[che-dev] Add metadata.namespace to Devfile

[Lukas Krejci <lkrejci@xxxxxxxxxx>]

Hi all,

We're adding the ability to specify the namespace in which a workspace
should be created and we are thinking where is the best place to put it.

Kubernetes objects have a optional "metadata.namespace" field, that
defaults to "default" or whatever is supplied as -n to kubectl.

This led us to the idea that devfile, too, should have such a field with
very similar semantics:

* optional with the default determined by the Che server (using our
config vars for specifying the namespace)
* non-editable

This has some nice consequences:
* it would bring devfile yet another tiny bit closer to other k8s objects
* because namespace would become part of the devfile model, it would be
consistent with all other devfile value overrides I asked about in my
previous email
(https://www.eclipse.org/lists/che-dev/msg03420.html).

Not having the namespace in the devfile model would require special
handling of the namespace in our REST API - both in factory and the
workspace APIs, which seems a little bit ugly compared to "just override
it as any other devfile attribute".

WDYT? Do you have some concerns about this idea? Do you have some
alternative proposals that would make workspace namespace nicely
integrated into our APIs?

For those concerned about the possible security issues (like for example
trying to submit a malicious devfile into kube-system namespace), the
ability to specify a user-defined namespace can be switched off
completely in the che server and our service account can be configured
with limited ability to deploy stuff in certain namespaces.

Thanks,

Lukas

Attachment: signature.asc
Description: OpenPGP digital signature