Merge remote-tracking branch 'upstream/master' into createInitialOpenshift4UserForOAuth

.github/workflows/release-che-docs.yml

@@ -0,0 +1,60 @@
+# This Workflow creates PRs for the release of the latest che-docs
+name: Release che docs
+on:
+  # manual trigger if required
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version that is going to be released. Should be in format 7.y.z'
+        required: true
+        default: '7.y.z'
+      forceflag:
+        description: 'To force creation of .x branch, use --force flag here'
+        default: ''
+  # trigger on commit to master branch of new CSVs, eg., https://github.com/eclipse/che-operator/pull/571/files
+  push:
+    branches: 
+      - master
+    paths:
+      - 'olm/eclipse-che-preview-*/deploy/olm-catalog/eclipse-che-preview-*/eclipse-che-preview-*.package.yaml'
+
+jobs:
+  build:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Release che docs PRs
+        run: |
+          hub version
+          git config --global user.name "Mykhailo Kuznietsov"
+          git config --global user.email "mkuznets@redhat.com"
+          export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
+          set -e
+          # if not run manually, need to compute che docs version from latest released CSV
+          if [[ "${{ github.event.inputs.version }}" == "" ]] || [[ "${{ github.event.inputs.version }}" == "7.y.z" ]]; then
+            chedocsVersion=$(cat olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/eclipse-che-preview-openshift.package.yaml | yq -r '.channels[].currentCSV' | sed -e "s#eclipse-che-preview-openshift.v##")
+          else
+            chedocsVersion="${{ github.event.inputs.version }}"
+          fi
+
+          # generic method to call a GH action and pass in a single var=val parameter 
+          invokeAction() {
+              this_repo=$1
+              this_action_name=$2
+              this_workflow_id=$3
+              this_var=$4
+              this_val=$5
+
+              # can compute using GH API
+              # workflow_id=$(curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" | jq --arg search_field "${this_action_name}" '.workflows[] | select(.name == $search_field).id'); # echo "workflow_id = $workflow_id"
+              # or just pass it in
+              workflow_id=$this_workflow_id
+
+              curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows/${workflow_id}/dispatches -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" -d "{\"ref\":\"master\",\"inputs\": {\"${this_var}\":\"${this_val}\"} }" || die_with "[ERROR] Problem invoking action https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22"
+              echo "[INFO] Invoked '${this_action_name}' action ($workflow_id) - see https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22"
+          }
+
+          # invoke action from che-docs repo
+          invokeAction eclipse/che-docs "Release Che Docs" "5193493" version "${chedocsVersion}"

.github/workflows/release-community-operator-PRs.yml

@@ -25,34 +25,22 @@ jobs:
         uses: actions/setup-python@v2
         with:
           python-version: 3.6
-      - name: Install operator courier, yq, and base32 wrapper
+      - name: Install operator courier, yq
         run: |
           python -m pip install --upgrade pip
           pip install operator-courier==2.1.7
           pip install yq
-          # get base32 util from che-release project
-          wget https://raw.githubusercontent.com/eclipse/che-release/master/utils/base32
-          # copy base32 python-based helper script into dir that's accessed from PATH (so it's accessible to this and other called scripts) 
-          sudo cp -f $(pwd)/base32 /usr/local/bin/ 
-          sudo chmod +x /usr/local/bin/base32
-          #remove base32 from current directory to avoid it being commited during release
-          rm $(pwd)/base32 
       - name: Release community operator PRs
         run: |
           hub version
           git config --global user.name "Mykhailo Kuznietsov"
           git config --global user.email "mkuznets@redhat.com"
-          export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
+          export GITHUB_TOKEN=${{ secrets.CHE_INCUBATOR_BOT_GITHUB_TOKEN }}
           set -e
           OP_SDK_DIR=/opt/operator-sdk
           mkdir -p $OP_SDK_DIR
-          if [[ ${CHE_VERSION%.*} == 7.21 ]];then
-            wget https://github.com/operator-framework/operator-sdk/releases/download/v0.10.0/operator-sdk-v0.10.0-x86_64-linux-gnu -O $OP_SDK_DIR/operator-sdk 
-          else
-            OPERATOR_SDK=$(sed -r 's|operator-sdk:\s*(.*)|\1|' REQUIREMENTS)
-            wget https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_SDK}/operator-sdk-${OPERATOR_SDK}-x86_64-linux-gnu -O $OP_SDK_DIR/operator-sdk 
-          fi
-          chmod +x $OP_SDK_DIR/operator-sdk
+          OPERATOR_SDK=$(sed -r 's|operator-sdk:\s*(.*)|\1|' REQUIREMENTS)
+          curl -sSLo $OP_SDK_DIR/operator-sdk  https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_SDK}/operator-sdk-${OPERATOR_SDK}-x86_64-linux-gnu && chmod +x $OP_SDK_DIR/operator-sdk
           export PATH="$PATH:$OP_SDK_DIR"
           export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }}
           export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }}
@@ -61,4 +49,4 @@ jobs:
           export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }}
           export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }}
           export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }}
-          ./make-release.sh nightly --update-nightly-olm-files --prepare-community-operators-update ${{ github.event.inputs.forceflag }}
+          ./make-release.sh --prepare-community-operators-update ${{ github.event.inputs.forceflag }}

README.md

@@ -154,10 +154,35 @@ spec:
       CHE_MULTIUSER: "false"
 ```
 
-```
+```bash
 $ chectl server:update -n <ECLIPSE-CHE-NAMESPACE> --che-operator-cr-patch-yaml <PATH_TO_CR_PATCH_YAML>
 ```
 
+### Workspace namespace strategy
+
+Workspace namespace strategy defines default namespace in which user's workspaces are created.
+It's possible to use <username>, <userid> and <workspaceid> placeholders (e.g.: che-workspace-<username>).
+In that case, new namespace will be created for each user (or workspace).
+For OpenShift infrastructure this property used to specify Project (instead of namespace conception).
+
+To set up namespace workspace strategy use command line:
+
+```bash
+$ kubectl patch checluster/eclipse-che -n <ECLIPSE-CHE-NAMESPACE> --type=merge -p '{"spec":{"server": {"customCheProperties": {"CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT": "che-workspace-<username>"}}}}'
+```
+
+or create `cr-patch.yaml` and use it with chectl:
+
+```yaml
+spec:
+  server:
+    customCheProperties:
+      CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT: "che-workspace-<username>"
+```
+
+```bash
+$ chectl server:update -n <ECLIPSE-CHE-NAMESPACE> --che-operator-cr-patch-yaml <PATH_TO_CR_PATCH_YAML>
+
 ### OpenShift OAuth
 
 OpenShift clusters include a built-in OAuth server. Che operator supports this authentication method. It's enabled by default.
@@ -176,7 +201,7 @@ spec:
     openShiftoAuth: false
 ```
 
-```
+```bash
 $ chectl server:update -n <ECLIPSE-CHE-NAMESPACE> --che-operator-cr-patch-yaml <PATH_TO_CR_PATCH_YAML>
 ```
 
@@ -196,7 +221,7 @@ spec:
     tlsSupport: false
 ```
 
-```
+```bash
 $ chectl server:update -n <ECLIPSE-CHE-NAMESPACE> --che-operator-cr-patch-yaml <PATH_TO_CR_PATCH_YAML>
 ```
 
@@ -292,6 +317,7 @@ Run the VSCode task: `Format che-operator code` or use the terminal:
 ```bash
 $ go fmt ./...
 ```
+> Notice: if you don't have redhat subscription, use public image registry.access.redhat.com/devtools/go-toolset-rhel7:latest
 
 ### Update golang dependencies
 

cmd/manager/main.go

@@ -15,10 +15,12 @@ import (
 	"context"
 	"flag"
 	"fmt"
+
 	"os"
 	"runtime"
 
 	image_puller_api "github.com/che-incubator/kubernetes-image-puller-operator/pkg/apis"
+	"github.com/eclipse/che-operator/cmd/manager/signal"
 	"github.com/eclipse/che-operator/pkg/util"
 	operatorsv1 "github.com/operator-framework/api/pkg/operators/v1"
 	operatorsv1alpha1 "github.com/operator-framework/api/pkg/operators/v1alpha1"
@@ -37,7 +39,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
-	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 )
 
 var (
@@ -170,7 +171,9 @@ func main() {
 	logrus.Info("Starting the Cmd")
 
 	// Start the Cmd
-	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+	period := signal.GetTerminationGracePeriodSeconds(mgr.GetAPIReader(), namespace)
+	logrus.Info("Create manager")
+	if err := mgr.Start(signal.SetupSignalHandler(period)); err != nil {
 		logrus.Error(err, "Manager exited non-zero")
 		os.Exit(1)
 	}

cmd/manager/signal/signal_handler.go

@@ -0,0 +1,94 @@
+//
+// Copyright (c) 2012-2020 Red Hat, Inc.
+// This program and the accompanying materials are made
+// available under the terms of the Eclipse Public License 2.0
+// which is available at https://www.eclipse.org/legal/epl-2.0/
+//
+// SPDX-License-Identifier: EPL-2.0
+//
+// Contributors:
+//   Red Hat, Inc. - initial API and implementation
+//
+
+package signal
+
+import (
+	"context"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// SetupSignalHandler set up custom signal handler for main process.
+func SetupSignalHandler(terminationPeriod int64) (stopCh <-chan struct{}) {
+	logrus.Info("Set up process signal handler")
+	var shutdownSignals = []os.Signal{os.Interrupt, syscall.SIGTERM, syscall.SIGINT}
+
+	stop := make(chan struct{})
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, shutdownSignals...)
+	go func() {
+		sig := <-c
+		printSignal(sig)
+
+		// We need provide more time for Che controller go routing to complete finalizers logic.
+		// Otherwise resource won't be clean up gracefully
+		// and Che custom resource will stay with non empty "finalizers" field.
+		time.Sleep(time.Duration(terminationPeriod) * time.Second)
+		logrus.Info("Stop and exit operator.")
+		// Stop Che controller
+		close(stop)
+		// Exit from main process directly.
+		os.Exit(1)
+	}()
+
+	return stop
+}
+
+func printSignal(signal os.Signal) {
+	switch signal {
+	case syscall.SIGHUP:
+		logrus.Info("Signal SIGHUP")
+
+	case syscall.SIGINT:
+		logrus.Println("Signal SIGINT (ctrl+c)")
+
+	case syscall.SIGTERM:
+		logrus.Println("Signal SIGTERM stop")
+
+	case syscall.SIGQUIT:
+		logrus.Println("Signal SIGQUIT (top and core dump)")
+
+	default:
+		logrus.Println("Unknown signal")
+	}
+}
+
+func GetTerminationGracePeriodSeconds(k8sClient client.Reader, namespace string) int64 {
+	cheFlavor := os.Getenv("CHE_FLAVOR")
+	if cheFlavor == "" {
+		cheFlavor = "che"
+	}
+	defaultTerminationGracePeriodSeconds := int64(20)
+
+	deployment := &appsv1.Deployment{}
+	namespacedName := types.NamespacedName{Namespace: namespace, Name: cheFlavor + "-operator"}
+	if err := k8sClient.Get(context.TODO(), namespacedName, deployment); err != nil {
+		logrus.Warnf("Unable to find '%s' deployment in namespace '%s', err: %s", cheFlavor+"-operator", namespace, err.Error())
+	} else {
+		terminationPeriod := deployment.Spec.Template.Spec.TerminationGracePeriodSeconds
+		if terminationPeriod != nil {
+			logrus.Infof("Use 'terminationGracePeriodSeconds' %d sec. from operator deployment.", *terminationPeriod)
+			return *terminationPeriod
+		}
+	}
+
+	logrus.Infof("Use default 'terminationGracePeriodSeconds' %d sec.", defaultTerminationGracePeriodSeconds)
+	return defaultTerminationGracePeriodSeconds
+}

