernetes namespace different from default.
 # It's NOT RECOMMENDED to configured true without OAuth configured.
 # Is used by OpenShift infra as well to allows users choose Project
 #
-# BETA It's not fully supported by infra.
-# Use che.infra.kubernetes.namespace to configure workspaces' namespace
+# BETA This is not currently supported and setting it to true doesn't have any effect.
 che.infra.kubernetes.namespace.allow_user_defined=false
 
 # Defines Kubernetes Service Account name which should be specified to be bound to all workspaces pods.
@@ -606,11 +608,17 @@ che.infra.kubernetes.runtimes_consistency_check_period_min=-1
 # OpenShift infrastructure reuse most of the Kubernetes configuration attributes.
 #
 
+# DEPRECATED - please do not change the value of this property otherwise the existing workspaces will loose data. Do not
+# set it on new installations.
+#
 # Defines OpenShift namespace in which all workspaces will be created.
 # If not set, every workspace will be created in a new project, where project name = workspace id
 # It's possible to use <username> and <userid> placeholders (e.g.: che-workspace-<username>).
 # In that case, new project will be created for each user. OpenShift oauth or service account with
 # permission to create new projects must be used.
+#
+# If the project pointed to by this property exists, it will be used for all workspaces. If it does not exist,
+# the namespace specified by the che.infra.kubernetes.namespace.default will be created and used.
 che.infra.openshift.project=
 
 # Single port mode wildcard domain host & port. nip.io is used by default

deploy/kubernetes/helm/che/templates/configmap.yaml

@@ -50,7 +50,7 @@ data:
 {{- if and .Values.global.multiuser .Values.customOidcUsernameClaim }}
   CHE_KEYCLOAK_USERNAME__CLAIM: {{ .Values.customOidcUsernameClaim }}
 {{- end }}
-  CHE_INFRA_KUBERNETES_NAMESPACE: {{ .Values.global.cheWorkspacesNamespace | quote}}
+  CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT: {{ .Values.global.cheWorkspacesNamespace | quote}}
   CHE_INFRA_KUBERNETES_SERVICE__ACCOUNT__NAME: {{ .Values.global.cheWorkspaceServiceAccount }}
   CHE_INFRA_KUBERNETES_TRUST__CERTS: "false"
   CHE_INFRA_KUBERNETES_PVC_STRATEGY: "common"

deploy/kubernetes/helm/che/templates/deployment.yaml

@@ -85,9 +85,9 @@ spec:
               optional: false
         {{- end }}
 
-        # If workspaces are created in different namespace than Che Server's one
+        # If workspaces are created in a separate precreated namespace
         # then configure Che Server to propagate TLS secret to workspaces' namespaces
-        {{- if ne .Release.Namespace .Values.global.cheWorkspacesNamespace }}
+        {{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
         - name: "CHE_INFRA_KUBERNETES_TLS__CERT"
           valueFrom:
             secretKeyRef:

deploy/kubernetes/helm/che/templates/exec-role.yaml

@@ -7,7 +7,7 @@
 # SPDX-License-Identifier: EPL-2.0
 #
 
-{{- if (.Values.global.cheWorkspacesNamespace) }}
+{{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:

deploy/kubernetes/helm/che/templates/workspace-exec-role-binding.yaml

@@ -7,7 +7,7 @@
 # SPDX-License-Identifier: EPL-2.0
 #
 
-{{- if (.Values.global.cheWorkspacesNamespace) }}
+{{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:

deploy/kubernetes/helm/che/templates/workspace-service-account.yaml

@@ -7,7 +7,7 @@
 # SPDX-License-Identifier: EPL-2.0
 #
 
-{{- if (.Values.global.cheWorkspacesNamespace) }}
+{{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
 kind: ServiceAccount
 apiVersion: v1
 metadata:

deploy/kubernetes/helm/che/templates/workspace-view-role-binding.yaml

@@ -7,7 +7,7 @@
 # SPDX-License-Identifier: EPL-2.0
 #
 
-{{- if (.Values.global.cheWorkspacesNamespace) }}
+{{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:

deploy/kubernetes/helm/che/templates/workspace-view-role.yaml

@@ -7,7 +7,7 @@
 # SPDX-License-Identifier: EPL-2.0
 #
 
-{{- if (.Values.global.cheWorkspacesNamespace) }}
+{{- if not (contains "<" .Values.global.cheWorkspacesNamespace) }}
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:

deploy/kubernetes/helm/che/values.yaml

@@ -53,11 +53,11 @@ global:
   gitHubClientID: ""
   gitHubClientSecret: ""
   pvcClaim: "1Gi"
-  cheWorkspacesNamespace: ""
+  cheWorkspacesNamespace: "<username>-che"
   # Service account name that will be mounted to workspaces pods
   # Note that:
-  # if `cheWorkspacesNamespace` is configured then service account with configured name will be created by helm chart during deploying Che
-  # if `cheWorkspacesNamespace` is empty then Che Server creates new namespace for each workspace and ensures that configured SA exists there
+  # if `cheWorkspacesNamespace` doesn't contain placeholders then service account with configured name will be created by helm chart during deploying Che
+  # if `cheWorkspacesNamespace` contains placeholders then Che Server creates new namespaces accordingly and ensures that configured SA exists there
   cheWorkspaceServiceAccount: "che-workspace"
   # If set, Che will bind the specified cluster role to the workspace service account when creating a workspace.
   cheWorkspaceClusterRole: ""

infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/namespace/KubernetesNamespace.java

@@ -11,6 +11,8 @@
  */
 package org.eclipse.che.workspace.infrastructure.kubernetes.namespace;
 
+import static java.lang.String.format;
+
 import com.google.common.annotations.VisibleForTesting;
 import io.fabric8.kubernetes.api.model.ConfigMap;
 import io.fabric8.kubernetes.api.model.DoneableServiceAccount;
@@ -117,6 +119,12 @@ void prepare() throws InfrastructureException {
     }
   }
 
+  void delete() throws InfrastructureException {
+
+    KubernetesClient client = clientFactory.create(workspaceId);
+    delete(name, client);
+  }
+
   /** Returns namespace name */
   public String getName() {
     return name;
@@ -214,6 +222,25 @@ private void create(String namespaceName, KubernetesClient client)
     }
   }
 
+  private void delete(String namespaceName, KubernetesClient client)
+      throws InfrastructureException {
+    try {
+      client.namespaces().withName(namespaceName).delete();
+    } catch (KubernetesClientException e) {
+      if (e.getCode() == 404) {
+        LOG.warn(
+            format(
+                "Tried to delete namespace '%s' but it doesn't exist in the cluster.",
+                namespaceName),
+            e);
+      } else if (e.getCode() == 409) {
+        LOG.info(format("The namespace '%s' is currently being deleted.", namespaceName), e);
+      } else {
+        throw new KubernetesInfrastructureException(e);
+      }
+    }
+  }
+
   /**
    * Waits few seconds until 'default' service account become available otherwise an infrastructure
    * exception will be thrown.