Add CAP_CHOWN when hostUsers: false and procMount: Unmasked

[cgruver]

What does this PR do?

Adds CAP_CHOWN to workspaces where Container Run is enabled in the CheCluster

What issues does this PR fix or reference?

eclipse-che/che#23748

How to test this PR?

1. Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

2. Deploy a workspace from a Che instance with Container Run enabled.

Observe that the workspace pod has CAP_CHOWN enabled.

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

Common Test Scenarios

• Deploy Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Hi @cgruver. Thanks for your PR.

I'm waiting for a eclipse-che member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cgruver, rohanKanojia

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cgruver]

Note: I flipped this to Ready For Review, but I have not built and run a local test of the changes yet.

I get an error on make update-go-dependencies

che-operator (main) $ make update-go-dependencies
go: errors parsing go.mod:
/projects/che-operator/go.mod:3: invalid go version '1.25.5': must match format 1.23
go: errors parsing go.mod:
/projects/che-operator/go.mod:3: invalid go version '1.25.5': must match format 1.23
make: *** [Makefile:297: update-go-dependencies] Error 1

[rohanKanojia]

@cgruver : It seems you need to update go version on your local system. Project requires Go 1.25.5

che-operator/go.mod

Line 3 in a322f87

go 1.25.5

[cgruver]

@rohanKanojia I'm doing the development in a Dev Spaces workspace, I think we need to update the dev image that is specified in the devfile.yaml.

[tolusha]

@cgruver
Since the defaults in the CheCluster CR have been updated, all existing installations will retain the previous values without CAP_CHOWN. Is that acceptable?

[tolusha]

Changes in stable have to be reverted.
helmcharts/stable/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml
bundle/stable/eclipse-che/manifests/org.eclipse.che_checlusters.yaml

[cgruver]

@cgruver Since the defaults in the CheCluster CR have been updated, all existing installations will retain the previous values without CAP_CHOWN. Is that acceptable?

Users that have enabled container run will likely need a way to update to the new config without having to recreate the CheCluster.

[cgruver]

@tolusha If you want to take over this PR, or even recreate it, my feelings will not be hurt. ;-)

I made these changes just to see how big the effort might be. But, I don't know the nuances of the different install paths.

We just need to get CAP_CHOWN added to support running containers with systemd in a workspace that has a writable cgroupfs.

[tolusha]

If you want to take over this PR, or even recreate it, my feelings will not be hurt. ;-)

Yes, I would like to work on this issue.

[cgruver]

@cgruver Since the defaults in the CheCluster CR have been updated, all existing installations will retain the previous values without CAP_CHOWN. Is that acceptable?

Users that have enabled container run will likely need a way to update to the new config without having to recreate the CheCluster.

@tolusha One clarification, if by existing installations you mean existing workspaces, I don't think that is a problem. Workspaces should be disposable. This feature should modify the existing DWOC that is managed by the Operator so that any new, or recreated workspaces get the added feature.