deploy/cluster_role.yaml

@@ -18,66 +18,249 @@ metadata:
     app.kubernetes.io/component: che-operator
 rules:
   - apiGroups:
-    - ""
+      - oauth.openshift.io
     resources:
-    - secrets
+      - oauthclients
     verbs:
-    - get
-    - create
-    - delete
+      - create
+      - get
+      - delete
+      - list
+      - patch
+      - update
+      - watch
   - apiGroups:
-    - user.openshift.io
+      - config.openshift.io
     resources:
-    - identities
+      - oauths
     verbs:
-    - delete
+      - get
+      - list
+      - watch
+      - patch
   - apiGroups:
-    - oauth.openshift.io
+      - config.openshift.io
     resources:
-    - oauthclients
+      - infrastructures
+      - proxies
     verbs:
-    - create
-    - get
-    - delete
-    - list
-    - patch
-    - update
-    - watch
+      - get
+      - list
+      - watch
   - apiGroups:
-    - config.openshift.io
+      - user.openshift.io
     resources:
-    - infrastructures
-    - oauths
-    - proxies
+      - users
     verbs:
-    - get
-    - list
-    - patch
-    - watch
+      - list
+      - delete
   - apiGroups:
-    - user.openshift.io
+      - user.openshift.io
     resources:
-    - users
+      - identities
     verbs:
-    - list
-    - delete
+      - delete
   - apiGroups:
-    - console.openshift.io
+      - console.openshift.io
     resources:
-    - consolelinks
+      - consolelinks
     verbs:
-    - get
-    - list
-    - create
-    - update
-    - patch
-    - delete
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
-    - rbac.authorization.k8s.io
+      - rbac.authorization.k8s.io
     resources:
-    - clusterrolebindings
+      - clusterrolebindings
     verbs:
-    - list
-    - create
-    - watch
-    - update
+      - list
+      - create
+      - watch
+      - update
+      - get
+      - delete
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterroles
+    verbs:
+      - list
+      - create
+      - watch
+      - update
+      - get
+      - delete
+  - apiGroups:
+      - authorization.openshift.io
+    resources:
+      - roles
+    verbs:
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - authorization.openshift.io
+    resources:
+      - rolebindings
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - roles
+    verbs:
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - rolebindings
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - org.eclipse.che
+    resources:
+      - checlusters
+      - checlusters/finalizers
+    verbs:
+      - '*'
+  - apiGroups:
+      - project.openshift.io
+    resources:
+      - projectrequests
+    verbs:
+      - create
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - create
+      - update
+  - apiGroups:
+      - project.openshift.io
+    resources:
+      - projects
+    verbs:
+      - get
+  - apiGroups:
+      - ''
+    resources:
+      - serviceaccounts
+    verbs:
+      - get
+      - create
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - pods/exec
+    verbs:
+      - create
+  - apiGroups:
+      - apps
+    resources:
+      - secrets
+    verbs:
+      - list
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - list
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - create
+      - watch
+      - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    verbs:
+      - get
+      - list
+      - create
+      - patch
+      - watch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - services
+    verbs:
+      - list
+      - create
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes
+    verbs:
+      - list
+      - create
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - list
+      - get
+      - patch
+      - delete
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - list
+      - create
+      - watch
+      - get
+      - delete

deploy/crds/org_v1_che_cr.yaml

@@ -59,7 +59,7 @@ spec:
     # sets mem limit for server deployment. Defaults to 1Gi
     serverMemoryLimit: ''
     # sets default namespace where new workspaces will be created
-    workspaceNamespaceDefault: ''
+    workspaceNamespaceDefault: "<username>-che"
     # defines if user is able to specify namespace different from the default
     allowUserDefinedWorkspaceNamespaces: false
     # Sets the server and workspaces exposure type. Possible values are "multi-host", "single-host", "default-host".

deploy/namespaces_cluster_role.yaml

@@ -23,4 +23,6 @@ rules:
       - namespaces
     verbs:
       - update
+      - list
+      - create
       - get

deploy/olm-catalog/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml

@@ -68,7 +68,7 @@ metadata:
               "singleHostGatewayImage": "",
               "tlsSupport": true,
               "useInternalClusterSVCNames": true,
-              "workspaceNamespaceDefault": ""
+              "workspaceNamespaceDefault": "<username>-che"
             },
             "storage": {
               "postgresPVCStorageClassName": "",
@@ -85,7 +85,7 @@ metadata:
     categories: Developer Tools
     certified: "false"
     containerImage: quay.io/eclipse/che-operator:nightly
-    createdAt: "2021-01-29T09:31:39Z"
+    createdAt: "2021-02-05T00:59:18Z"
     description: A Kube-native development solution that delivers portable and collaborative
       developer workspaces.
     operatorframework.io/suggested-namespace: eclipse-che
@@ -290,6 +290,151 @@ spec:
                 - create
                 - watch
                 - update
+                - get
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - clusterroles
+              verbs:
+                - list
+                - create
+                - watch
+                - update
+                - get
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - roles
+              verbs:
+                - get
+                - create
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - rolebindings
+              verbs:
+                - get
+                - create
+                - update
+                - delete
+            - apiGroups:
+                - org.eclipse.che
+              resources:
+                - checlusters
+                - checlusters/finalizers
+              verbs:
+                - '*'
+            - apiGroups:
+                - ""
+              resources:
+                - namespaces
+              verbs:
+                - get
+                - create
+                - update
+            - apiGroups:
+                - ""
+              resources:
+                - serviceaccounts
+              verbs:
+                - get
+                - create
+                - watch
+            - apiGroups:
+                - ""
+              resources:
+                - pods/exec
+              verbs:
+                - create
+            - apiGroups:
+                - apps
+              resources:
+                - secrets
+              verbs:
+                - list
+            - apiGroups:
+                - ""
+              resources:
+                - secrets
+              verbs:
+                - list
+                - create
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - persistentvolumeclaims
+              verbs:
+                - create
+                - get
+                - list
+                - watch
+            - apiGroups:
+                - ""
+              resources:
+                - pods
+              verbs:
+                - get
+                - list
+                - create
+                - watch
+                - delete
+            - apiGroups:
+                - apps
+              resources:
+                - deployments
+              verbs:
+                - get
+                - list
+                - create
+                - patch
+                - watch
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - services
+              verbs:
+                - list
+                - create
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - configmaps
+              verbs:
+                - get
+                - create
+                - delete
+                - list
+            - apiGroups:
+                - ""
+              resources:
+                - events
+              verbs:
+                - watch
+            - apiGroups:
+                - apps
+              resources:
+                - replicasets
+              verbs:
+                - list
+                - get
+                - patch
+                - delete
+            - apiGroups:
+                - extensions
+              resources:
+                - ingresses
+              verbs:
+                - list
+                - create
+                - watch
+                - get
+                - delete
           serviceAccountName: che-operator
         - rules:
             - apiGroups:
@@ -298,6 +443,8 @@ spec:
                 - namespaces
               verbs:
                 - update
+                - list
+                - create
                 - get
           serviceAccountName: che-namespace-editor
       deployments:
@@ -414,7 +561,7 @@ spec:
                           - ALL
                 restartPolicy: Always
                 serviceAccountName: che-operator
-                terminationGracePeriodSeconds: 5
+                terminationGracePeriodSeconds: 20
       permissions:
         - rules:
             - apiGroups:
@@ -480,7 +627,9 @@ spec:
             - apiGroups:
                 - org.eclipse.che
               resources:
-                - '*'
+                - checlusters
+                - checlusters/status
+                - checlusters/finalizers
               verbs:
                 - '*'
             - apiGroups:

deploy/olm-catalog/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml

@@ -59,7 +59,7 @@ metadata:
               "singleHostGatewayImage": "",
               "tlsSupport": true,
               "useInternalClusterSVCNames": true,
-              "workspaceNamespaceDefault": ""
+              "workspaceNamespaceDefault": "<username>-che"
             },
             "storage": {
               "postgresPVCStorageClassName": "",
@@ -76,7 +76,7 @@ metadata:
     categories: Developer Tools, OpenShift Optional
     certified: "false"
     containerImage: quay.io/eclipse/che-operator:nightly
-    createdAt: "2021-01-29T09:31:46Z"
+    createdAt: "2021-02-05T00:59:26Z"
     description: A Kube-native development solution that delivers portable and collaborative
       developer workspaces in OpenShift.
     operatorframework.io/suggested-namespace: eclipse-che
@@ -313,6 +313,189 @@ spec:
                 - create
                 - watch
                 - update
+                - get
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - clusterroles
+              verbs:
+                - list
+                - create
+                - watch
+                - update
+                - get
+                - delete
+            - apiGroups:
+                - authorization.openshift.io
+              resources:
+                - roles
+              verbs:
+                - get
+                - create
+                - delete
+            - apiGroups:
+                - authorization.openshift.io
+              resources:
+                - rolebindings
+              verbs:
+                - get
+                - create
+                - update
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - roles
+              verbs:
+                - get
+                - create
+                - delete
+            - apiGroups:
+                - rbac.authorization.k8s.io
+              resources:
+                - rolebindings
+              verbs:
+                - get
+                - create
+                - update
+                - delete
+            - apiGroups:
+                - org.eclipse.che
+              resources:
+                - checlusters
+                - checlusters/finalizers
+              verbs:
+                - '*'
+            - apiGroups:
+                - project.openshift.io
+              resources:
+                - projectrequests
+              verbs:
+                - create
+                - update
+            - apiGroups:
+                - ""
+              resources:
+                - namespaces
+              verbs:
+                - get
+                - create
+                - update
+            - apiGroups:
+                - project.openshift.io
+              resources:
+                - projects
+              verbs:
+                - get
+            - apiGroups:
+                - ""
+              resources:
+                - serviceaccounts
+              verbs:
+                - get
+                - create
+                - watch
+            - apiGroups:
+                - ""
+              resources:
+                - pods/exec
+              verbs:
+                - create
+            - apiGroups:
+                - apps
+              resources:
+                - secrets
+              verbs:
+                - list
+            - apiGroups:
+                - ""
+              resources:
+                - secrets
+              verbs:
+                - list
+                - create
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - persistentvolumeclaims
+              verbs:
+                - create
+                - get
+                - list
+                - watch
+            - apiGroups:
+                - ""
+              resources:
+                - pods
+              verbs:
+                - get
+                - list
+                - create
+                - watch
+                - delete
+            - apiGroups:
+                - apps
+              resources:
+                - deployments
+              verbs:
+                - get
+                - list
+                - create
+                - patch
+                - watch
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - services
+              verbs:
+                - list
+                - create
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - configmaps
+              verbs:
+                - get
+                - create
+                - delete
+                - list
+            - apiGroups:
+                - route.openshift.io
+              resources:
+                - routes
+              verbs:
+                - list
+                - create
+                - delete
+            - apiGroups:
+                - ""
+              resources:
+                - events
+              verbs:
+                - watch
+            - apiGroups:
+                - apps
+              resources:
+                - replicasets
+              verbs:
+                - list
+                - get
+                - patch
+                - delete
+            - apiGroups:
+                - extensions
+              resources:
+                - ingresses
+              verbs:
+                - list
+                - create
+                - watch
+                - get
+                - delete
           serviceAccountName: che-operator
         - rules:
             - apiGroups:
@@ -321,6 +504,8 @@ spec:
                 - namespaces
               verbs:
                 - update
+                - list
+                - create
                 - get
           serviceAccountName: che-namespace-editor
       deployments:
@@ -435,7 +620,7 @@ spec:
                           - ALL
                 restartPolicy: Always
                 serviceAccountName: che-operator
-                terminationGracePeriodSeconds: 5
+                terminationGracePeriodSeconds: 20
       permissions:
         - rules:
             - apiGroups:
@@ -508,7 +693,9 @@ spec:
             - apiGroups:
                 - org.eclipse.che
               resources:
-                - '*'
+                - checlusters
+                - checlusters/status
+                - checlusters/finalizers
               verbs:
                 - '*'
             - apiGroups:

deploy/operator.yaml

@@ -123,4 +123,4 @@ spec:
               cpu: 500m
       restartPolicy: Always
       serviceAccountName: che-operator
-      terminationGracePeriodSeconds: 5
+      terminationGracePeriodSeconds: 20

deploy/role.yaml

@@ -88,7 +88,9 @@ rules:
 - apiGroups:
   - org.eclipse.che
   resources:
-  - '*'
+  - checlusters
+  - checlusters/status
+  - checlusters/finalizers
   verbs:
   - '*'
 - apiGroups:

mocks/permission_checker_mock.go

@@ -0,0 +1,49 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: pkg/controller/che/permission_checker.go
+
+// Package mock_che is a generated GoMock package.
+package mock_che
+
+import (
+	gomock "github.com/golang/mock/gomock"
+	v1 "k8s.io/api/rbac/v1"
+	reflect "reflect"
+)
+
+// MockPermissionChecker is a mock of PermissionChecker interface
+type MockPermissionChecker struct {
+	ctrl     *gomock.Controller
+	recorder *MockPermissionCheckerMockRecorder
+}
+
+// MockPermissionCheckerMockRecorder is the mock recorder for MockPermissionChecker
+type MockPermissionCheckerMockRecorder struct {
+	mock *MockPermissionChecker
+}
+
+// NewMockPermissionChecker creates a new mock instance
+func NewMockPermissionChecker(ctrl *gomock.Controller) *MockPermissionChecker {
+	mock := &MockPermissionChecker{ctrl: ctrl}
+	mock.recorder = &MockPermissionCheckerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use
+func (m *MockPermissionChecker) EXPECT() *MockPermissionCheckerMockRecorder {
+	return m.recorder
+}
+
+// GetNotPermittedPolicyRules mocks base method
+func (m *MockPermissionChecker) GetNotPermittedPolicyRules(policies []v1.PolicyRule, namespace string) ([]v1.PolicyRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetNotPermittedPolicyRules", policies, namespace)
+	ret0, _ := ret[0].([]v1.PolicyRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetNotPermittedPolicyRules indicates an expected call of GetNotPermittedPolicyRules
+func (mr *MockPermissionCheckerMockRecorder) GetNotPermittedPolicyRules(policies, namespace interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNotPermittedPolicyRules", reflect.TypeOf((*MockPermissionChecker)(nil).GetNotPermittedPolicyRules), policies, namespace)
+}

olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.1/eclipse-che-preview-kubernetes.crd.yaml

