feat: Manage OpenVSX as Che operand

[svor]

What does this PR do?

• Deploy and manage a dedicated OpenVSX server and PostgreSQL database as Che operands,
  enabled via spec.components.openVSX.enable
• Expose OpenVSX via the Che gateway, the registry is available by https://<cheHost>/openvsx
• Auto-seed the database with a privileged user and admin PAT via a one-shot Job
• Support publishing extensions from a user-editable openvsx-extensions ConfigMap
• Persist extension storage on a PVC (default 3Gi, configurable via
  spec.components.openVSX.server.claimSize)
• Make openvsx-server-config ConfigMap user-editable with automatic pod rollout on
  changes

Resources created when enabled

• openvsx-database: Deployment, Service, PVC, credentials Secret
• openvsx-server: Deployment, Service, PVC, ConfigMap (application config), ConfigMap
  (extensions list)
• openvsx-database-provision: one-shot Job to seed DB users and PATs, the job auto-deletes after 60s
• openvsx-server-publisher: Job to publish extensions from the extensions ConfigMap

All resources are cleaned up when openVSX.enable is set to false.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://issues.redhat.com/browse/CRW-10323

How to test this PR?

1. Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

Common Test Scenarios

Click me

Verification Steps for OpenVSX Operand

Prerequisites

• OpenShift cluster with Che operator deployed
• oc CLI logged in

1. Enable the internal OpenVSX registry

oc patch checluster eclipse-che -n eclipse-che --type merge \
  -p '{"spec":{"components":{"openVSXRegistry":{"enable":true}}}}'

2. Verify all pods are running

oc get pods -n eclipse-che | grep openvsx

Expected: openvsx-database and openvsx-server pods in Running state (1/1).

3. Verify the database provision job completed

oc get jobs -n eclipse-che | grep openvsx-database-provision

Expected: COMPLETIONS 1/1. The job auto-deletes after 60s, so check events if it's gone:

oc get events -n eclipse-che --field-selector reason=Completed | grep provision

4. Verify tokens were inserted into the database

oc exec -n eclipse-che deploy/openvsx-database -- \
  psql -U openvsx -d openvsx -c "SELECT id, active FROM personal_access_token WHERE id IN (1001, 1002);"

Expected: two rows with active = t.

5. Verify the status URL uses the gateway path

oc get checluster eclipse-che -n eclipse-che -o jsonpath='{.status.openVSXURL}'

Expected: https://<cheHost>/openvsx

6. Verify the gateway route works

curl -sk https://<cheHost>/openvsx/api/version

Expected: JSON response with version info (e.g., "version":"v1.0.1").

7. Verify the WebUI loads

Open https://<cheHost>/openvsx in a browser. The OpenVSX SPA should load with working navigation.

8. Verify extension publishing

Edit the openvsx-server-extensions ConfigMap by adding a list of extensions:

oc edit configmap openvsx-server-extensions -n eclipse-che

Add the following under data.extensions.list:

https://open-vsx.org/api/redhat/vscode-xml/0.29.0/file/redhat.vscode-xml-0.29.0.vsix
https://open-vsx.org/api/redhat/vscode-yaml/1.18.0/file/redhat.vscode-yaml-1.18.0.vsix
https://open-vsx.org/api/vscjava/vscode-java-debug/0.58.2/file/vscjava.vscode-java-debug-0.58.2.vsix
https://open-vsx.org/api/redhat/java/1.43.1/file/redhat.java-1.43.1.vsix
https://open-vsx.org/api/vscode/html-language-features/1.95.3/file/vscode.html-language-features-1.95.3.vsix
https://open-vsx.org/api/redhat/vscode-microprofile/0.14.0/file/redhat.vscode-microprofile-0.14.0.vsix
https://open-vsx.org/api/redhat/vscode-quarkus/1.21.0/file/redhat.vscode-quarkus-1.21.0.vsix

Then check the publisher Job:

oc get pods -n eclipse-che | grep publisher
oc logs -n eclipse-che -l app.kubernetes.io/component=openvsx-server-publisher

Expected: extensions published successfully, no ECONNREFUSED or auth errors.

Open https://<cheHost>/openvsx in a browser and verify the published extensions are visible.

9. Verify new registry is used by workspace

Create any workspace and check available extensions in the Extensions view.

10. Verify disable cycle

oc patch checluster eclipse-che -n eclipse-che --type merge \
  -p '{"spec":{"components":{"openVSXRegistry":{"enable":false}}}}'

Verify all OpenVSX resources are cleaned up.
Restart the workspace and see that default openvsx.org registry is used

11. Verify custom credentials secret

Create a secret with all 7 required keys before enabling OpenVSX:

oc create secret generic my-openvsx-credentials -n eclipse-che \
  --from-literal=database-user=myuser \
  --from-literal=database-password=mypassword \
  --from-literal=database-name=mydb \
  --from-literal=openvsx-publisher-name=my-publisher \
  --from-literal=openvsx-publisher-token=my-publisher-token-value-32chars \
  --from-literal=openvsx-admin-name=my-admin \
  --from-literal=openvsx-admin-token=my-admin-token-value-32chars1234

Enable OpenVSX with the custom secret:

oc patch checluster eclipse-che -n eclipse-che --type merge \
  -p '{"spec":{"components":{"openVSXRegistry":{"enable":true,"credentialsSecretName":"my-openvsx-credentials"}}}}'

Verify the components use the custom secret:

# Check the server deployment references the custom secret
oc get deploy openvsx-server -n eclipse-che -o jsonpath='{.spec.template.spec.containers[0].env}' | grep my-openvsx-credentials

# Check the database deployment references the custom secret
oc get deploy openvsx-database -n eclipse-che -o jsonpath='{.spec.template.spec.containers[0].env}' | grep my-openvsx-credentials

# Verify the token in the database matches the custom secret
oc exec -n eclipse-che deploy/openvsx-database -- \
  psql -U myuser -d mydb -c "SELECT id, active FROM personal_access_token WHERE id IN (1001, 1002);"

Expected: both deployments reference my-openvsx-credentials, and PATs are inserted with active = t.

12. Verify server configuration can be patched via ConfigMap

The openvsx-server ConfigMap holds the Spring Boot application.yml. The operator creates it with CreateIfNotExists, so manual edits are preserved. Editing the ConfigMap triggers an automatic server restart via the CONFIG_REVISION mechanism.

Edit the ConfigMap:

oc edit configmap openvsx-server -n eclipse-che

For example, change the registry version from v1.0.1 to 2.

Verify the server pod restarts automatically:

# Watch the pod restart (the operator detects the ConfigMap ResourceVersion change
# and updates the CONFIG_REVISION env var, triggering a rolling restart)
oc get pods -n eclipse-che -w | grep openvsx-server

Expected: the openvsx-server pod restarts with the updated configuration. Verify the change took effect:

curl -sk https://<cheHost>/openvsx/api/version

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant help — Show this help message

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: svor, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tolusha]

@svor
Good job!

[svor]

/che-ai-assistant generate-che-doc