fix: identical endpoint name conflicts

[akurinnoy]

What does this PR do?

This PR implements conflict detection and prevention at both the controller and webhook levels.

What issues does this PR fix or reference?

fixes eclipse-che/che#23231

Is it tested? How?

Same-namespace conflict detection

1. Create test namespace

oc create namespace test-namespace

2. Create first namespace and wait for it to be running.

cat << EOF | oc apply -f -
apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: endpoint-test-1
  namespace: test-namespace
spec:
  started: true
  routingClass: basic
  template:
    components:
      - name: postgresql
        container:
          image: quay.io/fedora/postgresql-12:latest
          endpoints:
            - name: postgresql
              targetPort: 5432
              exposure: internal
              protocol: tcp
              attributes:
                discoverable: true
          env:
            - name: POSTGRESQL_USER
              value: user
            - name: POSTGRESQL_PASSWORD
              value: pass
            - name: POSTGRESQL_ROOT_PASSWORD
              value: root
            - name: POSTGRESQL_DATABASE
              value: db
EOF

oc wait --for=condition=Ready dw/endpoint-test-1 -n test-namespace --timeout=300s

3. Try to create second workspace with same discoverable endpoint name. This operation should fail.

cat << EOF | oc apply -f -
apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: endpoint-test-2
  namespace: test-namespace
spec:
  started: true
  routingClass: basic
  template:
    components:
      - name: postgresql
        container:
          image: quay.io/fedora/postgresql-12:latest
          endpoints:
            - name: postgresql
              targetPort: 5432
              exposure: internal
              protocol: tcp
              attributes:
                discoverable: true
          env:
            - name: POSTGRESQL_USER
              value: user
            - name: POSTGRESQL_PASSWORD
              value: pass
            - name: POSTGRESQL_ROOT_PASSWORD
              value: root
            - name: POSTGRESQL_DATABASE
              value: db
EOF

Expected result:

# "admission webhook "validate-devfile.devworkspace-controller.svc" denied the request: 
# discoverable endpoint 'postgresql' is already in use by workspace 'endpoint-test-1'"

Cross-name isolation

1. Create second namespace

oc create namespace test-namespace-2

2. Create workspace in second namespace with same endpoint name

cat << EOF | oc apply -f -
apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: endpoint-test-1
  namespace: test-namespace-2
spec:
  started: true
  routingClass: basic
  template:
    components:
      - name: postgresql
        container:
          image: quay.io/fedora/postgresql-12:latest
          endpoints:
            - name: postgresql
              targetPort: 5432
              exposure: internal
              protocol: tcp
              attributes:
                discoverable: true
          env:
            - name: POSTGRESQL_USER
              value: user
            - name: POSTGRESQL_PASSWORD
              value: pass
            - name: POSTGRESQL_ROOT_PASSWORD
              value: root
            - name: POSTGRESQL_DATABASE
              value: db
EOF

3. Verify both workspaces are running successfully

oc wait --for=condition=Ready dw/endpoint-test-1 -n test-namespace --timeout=300s
oc wait --for=condition=Ready dw/endpoint-test-1 -n test-namespace-2 --timeout=300s

4. Verify both workspaces have services with the same name

oc get svc postgresql -n test-namespace
oc get svc postgresql -n test-namespace-2

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy, tolusha
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[rohanKanojia]

I tested the PR with abovementioned steps and it seems to work as expected ✔️

[akurinnoy]

/retest

[dkwon17]

@akurinnoy is there a reason for implementing duplicate endpiont detection in both the webhook and the GetDiscoverableServicesForEndpoints function?

[akurinnoy]

While the webhook prevents the DevWorkspaces (which will cause endpoint conflicts) from being created, the controller checks other cases:

• two workspaces created simultaneously - both of them may pass the webhook validation
• services can be created from other sources
• old workspaces, created before this validation

Is this the answer to your question?

[rohanKanojia]

@akurinnoy : I ran your claude skill /ok-pr-review and it revealed this finding. Do you think it's a valid use case?

The webhook validation has a logic error that causes it to reject valid workspace creations. Currently, if the current workspace has a discoverable endpoint named X, and another workspace has any endpoint (discoverable OR NOT) named X, we reject it.

Steps to reproduce

• Create workspace A with a non-discoverable endpoint named "postgresql"

oc create -f - <<EOF
apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: workspace-a
  namespace: test-namespace
spec:
  started: true
  routingClass: basic
  template:
    components:
      - name: postgresql
        container:
          image: quay.io/fedora/postgresql-12:latest
          endpoints:
            - name: postgresql
              targetPort: 5432
              exposure: internal
              protocol: tcp
EOF

• Create workspace B with a discoverable endpoint named "postgresql" (gets rejected)

oc create -f - <<EOF
apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: workspace-b
  namespace: test-namespace
spec:
  started: true
  routingClass: basic
  template:
    components:
      - name: postgresql
        container:
          image: quay.io/fedora/postgresql-12:latest
          endpoints:
            - name: postgresql
              targetPort: 5432
              exposure: internal
              protocol: tcp
              attributes:
                discoverable: true
EOF

Do you think Workspace B should be allowed because Workspace A's endpoint is NOT discoverable and doesn't create a service named postgresql?