@@ -0,0 +1,826 @@
+#
+#  Copyright (c) 2012-2020 Red Hat, Inc.
+#    This program and the accompanying materials are made
+#    available under the terms of the Eclipse Public License 2.0
+#    which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+#  SPDX-License-Identifier: EPL-2.0
+#
+#  Contributors:
+#    Red Hat, Inc. - initial API and implementation
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: checlusters.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheCluster
+    listKind: CheClusterList
+    plural: checlusters
+    singular: checluster
+  scope: Namespaced
+  subresources:
+    status: {}
+  validation:
+    openAPIV3Schema:
+      description: The `CheCluster` custom resource allows defining and managing a
+        Che server installation
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: Desired configuration of the Che installation. Based on these
+            settings, the operator automatically creates and maintains several config
+            maps that will contain the appropriate environment variables the various
+            components of the Che installation. These generated config maps should
+            NOT be updated manually.
+          properties:
+            auth:
+              description: Configuration settings related to the Authentication used
+                by the Che installation.
+              properties:
+                externalIdentityProvider:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated Identity Provider (Keycloak or RH SSO instance). By
+                    default a dedicated Identity Provider server is deployed as part
+                    of the Che installation. But if `externalIdentityProvider` is
+                    `true`, then no dedicated identity provider will be deployed by
+                    the operator and you might need to provide details about the external
+                    identity provider you want to use. See also all the other fields
+                    starting with: `identityProvider`.'
+                  type: boolean
+                identityProviderAdminUserName:
+                  description: Overrides the name of the Identity Provider admin user.
+                    Defaults to `admin`.
+                  type: string
+                identityProviderClientId:
+                  description: Name of a Identity provider (Keycloak / RH SSO) `client-id`
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field suffixed with `-public`.
+                  type: string
+                identityProviderContainerResources:
+                  description: Identity provider container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                identityProviderImage:
+                  description: Overrides the container image used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. This includes the image
+                    tag. Omit it or leave it empty to use the defaut container image
+                    provided by the operator.
+                  type: string
+                identityProviderImagePullPolicy:
+                  description: Overrides the image pull policy used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. Default value is `Always`
+                    for `nightly` or `latest` images, and `IfNotPresent` in other
+                    cases.
+                  type: string
+                identityProviderIngress:
+                  description: Ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderPassword:
+                  description: Overrides the password of Keycloak admin user. This
+                    is useful to override it ONLY if you use an external Identity
+                    Provider (see the `externalIdentityProvider` field). If omitted
+                    or left blank, it will be set to an auto-generated password.
+                  type: string
+                identityProviderPostgresPassword:
+                  description: Password for The Identity Provider (Keycloak / RH SSO)
+                    to connect to the database. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to an auto-generated
+                    password.
+                  type: string
+                identityProviderPostgresSecret:
+                  description: 'The secret that contains `password` for The Identity
+                    Provider (Keycloak / RH SSO) to connect to the database. If the
+                    secret is defined then `identityProviderPostgresPassword` will
+                    be ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `identityProviderPostgresPassword` is defined,
+                    then it will be used to connect to the database. 2. `identityProviderPostgresPassword`
+                    is not defined, then a new secret with the name `che-identity-postgres-secret`
+                    will be created with an auto-generated value for `password`.'
+                  type: string
+                identityProviderRealm:
+                  description: Name of a Identity provider (Keycloak / RH SSO) realm
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field.
+                  type: string
+                identityProviderRoute:
+                  description: Route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderSecret:
+                  description: 'The secret that contains `user` and `password` for
+                    Identity Provider. If the secret is defined then `identityProviderAdminUserName`
+                    and `identityProviderPassword` are ignored. If the value is omitted
+                    or left blank then there are two scenarios: 1. `identityProviderAdminUserName`
+                    and `identityProviderPassword` are defined, then they will be
+                    used. 2. `identityProviderAdminUserName` or `identityProviderPassword`
+                    are not defined, then a new secret with the name `che-identity-secret`
+                    will be created with default value `admin` for `user` and with
+                    an auto-generated value for `password`.'
+                  type: string
+                identityProviderURL:
+                  description: Public URL of the Identity Provider server (Keycloak
+                    / RH SSO server). You should set it ONLY if you use an external
+                    Identity Provider (see the `externalIdentityProvider` field).
+                    By default this will be automatically calculated and set by the
+                    operator.
+                  type: string
+                oAuthClientName:
+                  description: Name of the OpenShift `OAuthClient` resource used to
+                    setup identity federation on the OpenShift side. Auto-generated
+                    if left blank. See also the `OpenShiftoAuth` field.
+                  type: string
+                oAuthSecret:
+                  description: Name of the secret set in the OpenShift `OAuthClient`
+                    resource used to setup identity federation on the OpenShift side.
+                    Auto-generated if left blank. See also the `OAuthClientName` field.
+                  type: string
+                openShiftoAuth:
+                  description: 'Enables the integration of the identity provider (Keycloak
+                    / RHSSO) with OpenShift OAuth. Empty value on the OpenShift platform
+                    by default. If user changes this empty value to true/false, then
+                    che-operator respect this value. Otherwise che-operator tries
+                    to auto detect if Openshift oAuth can be enabled and change empty
+                    value, correspondly to auto-detection result. This property allows
+                    users to directly login with their Openshift user through the
+                    Openshift login, and have their workspaces created under personal
+                    OpenShift namespaces. WARNING: the `kubeadmin` user is NOT supported,
+                    and logging through it will NOT allow accessing the Che Dashboard.'
+                  type: boolean
+                updateAdminPassword:
+                  description: Forces the default `admin` Che user to update password
+                    on first login. Defaults to `false`.
+                  type: boolean
+              type: object
+            database:
+              description: Configuration settings related to the database used by
+                the Che installation.
+              properties:
+                chePostgresContainerResources:
+                  description: Postgres container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                chePostgresDb:
+                  description: Postgres database name that the Che server uses to
+                    connect to the DB. Defaults to `dbche`.
+                  type: string
+                chePostgresHostName:
+                  description: Postgres Database hostname that the Che server uses
+                    to connect to. Defaults to postgres. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresPassword:
+                  description: Postgres password that the Che server should use to
+                    connect to the DB. If omitted or left blank, it will be set to
+                    an auto-generated value.
+                  type: string
+                chePostgresPort:
+                  description: Postgres Database port that the Che server uses to
+                    connect to. Defaults to 5432. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresSecret:
+                  description: 'The secret that contains Postgres `user` and `password`
+                    that the Che server should use to connect to the DB. If the secret
+                    is defined then `chePostgresUser` and `chePostgresPassword` are
+                    ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `chePostgresUser` and `chePostgresPassword`
+                    are defined, then they will be used to connect to the DB. 2. `chePostgresUser`
+                    or `chePostgresPassword` are not defined, then a new secret with
+                    the name `che-postgres-secret` will be created with default value
+                    of `pgche` for `user` and with an auto-generated value for `password`.'
+                  type: string
+                chePostgresUser:
+                  description: Postgres user that the Che server should use to connect
+                    to the DB. Defaults to `pgche`.
+                  type: string
+                externalDb:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated database. By default a dedicated Postgres database
+                    is deployed as part of the Che installation. But if `externalDb`
+                    is `true`, then no dedicated database will be deployed by the
+                    operator and you might need to provide connection details to the
+                    external DB you want to use. See also all the fields starting
+                    with: `chePostgres`.'
+                  type: boolean
+                postgresImage:
+                  description: Overrides the container image used in the Postgres
+                    database deployment. This includes the image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                postgresImagePullPolicy:
+                  description: Overrides the image pull policy used in the Postgres
+                    database deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+              type: object
+            imagePuller:
+              description: Kubernetes Image Puller configuration
+              properties:
+                enable:
+                  description: "Install and configure the Community Supported Kubernetes
+                    Image Puller Operator. If true and no spec is provided, it will
+                    create a default KubernetesImagePuller object to be managed by
+                    the Operator. If false, the KubernetesImagePuller object will
+                    be deleted, and the operator will be uninstalled, regardless of
+                    whether or not a spec is provided. \n Please note that while this
+                    operator and its behavior is community-supported, its payload
+                    may be commercially-supported if you use it for pulling commercially-supported
+                    images."
+                  type: boolean
+                spec:
+                  description: A KubernetesImagePullerSpec to configure the image
+                    puller in the CheCluster
+                  properties:
+                    cachingCPULimit:
+                      type: string
+                    cachingCPURequest:
+                      type: string
+                    cachingIntervalHours:
+                      type: string
+                    cachingMemoryLimit:
+                      type: string
+                    cachingMemoryRequest:
+                      type: string
+                    configMapName:
+                      type: string
+                    daemonsetName:
+                      type: string
+                    deploymentName:
+                      type: string
+                    images:
+                      type: string
+                    nodeSelector:
+                      type: string
+                  type: object
+              type: object
+            k8s:
+              description: Configuration settings specific to Che installations made
+                on upstream Kubernetes.
+              properties:
+                ingressClass:
+                  description: 'Ingress class that will define the which controler
+                    will manage ingresses. Defaults to `nginx`. NB: This drives the
+                    `is kubernetes.io/ingress.class` annotation on Che-related ingresses.'
+                  type: string
+                ingressDomain:
+                  description: 'Global ingress domain for a K8S cluster. This MUST
+                    be explicitly specified: there are no defaults.'
+                  type: string
+                ingressStrategy:
+                  description: Strategy for ingress creation. This can be `multi-host`
+                    (host is explicitly provided in ingress), `single-host` (host
+                    is provided, path-based rules) and `default-host.*`(no host is
+                    provided, path-based rules). Defaults to `"multi-host` Deprecated
+                    in favor of "serverExposureStrategy" in the "server" section,
+                    which defines this regardless of the cluster type. If both are
+                    defined, `serverExposureStrategy` takes precedence.
+                  type: string
+                securityContextFsGroup:
+                  description: FSGroup the Che pod and Workspace pods containers should
+                    run in. Defaults to `1724`.
+                  type: string
+                securityContextRunAsUser:
+                  description: ID of the user the Che pod and Workspace pods containers
+                    should run as. Default to `1724`.
+                  type: string
+                singleHostExposureType:
+                  description: When the serverExposureStrategy is set to "single-host",
+                    the way the server, registries and workspaces are exposed is further
+                    configured by this property. The possible values are "native"
+                    (which means that the server and workspaces are exposed using
+                    ingresses on K8s) or "gateway" where the server and workspaces
+                    are exposed using a custom gateway based on Traefik. All the endpoints
+                    whether backed by the ingress or gateway "route" always point
+                    to the subpaths on the same domain. Defaults to "native".
+                  type: string
+                tlsSecretName:
+                  description: Name of a secret that is used to set ingress TLS termination
+                    if TLS is enabled. If the specified secret does not exist, a self-signed
+                    certificate will be created. If the value is empty or omitted,
+                    the default ingress controller certificate will be used. See also
+                    the `tlsSupport` field. Note, when switching to the default ingress
+                    controller certificate, `self-signed-certificate` secret should
+                    be deleted manually.
+                  type: string
+              type: object
+            metrics:
+              description: Configuration settings related to the metrics collection
+                used by the Che installation.
+              properties:
+                enable:
+                  description: Enables `metrics` Che server endpoint. Default to `true`.
+                  type: boolean
+              type: object
+            server:
+              description: General configuration settings related to the Che server
+                and the plugin and devfile registries
+              properties:
+                airGapContainerRegistryHostname:
+                  description: Optional hostname (or url) to an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry hostname defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                airGapContainerRegistryOrganization:
+                  description: Optional repository name of an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry organization defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                allowUserDefinedWorkspaceNamespaces:
+                  description: Defines if a user is able to specify Kubernetes namespace
+                    (or OpenShift project) different from the default. It's NOT RECOMMENDED
+                    to configured true without OAuth configured. This property is
+                    also used by the OpenShift infra.
+                  type: boolean
+                cheClusterRoles:
+                  description: Comma-separated list of ClusterRoles that will be assigned
+                    to che ServiceAccount. Be aware that che-operator has to already
+                    have all permissions in these ClusterRoles to be able to grant
