feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator

[tolusha]

What does this PR do?

Moves workspace NetworkPolicy provisioning from Che Operator to the DevWorkspace Operator, and reworks the NetworkPolicies Che Operator creates for its own components.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

• Depends on DevWorkspace Operator changes: chore: networkpolicy provisioning devfile/devworkspace-operator#1710, chore: pass operator namespace to GetDefaultNetworkPolicy devfile/devworkspace-operator#1719, fix: preserve deny-all NetworkPolicy config and stop mutating defaultConfig devfile/devworkspace-operator#1721

How to test this PR?

1. Deploy the operator:

OpenShift

oc create namespace devworkspace-controller
oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml

OPERATOR_IMAGE=<...>
sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f  -
oc wait --for=condition=Ready pod -l app.kubernetes.io/component=che-operator -n eclipse-che --timeout=60s
oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active   --timeout=120s

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

TODO

Common Test Scenarios

• Deploy Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added configurable network policies for DevWorkspaces, including custom ingress and egress rules alongside operator-provided defaults.
  • Network policies now apply to Che pods in the CheCluster namespace on both Kubernetes and OpenShift.
• Bug Fixes
  • Network policies default to the configured default when the setting is omitted.
  • OpenShift workspace namespaces are cleaned up of legacy operator-managed network policies.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant claude — Run a free-form instruction on this PR
• /che-ai-assistant help — Show this help message

[github-actions]

🐳 New images available:

• quay.io/eclipse/che-operator:pr-2228-amd64
• quay.io/eclipse/che-operator:pr-2228-arm64
• quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-amd64
• quay.io/eclipse/eclipse-che-olm-catalog:pr-2228-arm64