+                    them.
+                  type: string
+                cheDebug:
+                  description: Enables the debug mode for Che server. Defaults to
+                    `false`.
+                  type: string
+                cheFlavor:
+                  description: Flavor of the installation. This is either `che` for
+                    upstream Che installations, or `codeready` for CodeReady Workspaces
+                    installation. In most cases the default value should not be overridden.
+                  type: string
+                cheHost:
+                  description: Public hostname of the installed Che server. If value
+                    is omitted then it will be automatically set by the operator.
+                    (see the `cheHostTLSSecret` field).
+                  type: string
+                cheHostTLSSecret:
+                  description: Name of a secret containing certificates to secure
+                    ingress/route for the custom hostname of the installed Che server.
+                    (see the `cheHost` field).
+                  type: string
+                cheImage:
+                  description: Overrides the container image used in Che deployment.
+                    This does NOT include the container image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                cheImagePullPolicy:
+                  description: Overrides the image pull policy used in Che deployment.
+                    Default value is `Always` for `nightly` or `latest` images, and
+                    `IfNotPresent` in other cases.
+                  type: string
+                cheImageTag:
+                  description: Overrides the tag of the container image used in Che
+                    deployment. Omit it or leave it empty to use the defaut image
+                    tag provided by the operator.
+                  type: string
+                cheLogLevel:
+                  description: 'Log level for the Che server: `INFO` or `DEBUG`. Defaults
+                    to `INFO`.'
+                  type: string
+                cheServerIngress:
+                  description: Che server ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheServerRoute:
+                  description: Che server route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheWorkspaceClusterRole:
+                  description: Custom cluster role bound to the user for the Che workspaces.
+                    The default roles are used if this is omitted or left blank.
+                  type: string
+                customCheProperties:
+                  additionalProperties:
+                    type: string
+                  description: Map of additional environment variables that will be
+                    applied in the generated `che` config map to be used by the Che
+                    server, in addition to the values already generated from other
+                    fields of the `CheCluster` custom resource (CR). If `customCheProperties`
+                    contains a property that would be normally generated in `che`
+                    config map from other CR fields, then the value defined in the
+                    `customCheProperties` will be used instead.
+                  type: object
+                devfileRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                devfileRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                devfileRegistryImage:
+                  description: Overrides the container image used in the Devfile registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the defaut container image provided by the operator.
+                  type: string
+                devfileRegistryIngress:
+                  description: Devfile registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Devfile registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                devfileRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Devfile registry
+                    deployment In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                devfileRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Devfile
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                devfileRegistryRoute:
+                  description: Devfile registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryUrl:
+                  description: Public URL of the Devfile registry, that serves sample,
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalDevfileRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                externalDevfileRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Devfile registry server. By default a dedicated devfile
+                    registry server is started. But if `externalDevfileRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `devfileRegistryUrl` field
+                  type: boolean
+                externalPluginRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Plugin registry server. By default a dedicated plugin
+                    registry server is started. But if `externalPluginRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `pluginRegistryUrl` field.
+                  type: boolean
+                gitSelfSignedCert:
+                  description: If enabled, then the certificate from `che-git-self-signed-cert`
+                    config map will be propagated to the Che components and provide
+                    particular configuration for Git.
+                  type: boolean
+                nonProxyHosts:
+                  description: 'List of hosts that should not use the configured proxy.
+                    So specify wild card domain use the following form `.<DOMAIN>`
+                    and `|` as delimiter, eg: `localhost|.my.host.com|123.42.12.32`
+                    Only use when configuring a proxy is required. Operator respects
+                    OpenShift cluster wide proxy configuration and no additional configuration
+                    is required, but defining `nonProxyHosts` in a custom resource
+                    leads to merging non proxy hosts lists from the cluster proxy
+                    configuration and ones defined in the custom resources. (see the
+                    doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyURL` fields).'
+                  type: string
+                pluginRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                pluginRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                pluginRegistryImage:
+                  description: Overrides the container image used in the Plugin registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the default container image provided by the operator.
+                  type: string
+                pluginRegistryIngress:
+                  description: Plugin registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                pluginRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                pluginRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Plugin
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                pluginRegistryRoute:
+                  description: Plugin registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryUrl:
+                  description: Public URL of the Plugin registry, that serves sample
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalPluginRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                proxyPassword:
+                  description: Password of the proxy server Only use when proxy configuration
+                    is required (see also the `proxyURL`, `proxyUser` and `proxySecret`
+                    fields).
+                  type: string
+                proxyPort:
+                  description: Port of the proxy server. Only use when configuring
+                    a proxy is required. (see also the `proxyURL` and `nonProxyHosts`
+                    fields).
+                  type: string
+                proxySecret:
+                  description: The secret that contains `user` and `password` for
+                    a proxy server. If the secret is defined then `proxyUser` and
+                    `proxyPassword` are ignored
+                  type: string
+                proxyURL:
+                  description: URL (protocol+hostname) of the proxy server. This drives
+                    the appropriate changes in the `JAVA_OPTS` and `https(s)_proxy`
+                    variables in the Che server and workspaces containers. Only use
+                    when configuring a proxy is required. Operator respects OpenShift
+                    cluster wide proxy configuration and no additional configuration
+                    is required, but defining `proxyUrl` in a custom resource leads
+                    to overrides the cluster proxy configuration with fields `proxyUrl`,
+                    `proxyPort`, `proxyUser` and `proxyPassword` from the custom resource.
+                    (see the doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyPort` and `nonProxyHosts` fields).
+                  type: string
+                proxyUser:
+                  description: User name of the proxy server. Only use when configuring
+                    a proxy is required (see also the `proxyURL`, `proxyPassword`
+                    and `proxySecret` fields).
+                  type: string
+                selfSignedCert:
+                  description: Deprecated. The value of this flag is ignored. Che
+                    operator will automatically detect if router certificate is self-signed.
+                    If so it will be propagated to Che server and some other components.
+                  type: boolean
+                serverCpuLimit:
+                  description: Overrides the cpu limit used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 1.
+                  type: string
+                serverCpuRequest:
+                  description: Overrides the cpu request used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                serverExposureStrategy:
+                  description: Sets the server and workspaces exposure type. Possible
+                    values are "multi-host", "single-host", "default-host". Defaults
+                    to "multi-host" which creates a separate ingress (or route on
+                    OpenShift) for every required endpoint. "single-host" makes Che
+                    exposed on a single hostname with workspaces exposed on subpaths.
+                    Please read the docs to learn about the limitations of this approach.
+                    Also consult the `singleHostExposureType` property to further
+                    configure how the operator and Che server make that happen on
+                    Kubernetes. "default-host" exposes che server on the host of the
+                    cluster. Please read the docs to learn about the limitations of
+                    this approach.
+                  type: string
+                serverMemoryLimit:
+                  description: Overrides the memory limit used in the Che server deployment.
+                    In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024). Defaults
+                    to 1Gi.
+                  type: string
+                serverMemoryRequest:
+                  description: Overrides the memory request used in the Che server
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 512Mi.
+                  type: string
+                serverTrustStoreConfigMapName:
+                  description: Name of the config-map with public certificates to
+                    add to Java trust store of the Che server. This is usually required
+                    when adding the OpenShift OAuth provider which has https endpoint
+                    signed with self-signed cert. So, Che server must be aware of
+                    its CA cert to be able to request it. This is disabled by default.
+                  type: string
+                singleHostGatewayConfigMapLabels:
+                  additionalProperties:
+                    type: string
+                  description: The labels that need to be present (and are put) on
+                    the configmaps representing the gateway configuration.
+                  type: object
+                singleHostGatewayConfigSidecarImage:
+                  description: The image used for the gateway sidecar that provides
+                    configuration to the gateway. Omit it or leave it empty to use
+                    the defaut container image provided by the operator.
+                  type: string
+                singleHostGatewayImage:
+                  description: The image used for the gateway in the single host mode.
+                    Omit it or leave it empty to use the defaut container image provided
+                    by the operator.
+                  type: string
+                tlsSupport:
+                  description: Deprecated. Instructs the operator to deploy Che in
+                    TLS mode. This is enabled by default. Disabling TLS may cause
+                    malfunction of some Che components.
+                  type: boolean
+                useInternalClusterSVCNames:
+                  description: Use internal cluster svc names to communicate between
+                    components to speed up the traffic and avoid proxy issues. The
+                    default value is `true`.
+                  type: boolean
+                workspaceNamespaceDefault:
+                  description: 'Defines Kubernetes default namespace in which user''s
+                    workspaces are created if user does not override it. It''s possible
+                    to use <username>, <userid> and <workspaceid> placeholders (e.g.:
+                    che-workspace-<username>). In that case, new namespace will be
+                    created for each user (or workspace). Is used by OpenShift infra
+                    as well to specify Project'
+                  type: string
+              type: object
+            storage:
+              description: Configuration settings related to the persistent storage
+                used by the Che installation.
+              properties:
+                postgresPVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claim dedicated
+                    to the Postgres database. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+                preCreateSubPaths:
+                  description: Instructs the Che server to launch a special pod to
+                    pre-create a subpath in the Persistent Volumes. Defaults to `false`,
+                    however it might need to enable it according to the configuration
+                    of your K8S cluster.
+                  type: boolean
+                pvcClaimSize:
+                  description: Size of the persistent volume claim for workspaces.
+                    Defaults to `1Gi`
+                  type: string
+                pvcJobsImage:
+                  description: Overrides the container image used to create sub-paths
+                    in the Persistent Volumes. This includes the image tag. Omit it
+                    or leave it empty to use the defaut container image provided by
+                    the operator. See also the `preCreateSubPaths` field.
+                  type: string
+                pvcStrategy:
+                  description: Persistent volume claim strategy for the Che server.
+                    This Can be:`common` (all workspaces PVCs in one volume), `per-workspace`
+                    (one PVC per workspace for all declared volumes) and `unique`
+                    (one PVC per declared volume). Defaults to `common`.
+                  type: string
+                workspacePVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claims dedicated
+                    to the Che workspaces. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+              type: object
+          type: object
+        status:
+          description: CheClusterStatus defines the observed state of Che installation
+          properties:
+            cheClusterRunning:
+              description: Status of a Che installation. Can be `Available`, `Unavailable`,
+                or `Available, Rolling Update in Progress`
+              type: string
+            cheURL:
+              description: Public URL to the Che server
+              type: string
+            cheVersion:
+              description: Current installed Che version
+              type: string
+            dbProvisioned:
+              description: Indicates if or not a Postgres instance has been correctly
+                provisioned
+              type: boolean
+            devfileRegistryURL:
+              description: Public URL to the Devfile registry
+              type: string
+            gitHubOAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the GitHub OAuth.
+              type: boolean
+            helpLink:
+              description: A URL that can point to some URL where to find help related
+                to the current Operator status.
+              type: string
+            keycloakProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been provisioned with realm, client and user
+              type: boolean
+            keycloakURL:
+              description: Public URL to the Identity Provider server (Keycloak /
+                RH SSO).
+              type: string
+            message:
+              description: A human readable message indicating details about why the
+                pod is in this condition.
+              type: string
+            openShiftoAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the OpenShift OAuth.
+              type: boolean
+            pluginRegistryURL:
+              description: Public URL to the Plugin registry
+              type: string
+            reason:
+              description: A brief CamelCase message indicating details about why
+                the pod is in this state.
+              type: string
+          type: object
+      type: object
+  version: v1
+  versions:
+  - name: v1
+    served: true
+    storage: true

olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.1/eclipse-che-preview-kubernetes.v7.25.1.clusterserviceversion.yaml.diff

@@ -0,0 +1,342 @@
+--- /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.0/eclipse-che-preview-kubernetes.v7.25.0.clusterserviceversion.yaml	2021-01-29 07:41:24.316094232 +0000
++++ /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.1/eclipse-che-preview-kubernetes.v7.25.1.clusterserviceversion.yaml	2021-01-29 08:27:32.009831613 +0000
+@@ -83,14 +83,14 @@
+     capabilities: Seamless Upgrades
+     categories: Developer Tools
+     certified: "false"
+-    containerImage: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
+-    createdAt: "2021-01-26T10:44:59Z"
++    containerImage: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++    createdAt: "2021-01-29T08:26:25Z"
+     description: A Kube-native development solution that delivers portable and collaborative
+       developer workspaces.
+     operatorframework.io/suggested-namespace: eclipse-che
+     repository: https://github.com/eclipse/che-operator
+     support: Eclipse Foundation
+-  name: eclipse-che-preview-kubernetes.v7.25.0
++  name: eclipse-che-preview-kubernetes.v7.25.1
+   namespace: placeholder
+ spec:
+   apiservicedefinitions: {}
+@@ -313,13 +313,13 @@
+                       - name: OPERATOR_NAME
+                         value: che-operator
+                       - name: CHE_VERSION
+-                        value: 7.25.0
++                        value: 7.25.1
+                       - name: RELATED_IMAGE_che_server
+-                        value: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
++                        value: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+                       - name: RELATED_IMAGE_plugin_registry
+-                        value: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
++                        value: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+                       - name: RELATED_IMAGE_devfile_registry
+-                        value: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
++                        value: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+                       - name: RELATED_IMAGE_che_tls_secrets_creation_job
+                         value: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+                       - name: RELATED_IMAGE_pvc_jobs
+@@ -327,7 +327,7 @@
+                       - name: RELATED_IMAGE_postgres
+                         value: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+                       - name: RELATED_IMAGE_keycloak
+-                        value: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
++                        value: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_metadata
+                         value: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_artifacts
+@@ -370,8 +370,8 @@
+                         value: quay.io/eclipse/che-buildah-base@sha256:417203d8629edd92f187afd3ebb3d8dc28338d34809eb75ffc2e08a400f8d56b
+                       - name: RELATED_IMAGE_che_buildkit_base_plugin_registry_image_GAXDOLRRFVRGCY3CGA3DS___
+                         value: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
++                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MFZWG2LJMRXWGLJVGMZTOZRYGA______
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MJQXUZLMFVTDCNLDGVSDM___
+@@ -424,53 +424,53 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+                       - name: RELATED_IMAGE_che_sidecar_workspace_data_sync_plugin_registry_image_GAXDALRR
+                         value: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
++                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+                       - name: RELATED_IMAGE_mta_vscode_extension_plugin_registry_image_NRQXIZLTOQ______
+                         value: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+                       - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWCOJRGVSGEN3CMVRWCOBXGE4TQZTDMQ3TQNRQGA4DMOJYHFTGKODBGMZDOYJRME2GMNRVGA4DAMRVMI3DIYLCGI4GMY3DG42DEM3CGI______
+                         value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:a915db7beca87198fcd7860086989fe8a327a1a4f6508025b64ab28fcc7423b2
+                       - name: RELATED_IMAGE_che__centos__mysql_57_centos7_devfile_registry_image_NRQXIZLTOQWWKMBYMVSTIZBUGNRDOMZVGY3DANZWHA2WENRZMJSGKNRTGM2WKMRXMNTDEMDDGAZDAZRTGQ2WENTDGZRTKOJUGAYDCOBTHA4DENZWGQ______
+                         value: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
++                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+                       - name: RELATED_IMAGE_ubi8_minimal_devfile_registry_image_HAXDG___
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_ubi_minimal_devfile_registry_image_
+                         value: registry.access.redhat.com/ubi8/ubi-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+-                    image: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
++                    image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+                     imagePullPolicy: IfNotPresent
+                     livenessProbe:
+                       failureThreshold: 10
+@@ -638,12 +638,12 @@
+   maturity: stable
+   provider:
+     name: Eclipse Foundation
+-  replaces: eclipse-che-preview-kubernetes.v7.24.2
+-  version: 7.25.0
++  replaces: eclipse-che-preview-kubernetes.v7.25.0
++  version: 7.25.1
+   relatedImages:
+-    - name: che-operator-7.25.0
+-      image: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
+-      # tag: quay.io/eclipse/che-operator:7.25.0
++    - name: che-operator-7.25.1
++      image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++      # tag: quay.io/eclipse/che-operator:7.25.1
+     - name: traefik-v2.2.8
+       image: docker.io/traefik@sha256:f5af5a5ce17fc3e353b507e8acce65d7f28126408a8c92dc3cac246d023dc9e8
+       # tag: docker.io/traefik:v2.2.8
+@@ -653,27 +653,27 @@
+     - name: che--centos--postgresql-96-centos7-9.6-b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+       image: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+       # tag: quay.io/eclipse/che--centos--postgresql-96-centos7:9.6-b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+-    - name: che-devfile-registry-7.25.0
+-      image: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
+-      # tag: quay.io/eclipse/che-devfile-registry:7.25.0
++    - name: che-devfile-registry-7.25.1
++      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++      # tag: quay.io/eclipse/che-devfile-registry:7.25.1
+     - name: che-jwtproxy-0.10.0
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy:0.10.0
+-    - name: che-keycloak-7.25.0
+-      image: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
+-      # tag: quay.io/eclipse/che-keycloak:7.25.0
++    - name: che-keycloak-7.25.1
++      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++      # tag: quay.io/eclipse/che-keycloak:7.25.1
+     - name: che-plugin-artifacts-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-artifacts-broker@sha256:4891a6e19be9eae59372f4b31144653f9bd1284e0301ecfe896a099ca6a12b58
+       # tag: quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0
+     - name: che-plugin-metadata-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       # tag: quay.io/eclipse/che-plugin-metadata-broker:v3.4.0
+-    - name: che-plugin-registry-7.25.0
+-      image: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
+-      # tag: quay.io/eclipse/che-plugin-registry:7.25.0
+-    - name: che-server-7.25.0
+-      image: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
+-      # tag: quay.io/eclipse/che-server:7.25.0
++    - name: che-plugin-registry-7.25.1
++      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++      # tag: quay.io/eclipse/che-plugin-registry:7.25.1
++    - name: che-server-7.25.1
++      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++      # tag: quay.io/eclipse/che-server:7.25.1
+     - name: che-tls-secret-creator-alpine-d1ed4ad
+       image: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       # tag: quay.io/eclipse/che-tls-secret-creator:alpine-d1ed4ad
+@@ -701,9 +701,9 @@
+     - name: che-buildkit-base-0.7.1-bacb069
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base:0.7.1-bacb069
+-    - name: che-machine-exec-7.25.0
+-      image: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
+-      # tag: quay.io/eclipse/che-machine-exec:7.25.0
++    - name: che-machine-exec-7.25.1
++      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++      # tag: quay.io/eclipse/che-machine-exec:7.25.1
+     - name: che-plugin-sidecar-asciidoc-5337f80
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+       # tag: quay.io/eclipse/che-plugin-sidecar:asciidoc-5337f80
+@@ -782,12 +782,12 @@
+     - name: che-sidecar-workspace-data-sync-0.0.1
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync:0.0.1
+-    - name: che-theia-endpoint-runtime-binary-7.25.0
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.0
+-    - name: che-theia-7.25.0
+-      image: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
+-      # tag: quay.io/eclipse/che-theia:7.25.0
++    - name: che-theia-endpoint-runtime-binary-7.25.1
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.1
++    - name: che-theia-7.25.1
++      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++      # tag: quay.io/eclipse/che-theia:7.25.1
+     - name: mta-vscode-extension-latest
+       image: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+       # tag: quay.io/windupeng/mta-vscode-extension:latest
+@@ -797,54 +797,54 @@
+     - name: che--centos--mysql-57-centos7-latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       image: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       # tag: quay.io/eclipse/che--centos--mysql-57-centos7:latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-    - name: che-cpp-rhel7-7.25.0
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.0
+-    - name: che-dotnet-2.2-7.25.0
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.0
+-    - name: che-dotnet-3.1-7.25.0
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.0
+-    - name: che-golang-1.14-7.25.0
+-      image: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-      # tag: quay.io/eclipse/che-golang-1.14:7.25.0
+-    - name: che-java11-gradle-7.25.0
+-      image: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-      # tag: quay.io/eclipse/che-java11-gradle:7.25.0
+-    - name: che-java11-maven-7.25.0
+-      image: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-      # tag: quay.io/eclipse/che-java11-maven:7.25.0
+-    - name: che-java8-maven-7.25.0
+-      image: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-      # tag: quay.io/eclipse/che-java8-maven:7.25.0
+-    - name: che-nodejs10-community-7.25.0
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-      # tag: quay.io/eclipse/che-nodejs10-community:7.25.0
+-    - name: che-nodejs10-ubi-7.25.0
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.0
+-    - name: che-nodejs12-community-7.25.0
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-      # tag: quay.io/eclipse/che-nodejs12-community:7.25.0
+-    - name: che-nodejs8-centos-7.25.0
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.0
+-    - name: che-php-7-7.25.0
+-      image: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-      # tag: quay.io/eclipse/che-php-7:7.25.0
+-    - name: che-python-3.7-7.25.0
+-      image: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-      # tag: quay.io/eclipse/che-python-3.7:7.25.0
+-    - name: che-python-3.8-7.25.0
+-      image: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-      # tag: quay.io/eclipse/che-python-3.8:7.25.0
+-    - name: che-quarkus-7.25.0
+-      image: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-      # tag: quay.io/eclipse/che-quarkus:7.25.0
+-    - name: che-rust-1.39-7.25.0
+-      image: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
+-      # tag: quay.io/eclipse/che-rust-1.39:7.25.0
++    - name: che-cpp-rhel7-7.25.1
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.1
++    - name: che-dotnet-2.2-7.25.1
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.1
++    - name: che-dotnet-3.1-7.25.1
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.1
++    - name: che-golang-1.14-7.25.1
++      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++      # tag: quay.io/eclipse/che-golang-1.14:7.25.1
++    - name: che-java11-gradle-7.25.1
++      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++      # tag: quay.io/eclipse/che-java11-gradle:7.25.1
++    - name: che-java11-maven-7.25.1
++      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++      # tag: quay.io/eclipse/che-java11-maven:7.25.1
++    - name: che-java8-maven-7.25.1
++      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++      # tag: quay.io/eclipse/che-java8-maven:7.25.1
++    - name: che-nodejs10-community-7.25.1
++      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++      # tag: quay.io/eclipse/che-nodejs10-community:7.25.1
++    - name: che-nodejs10-ubi-7.25.1
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.1
++    - name: che-nodejs12-community-7.25.1
++      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++      # tag: quay.io/eclipse/che-nodejs12-community:7.25.1
++    - name: che-nodejs8-centos-7.25.1
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.1
++    - name: che-php-7-7.25.1
++      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++      # tag: quay.io/eclipse/che-php-7:7.25.1
++    - name: che-python-3.7-7.25.1
++      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++      # tag: quay.io/eclipse/che-python-3.7:7.25.1
++    - name: che-python-3.8-7.25.1
++      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++      # tag: quay.io/eclipse/che-python-3.8:7.25.1
++    - name: che-quarkus-7.25.1
++      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++      # tag: quay.io/eclipse/che-quarkus:7.25.1
++    - name: che-rust-1.39-7.25.1
++      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++      # tag: quay.io/eclipse/che-rust-1.39:7.25.1
+     - name: ubi8-minimal-8.3
+       image: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+       # tag: registry.access.redhat.com/ubi8-minimal:8.3

olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.2/eclipse-che-preview-kubernetes.crd.yaml

@@ -0,0 +1,826 @@
+#
+#  Copyright (c) 2012-2020 Red Hat, Inc.
+#    This program and the accompanying materials are made
+#    available under the terms of the Eclipse Public License 2.0
+#    which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+#  SPDX-License-Identifier: EPL-2.0
+#
+#  Contributors:
+#    Red Hat, Inc. - initial API and implementation
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: checlusters.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheCluster
+    listKind: CheClusterList
+    plural: checlusters
+    singular: checluster
+  scope: Namespaced
+  subresources:
+    status: {}
+  validation:
+    openAPIV3Schema:
+      description: The `CheCluster` custom resource allows defining and managing a
+        Che server installation
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: Desired configuration of the Che installation. Based on these
+            settings, the operator automatically creates and maintains several config
+            maps that will contain the appropriate environment variables the various
+            components of the Che installation. These generated config maps should
+            NOT be updated manually.
+          properties:
+            auth:
+              description: Configuration settings related to the Authentication used
+                by the Che installation.
+              properties:
+                externalIdentityProvider:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated Identity Provider (Keycloak or RH SSO instance). By
+                    default a dedicated Identity Provider server is deployed as part
+                    of the Che installation. But if `externalIdentityProvider` is
+                    `true`, then no dedicated identity provider will be deployed by
+                    the operator and you might need to provide details about the external
+                    identity provider you want to use. See also all the other fields
+                    starting with: `identityProvider`.'
+                  type: boolean
+                identityProviderAdminUserName:
+                  description: Overrides the name of the Identity Provider admin user.
+                    Defaults to `admin`.
+                  type: string
+                identityProviderClientId:
+                  description: Name of a Identity provider (Keycloak / RH SSO) `client-id`
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field suffixed with `-public`.
+                  type: string
+                identityProviderContainerResources:
+                  description: Identity provider container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                identityProviderImage:
+                  description: Overrides the container image used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. This includes the image
+                    tag. Omit it or leave it empty to use the defaut container image
+                    provided by the operator.
+                  type: string
+                identityProviderImagePullPolicy:
+                  description: Overrides the image pull policy used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. Default value is `Always`
+                    for `nightly` or `latest` images, and `IfNotPresent` in other
+                    cases.
+                  type: string
+                identityProviderIngress:
+                  description: Ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderPassword:
+                  description: Overrides the password of Keycloak admin user. This
+                    is useful to override it ONLY if you use an external Identity
+                    Provider (see the `externalIdentityProvider` field). If omitted
+                    or left blank, it will be set to an auto-generated password.
+                  type: string
+                identityProviderPostgresPassword:
+                  description: Password for The Identity Provider (Keycloak / RH SSO)
+                    to connect to the database. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to an auto-generated
+                    password.
+                  type: string
+                identityProviderPostgresSecret:
+                  description: 'The secret that contains `password` for The Identity
+                    Provider (Keycloak / RH SSO) to connect to the database. If the
+                    secret is defined then `identityProviderPostgresPassword` will
+                    be ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `identityProviderPostgresPassword` is defined,
+                    then it will be used to connect to the database. 2. `identityProviderPostgresPassword`
+                    is not defined, then a new secret with the name `che-identity-postgres-secret`
+                    will be created with an auto-generated value for `password`.'
+                  type: string
+                identityProviderRealm:
+                  description: Name of a Identity provider (Keycloak / RH SSO) realm
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field.
+                  type: string
+                identityProviderRoute:
+                  description: Route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderSecret:
+                  description: 'The secret that contains `user` and `password` for
+                    Identity Provider. If the secret is defined then `identityProviderAdminUserName`
+                    and `identityProviderPassword` are ignored. If the value is omitted
+                    or left blank then there are two scenarios: 1. `identityProviderAdminUserName`
+                    and `identityProviderPassword` are defined, then they will be
+                    used. 2. `identityProviderAdminUserName` or `identityProviderPassword`
+                    are not defined, then a new secret with the name `che-identity-secret`
+                    will be created with default value `admin` for `user` and with
+                    an auto-generated value for `password`.'
+                  type: string
+                identityProviderURL:
+                  description: Public URL of the Identity Provider server (Keycloak
+                    / RH SSO server). You should set it ONLY if you use an external
+                    Identity Provider (see the `externalIdentityProvider` field).
+                    By default this will be automatically calculated and set by the
+                    operator.
+                  type: string
+                oAuthClientName:
+                  description: Name of the OpenShift `OAuthClient` resource used to
+                    setup identity federation on the OpenShift side. Auto-generated
+                    if left blank. See also the `OpenShiftoAuth` field.
+                  type: string
+                oAuthSecret:
+                  description: Name of the secret set in the OpenShift `OAuthClient`
+                    resource used to setup identity federation on the OpenShift side.
+                    Auto-generated if left blank. See also the `OAuthClientName` field.
+                  type: string
+                openShiftoAuth:
+                  description: 'Enables the integration of the identity provider (Keycloak
+                    / RHSSO) with OpenShift OAuth. Empty value on the OpenShift platform
+                    by default. If user changes this empty value to true/false, then
+                    che-operator respect this value. Otherwise che-operator tries
+                    to auto detect if Openshift oAuth can be enabled and change empty
+                    value, correspondly to auto-detection result. This property allows
+                    users to directly login with their Openshift user through the
+                    Openshift login, and have their workspaces created under personal
+                    OpenShift namespaces. WARNING: the `kubeadmin` user is NOT supported,
+                    and logging through it will NOT allow accessing the Che Dashboard.'
+                  type: boolean
+                updateAdminPassword:
+                  description: Forces the default `admin` Che user to update password
+                    on first login. Defaults to `false`.
+                  type: boolean
+              type: object
+            database:
+              description: Configuration settings related to the database used by
+                the Che installation.
+              properties:
+                chePostgresContainerResources:
+                  description: Postgres container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                chePostgresDb:
+                  description: Postgres database name that the Che server uses to
+                    connect to the DB. Defaults to `dbche`.
+                  type: string
+                chePostgresHostName:
+                  description: Postgres Database hostname that the Che server uses
+                    to connect to. Defaults to postgres. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresPassword:
+                  description: Postgres password that the Che server should use to
+                    connect to the DB. If omitted or left blank, it will be set to
+                    an auto-generated value.
+                  type: string
+                chePostgresPort:
+                  description: Postgres Database port that the Che server uses to
+                    connect to. Defaults to 5432. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresSecret:
+                  description: 'The secret that contains Postgres `user` and `password`
+                    that the Che server should use to connect to the DB. If the secret
+                    is defined then `chePostgresUser` and `chePostgresPassword` are
+                    ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `chePostgresUser` and `chePostgresPassword`
+                    are defined, then they will be used to connect to the DB. 2. `chePostgresUser`
+                    or `chePostgresPassword` are not defined, then a new secret with
+                    the name `che-postgres-secret` will be created with default value
+                    of `pgche` for `user` and with an auto-generated value for `password`.'
+                  type: string
+                chePostgresUser:
+                  description: Postgres user that the Che server should use to connect
+                    to the DB. Defaults to `pgche`.
+                  type: string
+                externalDb:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated database. By default a dedicated Postgres database
+                    is deployed as part of the Che installation. But if `externalDb`
+                    is `true`, then no dedicated database will be deployed by the
+                    operator and you might need to provide connection details to the
+                    external DB you want to use. See also all the fields starting
+                    with: `chePostgres`.'
+                  type: boolean
+                postgresImage:
+                  description: Overrides the container image used in the Postgres
+                    database deployment. This includes the image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                postgresImagePullPolicy:
+                  description: Overrides the image pull policy used in the Postgres
+                    database deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+              type: object
+            imagePuller:
+              description: Kubernetes Image Puller configuration
+              properties:
+                enable:
+                  description: "Install and configure the Community Supported Kubernetes
+                    Image Puller Operator. If true and no spec is provided, it will
+                    create a default KubernetesImagePuller object to be managed by
+                    the Operator. If false, the KubernetesImagePuller object will
+                    be deleted, and the operator will be uninstalled, regardless of
+                    whether or not a spec is provided. \n Please note that while this
+                    operator and its behavior is community-supported, its payload
+                    may be commercially-supported if you use it for pulling commercially-supported
+                    images."
+                  type: boolean
+                spec:
+                  description: A KubernetesImagePullerSpec to configure the image
+                    puller in the CheCluster
+                  properties:
+                    cachingCPULimit:
+                      type: string
+                    cachingCPURequest:
+                      type: string
+                    cachingIntervalHours:
+                      type: string
+                    cachingMemoryLimit:
+                      type: string
+                    cachingMemoryRequest:
+                      type: string
+                    configMapName:
+                      type: string
+                    daemonsetName:
+                      type: string
+                    deploymentName:
+                      type: string
+                    images:
+                      type: string
+                    nodeSelector:
+                      type: string
+                  type: object
+              type: object
+            k8s:
+              description: Configuration settings specific to Che installations made
+                on upstream Kubernetes.
+              properties:
+                ingressClass:
+                  description: 'Ingress class that will define the which controler
+                    will manage ingresses. Defaults to `nginx`. NB: This drives the
+                    `is kubernetes.io/ingress.class` annotation on Che-related ingresses.'
+                  type: string
+                ingressDomain:
+                  description: 'Global ingress domain for a K8S cluster. This MUST
+                    be explicitly specified: there are no defaults.'
+                  type: string
+                ingressStrategy:
+                  description: Strategy for ingress creation. This can be `multi-host`
+                    (host is explicitly provided in ingress), `single-host` (host
+                    is provided, path-based rules) and `default-host.*`(no host is
+                    provided, path-based rules). Defaults to `"multi-host` Deprecated
+                    in favor of "serverExposureStrategy" in the "server" section,
+                    which defines this regardless of the cluster type. If both are
+                    defined, `serverExposureStrategy` takes precedence.
+                  type: string
+                securityContextFsGroup:
+                  description: FSGroup the Che pod and Workspace pods containers should
+                    run in. Defaults to `1724`.
+                  type: string
+                securityContextRunAsUser:
+                  description: ID of the user the Che pod and Workspace pods containers
+                    should run as. Default to `1724`.
+                  type: string
+                singleHostExposureType:
+                  description: When the serverExposureStrategy is set to "single-host",
+                    the way the server, registries and workspaces are exposed is further
+                    configured by this property. The possible values are "native"
+                    (which means that the server and workspaces are exposed using
+                    ingresses on K8s) or "gateway" where the server and workspaces
+                    are exposed using a custom gateway based on Traefik. All the endpoints
+                    whether backed by the ingress or gateway "route" always point
+                    to the subpaths on the same domain. Defaults to "native".
+                  type: string
+                tlsSecretName:
+                  description: Name of a secret that is used to set ingress TLS termination
+                    if TLS is enabled. If the specified secret does not exist, a self-signed
+                    certificate will be created. If the value is empty or omitted,
+                    the default ingress controller certificate will be used. See also
+                    the `tlsSupport` field. Note, when switching to the default ingress
+                    controller certificate, `self-signed-certificate` secret should
+                    be deleted manually.
+                  type: string
+              type: object
+            metrics:
+              description: Configuration settings related to the metrics collection
+                used by the Che installation.
+              properties:
+                enable:
+                  description: Enables `metrics` Che server endpoint. Default to `true`.
+                  type: boolean
+              type: object
+            server:
+              description: General configuration settings related to the Che server
+                and the plugin and devfile registries
+              properties:
+                airGapContainerRegistryHostname:
+                  description: Optional hostname (or url) to an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry hostname defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                airGapContainerRegistryOrganization:
+                  description: Optional repository name of an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry organization defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                allowUserDefinedWorkspaceNamespaces:
+                  description: Defines if a user is able to specify Kubernetes namespace
+                    (or OpenShift project) different from the default. It's NOT RECOMMENDED
+                    to configured true without OAuth configured. This property is
+                    also used by the OpenShift infra.
+                  type: boolean
+                cheClusterRoles:
+                  description: Comma-separated list of ClusterRoles that will be assigned
+                    to che ServiceAccount. Be aware that che-operator has to already
+                    have all permissions in these ClusterRoles to be able to grant
+                    them.
+                  type: string
+                cheDebug:
+                  description: Enables the debug mode for Che server. Defaults to
+                    `false`.
+                  type: string
+                cheFlavor:
+                  description: Flavor of the installation. This is either `che` for
+                    upstream Che installations, or `codeready` for CodeReady Workspaces
+                    installation. In most cases the default value should not be overridden.
+                  type: string
+                cheHost:
+                  description: Public hostname of the installed Che server. If value
+                    is omitted then it will be automatically set by the operator.
+                    (see the `cheHostTLSSecret` field).
+                  type: string
+                cheHostTLSSecret:
+                  description: Name of a secret containing certificates to secure
+                    ingress/route for the custom hostname of the installed Che server.
+                    (see the `cheHost` field).
+                  type: string
+                cheImage:
+                  description: Overrides the container image used in Che deployment.
+                    This does NOT include the container image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                cheImagePullPolicy:
+                  description: Overrides the image pull policy used in Che deployment.
+                    Default value is `Always` for `nightly` or `latest` images, and
+                    `IfNotPresent` in other cases.
+                  type: string
+                cheImageTag:
+                  description: Overrides the tag of the container image used in Che
+                    deployment. Omit it or leave it empty to use the defaut image
+                    tag provided by the operator.
+                  type: string
+                cheLogLevel:
+                  description: 'Log level for the Che server: `INFO` or `DEBUG`. Defaults
+                    to `INFO`.'
+                  type: string
+                cheServerIngress:
+                  description: Che server ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheServerRoute:
+                  description: Che server route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheWorkspaceClusterRole:
+                  description: Custom cluster role bound to the user for the Che workspaces.
+                    The default roles are used if this is omitted or left blank.
+                  type: string
+                customCheProperties:
+                  additionalProperties:
+                    type: string
+                  description: Map of additional environment variables that will be
+                    applied in the generated `che` config map to be used by the Che
+                    server, in addition to the values already generated from other
+                    fields of the `CheCluster` custom resource (CR). If `customCheProperties`
+                    contains a property that would be normally generated in `che`
+                    config map from other CR fields, then the value defined in the
+                    `customCheProperties` will be used instead.
+                  type: object
+                devfileRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                devfileRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                devfileRegistryImage:
+                  description: Overrides the container image used in the Devfile registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the defaut container image provided by the operator.
+                  type: string
+                devfileRegistryIngress:
+                  description: Devfile registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Devfile registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                devfileRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Devfile registry
+                    deployment In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                devfileRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Devfile
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                devfileRegistryRoute:
+                  description: Devfile registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryUrl:
+                  description: Public URL of the Devfile registry, that serves sample,
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalDevfileRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                externalDevfileRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Devfile registry server. By default a dedicated devfile
+                    registry server is started. But if `externalDevfileRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `devfileRegistryUrl` field
+                  type: boolean
+                externalPluginRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Plugin registry server. By default a dedicated plugin
+                    registry server is started. But if `externalPluginRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `pluginRegistryUrl` field.
+                  type: boolean
+                gitSelfSignedCert:
+                  description: If enabled, then the certificate from `che-git-self-signed-cert`
+                    config map will be propagated to the Che components and provide
+                    particular configuration for Git.
+                  type: boolean
+                nonProxyHosts:
+                  description: 'List of hosts that should not use the configured proxy.
+                    So specify wild card domain use the following form `.<DOMAIN>`
+                    and `|` as delimiter, eg: `localhost|.my.host.com|123.42.12.32`
+                    Only use when configuring a proxy is required. Operator respects
+                    OpenShift cluster wide proxy configuration and no additional configuration
+                    is required, but defining `nonProxyHosts` in a custom resource
+                    leads to merging non proxy hosts lists from the cluster proxy
+                    configuration and ones defined in the custom resources. (see the
+                    doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyURL` fields).'
+                  type: string
+                pluginRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                pluginRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                pluginRegistryImage:
+                  description: Overrides the container image used in the Plugin registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the default container image provided by the operator.
+                  type: string
+                pluginRegistryIngress:
+                  description: Plugin registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                pluginRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                pluginRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Plugin
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                pluginRegistryRoute:
+                  description: Plugin registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryUrl:
+                  description: Public URL of the Plugin registry, that serves sample
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalPluginRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                proxyPassword:
+                  description: Password of the proxy server Only use when proxy configuration
+                    is required (see also the `proxyURL`, `proxyUser` and `proxySecret`
+                    fields).
+                  type: string
+                proxyPort:
+                  description: Port of the proxy server. Only use when configuring
+                    a proxy is required. (see also the `proxyURL` and `nonProxyHosts`
+                    fields).
+                  type: string
+                proxySecret:
+                  description: The secret that contains `user` and `password` for
+                    a proxy server. If the secret is defined then `proxyUser` and
+                    `proxyPassword` are ignored
+                  type: string
+                proxyURL:
+                  description: URL (protocol+hostname) of the proxy server. This drives
+                    the appropriate changes in the `JAVA_OPTS` and `https(s)_proxy`
+                    variables in the Che server and workspaces containers. Only use
+                    when configuring a proxy is required. Operator respects OpenShift
+                    cluster wide proxy configuration and no additional configuration
+                    is required, but defining `proxyUrl` in a custom resource leads
+                    to overrides the cluster proxy configuration with fields `proxyUrl`,
+                    `proxyPort`, `proxyUser` and `proxyPassword` from the custom resource.
+                    (see the doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyPort` and `nonProxyHosts` fields).
+                  type: string
+                proxyUser:
+                  description: User name of the proxy server. Only use when configuring
+                    a proxy is required (see also the `proxyURL`, `proxyPassword`
+                    and `proxySecret` fields).
+                  type: string
+                selfSignedCert:
+                  description: Deprecated. The value of this flag is ignored. Che
+                    operator will automatically detect if router certificate is self-signed.
+                    If so it will be propagated to Che server and some other components.
+                  type: boolean
+                serverCpuLimit:
+                  description: Overrides the cpu limit used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 1.
+                  type: string
+                serverCpuRequest:
+                  description: Overrides the cpu request used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                serverExposureStrategy:
+                  description: Sets the server and workspaces exposure type. Possible
+                    values are "multi-host", "single-host", "default-host". Defaults
+                    to "multi-host" which creates a separate ingress (or route on
+                    OpenShift) for every required endpoint. "single-host" makes Che
+                    exposed on a single hostname with workspaces exposed on subpaths.
+                    Please read the docs to learn about the limitations of this approach.
+                    Also consult the `singleHostExposureType` property to further
+                    configure how the operator and Che server make that happen on
+                    Kubernetes. "default-host" exposes che server on the host of the
+                    cluster. Please read the docs to learn about the limitations of
+                    this approach.
+                  type: string
+                serverMemoryLimit:
+                  description: Overrides the memory limit used in the Che server deployment.
+                    In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024). Defaults
+                    to 1Gi.
+                  type: string
+                serverMemoryRequest:
+                  description: Overrides the memory request used in the Che server
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 512Mi.
+                  type: string
+                serverTrustStoreConfigMapName:
+                  description: Name of the config-map with public certificates to
+                    add to Java trust store of the Che server. This is usually required
+                    when adding the OpenShift OAuth provider which has https endpoint
+                    signed with self-signed cert. So, Che server must be aware of
+                    its CA cert to be able to request it. This is disabled by default.
+                  type: string
+                singleHostGatewayConfigMapLabels:
+                  additionalProperties:
+                    type: string
+                  description: The labels that need to be present (and are put) on
+                    the configmaps representing the gateway configuration.
+                  type: object
+                singleHostGatewayConfigSidecarImage:
+                  description: The image used for the gateway sidecar that provides
+                    configuration to the gateway. Omit it or leave it empty to use
+                    the defaut container image provided by the operator.
+                  type: string
+                singleHostGatewayImage:
+                  description: The image used for the gateway in the single host mode.
+                    Omit it or leave it empty to use the defaut container image provided
+                    by the operator.
+                  type: string
+                tlsSupport:
+                  description: Deprecated. Instructs the operator to deploy Che in
+                    TLS mode. This is enabled by default. Disabling TLS may cause
+                    malfunction of some Che components.
+                  type: boolean
+                useInternalClusterSVCNames:
+                  description: Use internal cluster svc names to communicate between
+                    components to speed up the traffic and avoid proxy issues. The
+                    default value is `true`.
+                  type: boolean
+                workspaceNamespaceDefault:
+                  description: 'Defines Kubernetes default namespace in which user''s
+                    workspaces are created if user does not override it. It''s possible
+                    to use <username>, <userid> and <workspaceid> placeholders (e.g.:
+                    che-workspace-<username>). In that case, new namespace will be
+                    created for each user (or workspace). Is used by OpenShift infra
+                    as well to specify Project'
+                  type: string
+              type: object
+            storage:
+              description: Configuration settings related to the persistent storage
+                used by the Che installation.
+              properties:
+                postgresPVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claim dedicated
+                    to the Postgres database. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+                preCreateSubPaths:
+                  description: Instructs the Che server to launch a special pod to
+                    pre-create a subpath in the Persistent Volumes. Defaults to `false`,
+                    however it might need to enable it according to the configuration
+                    of your K8S cluster.
+                  type: boolean
+                pvcClaimSize:
+                  description: Size of the persistent volume claim for workspaces.
+                    Defaults to `1Gi`
+                  type: string
+                pvcJobsImage:
+                  description: Overrides the container image used to create sub-paths
+                    in the Persistent Volumes. This includes the image tag. Omit it
+                    or leave it empty to use the defaut container image provided by
+                    the operator. See also the `preCreateSubPaths` field.
+                  type: string
+                pvcStrategy:
+                  description: Persistent volume claim strategy for the Che server.
+                    This Can be:`common` (all workspaces PVCs in one volume), `per-workspace`
+                    (one PVC per workspace for all declared volumes) and `unique`
+                    (one PVC per declared volume). Defaults to `common`.
+                  type: string
+                workspacePVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claims dedicated
+                    to the Che workspaces. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+              type: object
+          type: object
+        status:
+          description: CheClusterStatus defines the observed state of Che installation
+          properties:
+            cheClusterRunning:
+              description: Status of a Che installation. Can be `Available`, `Unavailable`,
+                or `Available, Rolling Update in Progress`
+              type: string
+            cheURL:
+              description: Public URL to the Che server
+              type: string
+            cheVersion:
+              description: Current installed Che version
+              type: string
+            dbProvisioned:
+              description: Indicates if or not a Postgres instance has been correctly
+                provisioned
+              type: boolean
+            devfileRegistryURL:
+              description: Public URL to the Devfile registry
+              type: string
+            gitHubOAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the GitHub OAuth.
+              type: boolean
+            helpLink:
+              description: A URL that can point to some URL where to find help related
+                to the current Operator status.
+              type: string
+            keycloakProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been provisioned with realm, client and user
+              type: boolean
+            keycloakURL:
+              description: Public URL to the Identity Provider server (Keycloak /
+                RH SSO).
+              type: string
+            message:
+              description: A human readable message indicating details about why the
+                pod is in this condition.
+              type: string
+            openShiftoAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the OpenShift OAuth.
+              type: boolean
+            pluginRegistryURL:
+              description: Public URL to the Plugin registry
+              type: string
+            reason:
+              description: A brief CamelCase message indicating details about why
+                the pod is in this state.
+              type: string
+          type: object
+      type: object
+  version: v1
+  versions:
+  - name: v1
+    served: true
+    storage: true

olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.2/eclipse-che-preview-kubernetes.v7.25.2.clusterserviceversion.yaml.diff

@@ -0,0 +1,380 @@
+--- /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.1/eclipse-che-preview-kubernetes.v7.25.1.clusterserviceversion.yaml	2021-02-05 12:12:12.326509985 +0000
++++ /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/7.25.2/eclipse-che-preview-kubernetes.v7.25.2.clusterserviceversion.yaml	2021-02-05 12:55:03.065263764 +0000
+@@ -83,14 +83,14 @@
+     capabilities: Seamless Upgrades
+     categories: Developer Tools
+     certified: "false"
+-    containerImage: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+-    createdAt: "2021-01-29T08:26:25Z"
++    containerImage: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
++    createdAt: "2021-02-05T12:53:51Z"
+     description: A Kube-native development solution that delivers portable and collaborative
+       developer workspaces.
+     operatorframework.io/suggested-namespace: eclipse-che
+     repository: https://github.com/eclipse/che-operator
+     support: Eclipse Foundation
+-  name: eclipse-che-preview-kubernetes.v7.25.1
++  name: eclipse-che-preview-kubernetes.v7.25.2
+   namespace: placeholder
+ spec:
+   apiservicedefinitions: {}
+@@ -313,13 +313,13 @@
+                       - name: OPERATOR_NAME
+                         value: che-operator
+                       - name: CHE_VERSION
+-                        value: 7.25.1
++                        value: 7.25.2
+                       - name: RELATED_IMAGE_che_server
+-                        value: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++                        value: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
+                       - name: RELATED_IMAGE_plugin_registry
+-                        value: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++                        value: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
+                       - name: RELATED_IMAGE_devfile_registry
+-                        value: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++                        value: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
+                       - name: RELATED_IMAGE_che_tls_secrets_creation_job
+                         value: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+                       - name: RELATED_IMAGE_pvc_jobs
+@@ -327,7 +327,7 @@
+                       - name: RELATED_IMAGE_postgres
+                         value: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+                       - name: RELATED_IMAGE_keycloak
+-                        value: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++                        value: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_metadata
+                         value: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_artifacts
+@@ -370,8 +370,8 @@
+                         value: quay.io/eclipse/che-buildah-base@sha256:417203d8629edd92f187afd3ebb3d8dc28338d34809eb75ffc2e08a400f8d56b
+                       - name: RELATED_IMAGE_che_buildkit_base_plugin_registry_image_GAXDOLRRFVRGCY3CGA3DS___
+                         value: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MFZWG2LJMRXWGLJVGMZTOZRYGA______
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MJQXUZLMFVTDCNLDGVSDM___
+@@ -390,8 +390,6 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:55703ae5faebedee56fdce3879fa2281cc260488d8a488ff77ed3d40f778ddf7
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_M5XS2YZZGM4WEYJU
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:8615a29435b0256bffaf85ab2cf9327b059f14eaa6614346dfd51e3a6dd9f041
+-                      - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NBQXG23FNRWC2YRWGQYDGOLG
+-                        value: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NJQXMYJNMI4GMMBVGI4A____
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:70836fd2fc01198c1a31f44d0af9cdf2d7445035be54f0bc7ae2cbfe262e0231
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NJQXMYJYFVRDQZRQGUZDQ___
+@@ -408,8 +406,6 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:491c62a3ac775d5426d72a59ac18bdd50f5f5d61d07fbfb34e0cd7fed3d4da21
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OB4XI2DPNYWTEZTDMYZTIMI_
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:64311210e710ca1614839f897285fc1d39b2ca17215d56c165d091aafd19a14b
+-                      - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OJ2WE6JNMI3DIMBTHFTA____
+-                        value: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OJ2XG5BNGUZGMOLFHFQQ____
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_ONRWC3DBFUYWEZJWHA3TO___
+@@ -424,53 +420,53 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+                       - name: RELATED_IMAGE_che_sidecar_workspace_data_sync_plugin_registry_image_GAXDALRR
+                         value: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
+                       - name: RELATED_IMAGE_mta_vscode_extension_plugin_registry_image_NRQXIZLTOQ______
+                         value: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+                       - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWCOJRGVSGEN3CMVRWCOBXGE4TQZTDMQ3TQNRQGA4DMOJYHFTGKODBGMZDOYJRME2GMNRVGA4DAMRVMI3DIYLCGI4GMY3DG42DEM3CGI______
+                         value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:a915db7beca87198fcd7860086989fe8a327a1a4f6508025b64ab28fcc7423b2
+                       - name: RELATED_IMAGE_che__centos__mysql_57_centos7_devfile_registry_image_NRQXIZLTOQWWKMBYMVSTIZBUGNRDOMZVGY3DANZWHA2WENRZMJSGKNRTGM2WKMRXMNTDEMDDGAZDAZRTGQ2WENTDGZRTKOJUGAYDCOBTHA4DENZWGQ______
+                         value: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
+                       - name: RELATED_IMAGE_ubi8_minimal_devfile_registry_image_HAXDG___
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_ubi_minimal_devfile_registry_image_
+                         value: registry.access.redhat.com/ubi8/ubi-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+-                    image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++                    image: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
+                     imagePullPolicy: IfNotPresent
+                     livenessProbe:
+                       failureThreshold: 10
+@@ -638,12 +634,12 @@
+   maturity: stable
+   provider:
+     name: Eclipse Foundation
+-  replaces: eclipse-che-preview-kubernetes.v7.25.0
+-  version: 7.25.1
++  replaces: eclipse-che-preview-kubernetes.v7.25.1
++  version: 7.25.2
+   relatedImages:
+-    - name: che-operator-7.25.1
+-      image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+-      # tag: quay.io/eclipse/che-operator:7.25.1
++    - name: che-operator-7.25.2
++      image: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
++      # tag: quay.io/eclipse/che-operator:7.25.2
+     - name: traefik-v2.2.8
+       image: docker.io/traefik@sha256:f5af5a5ce17fc3e353b507e8acce65d7f28126408a8c92dc3cac246d023dc9e8
+       # tag: docker.io/traefik:v2.2.8
+@@ -653,27 +649,27 @@
+     - name: che--centos--postgresql-96-centos7-9.6-b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+       image: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+       # tag: quay.io/eclipse/che--centos--postgresql-96-centos7:9.6-b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+-    - name: che-devfile-registry-7.25.1
+-      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+-      # tag: quay.io/eclipse/che-devfile-registry:7.25.1
++    - name: che-devfile-registry-7.25.2
++      image: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
++      # tag: quay.io/eclipse/che-devfile-registry:7.25.2
+     - name: che-jwtproxy-0.10.0
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy:0.10.0
+-    - name: che-keycloak-7.25.1
+-      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+-      # tag: quay.io/eclipse/che-keycloak:7.25.1
++    - name: che-keycloak-7.25.2
++      image: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
++      # tag: quay.io/eclipse/che-keycloak:7.25.2
+     - name: che-plugin-artifacts-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-artifacts-broker@sha256:4891a6e19be9eae59372f4b31144653f9bd1284e0301ecfe896a099ca6a12b58
+       # tag: quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0
+     - name: che-plugin-metadata-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       # tag: quay.io/eclipse/che-plugin-metadata-broker:v3.4.0
+-    - name: che-plugin-registry-7.25.1
+-      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+-      # tag: quay.io/eclipse/che-plugin-registry:7.25.1
+-    - name: che-server-7.25.1
+-      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+-      # tag: quay.io/eclipse/che-server:7.25.1
++    - name: che-plugin-registry-7.25.2
++      image: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
++      # tag: quay.io/eclipse/che-plugin-registry:7.25.2
++    - name: che-server-7.25.2
++      image: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
++      # tag: quay.io/eclipse/che-server:7.25.2
+     - name: che-tls-secret-creator-alpine-d1ed4ad
+       image: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       # tag: quay.io/eclipse/che-tls-secret-creator:alpine-d1ed4ad
+@@ -701,9 +697,9 @@
+     - name: che-buildkit-base-0.7.1-bacb069
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base:0.7.1-bacb069
+-    - name: che-machine-exec-7.25.1
+-      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+-      # tag: quay.io/eclipse/che-machine-exec:7.25.1
++    - name: che-machine-exec-7.25.2
++      image: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
++      # tag: quay.io/eclipse/che-machine-exec:7.25.2
+     - name: che-plugin-sidecar-asciidoc-5337f80
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+       # tag: quay.io/eclipse/che-plugin-sidecar:asciidoc-5337f80
+@@ -731,9 +727,6 @@
+     - name: che-plugin-sidecar-go-c939ba4
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:8615a29435b0256bffaf85ab2cf9327b059f14eaa6614346dfd51e3a6dd9f041
+       # tag: quay.io/eclipse/che-plugin-sidecar:go-c939ba4
+-    - name: che-plugin-sidecar-haskell-b64039f
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+-      # tag: quay.io/eclipse/che-plugin-sidecar:haskell-b64039f
+     - name: che-plugin-sidecar-java-b8f0528
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:70836fd2fc01198c1a31f44d0af9cdf2d7445035be54f0bc7ae2cbfe262e0231
+       # tag: quay.io/eclipse/che-plugin-sidecar:java-b8f0528
+@@ -758,9 +751,6 @@
+     - name: che-plugin-sidecar-python-2fcf341
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:64311210e710ca1614839f897285fc1d39b2ca17215d56c165d091aafd19a14b
+       # tag: quay.io/eclipse/che-plugin-sidecar:python-2fcf341
+-    - name: che-plugin-sidecar-ruby-b64039f
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+-      # tag: quay.io/eclipse/che-plugin-sidecar:ruby-b64039f
+     - name: che-plugin-sidecar-rust-52f9e9a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+       # tag: quay.io/eclipse/che-plugin-sidecar:rust-52f9e9a
+@@ -782,12 +772,12 @@
+     - name: che-sidecar-workspace-data-sync-0.0.1
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync:0.0.1
+-    - name: che-theia-endpoint-runtime-binary-7.25.1
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.1
+-    - name: che-theia-7.25.1
+-      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+-      # tag: quay.io/eclipse/che-theia:7.25.1
++    - name: che-theia-endpoint-runtime-binary-7.25.2
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.2
++    - name: che-theia-7.25.2
++      image: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
++      # tag: quay.io/eclipse/che-theia:7.25.2
+     - name: mta-vscode-extension-latest
+       image: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+       # tag: quay.io/windupeng/mta-vscode-extension:latest
+@@ -797,54 +787,54 @@
+     - name: che--centos--mysql-57-centos7-latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       image: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       # tag: quay.io/eclipse/che--centos--mysql-57-centos7:latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-    - name: che-cpp-rhel7-7.25.1
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.1
+-    - name: che-dotnet-2.2-7.25.1
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.1
+-    - name: che-dotnet-3.1-7.25.1
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.1
+-    - name: che-golang-1.14-7.25.1
+-      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-      # tag: quay.io/eclipse/che-golang-1.14:7.25.1
+-    - name: che-java11-gradle-7.25.1
+-      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-      # tag: quay.io/eclipse/che-java11-gradle:7.25.1
+-    - name: che-java11-maven-7.25.1
+-      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-      # tag: quay.io/eclipse/che-java11-maven:7.25.1
+-    - name: che-java8-maven-7.25.1
+-      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-      # tag: quay.io/eclipse/che-java8-maven:7.25.1
+-    - name: che-nodejs10-community-7.25.1
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-      # tag: quay.io/eclipse/che-nodejs10-community:7.25.1
+-    - name: che-nodejs10-ubi-7.25.1
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.1
+-    - name: che-nodejs12-community-7.25.1
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-      # tag: quay.io/eclipse/che-nodejs12-community:7.25.1
+-    - name: che-nodejs8-centos-7.25.1
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.1
+-    - name: che-php-7-7.25.1
+-      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-      # tag: quay.io/eclipse/che-php-7:7.25.1
+-    - name: che-python-3.7-7.25.1
+-      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-      # tag: quay.io/eclipse/che-python-3.7:7.25.1
+-    - name: che-python-3.8-7.25.1
+-      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-      # tag: quay.io/eclipse/che-python-3.8:7.25.1
+-    - name: che-quarkus-7.25.1
+-      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-      # tag: quay.io/eclipse/che-quarkus:7.25.1
+-    - name: che-rust-1.39-7.25.1
+-      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+-      # tag: quay.io/eclipse/che-rust-1.39:7.25.1
++    - name: che-cpp-rhel7-7.25.2
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.2
++    - name: che-dotnet-2.2-7.25.2
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.2
++    - name: che-dotnet-3.1-7.25.2
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.2
++    - name: che-golang-1.14-7.25.2
++      image: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++      # tag: quay.io/eclipse/che-golang-1.14:7.25.2
++    - name: che-java11-gradle-7.25.2
++      image: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++      # tag: quay.io/eclipse/che-java11-gradle:7.25.2
++    - name: che-java11-maven-7.25.2
++      image: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++      # tag: quay.io/eclipse/che-java11-maven:7.25.2
++    - name: che-java8-maven-7.25.2
++      image: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++      # tag: quay.io/eclipse/che-java8-maven:7.25.2
++    - name: che-nodejs10-community-7.25.2
++      image: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++      # tag: quay.io/eclipse/che-nodejs10-community:7.25.2
++    - name: che-nodejs10-ubi-7.25.2
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.2
++    - name: che-nodejs12-community-7.25.2
++      image: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++      # tag: quay.io/eclipse/che-nodejs12-community:7.25.2
++    - name: che-nodejs8-centos-7.25.2
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.2
++    - name: che-php-7-7.25.2
++      image: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++      # tag: quay.io/eclipse/che-php-7:7.25.2
++    - name: che-python-3.7-7.25.2
++      image: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++      # tag: quay.io/eclipse/che-python-3.7:7.25.2
++    - name: che-python-3.8-7.25.2
++      image: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++      # tag: quay.io/eclipse/che-python-3.8:7.25.2
++    - name: che-quarkus-7.25.2
++      image: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++      # tag: quay.io/eclipse/che-quarkus:7.25.2
++    - name: che-rust-1.39-7.25.2
++      image: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
++      # tag: quay.io/eclipse/che-rust-1.39:7.25.2
+     - name: ubi8-minimal-8.3
+       image: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+       # tag: registry.access.redhat.com/ubi8-minimal:8.3

olm/eclipse-che-preview-kubernetes/deploy/olm-catalog/eclipse-che-preview-kubernetes/eclipse-che-preview-kubernetes.package.yaml

@@ -1,5 +1,5 @@
 channels:
-- currentCSV: eclipse-che-preview-kubernetes.v7.25.0
+- currentCSV: eclipse-che-preview-kubernetes.v7.25.2
   name: stable
 defaultChannel: stable
 packageName: eclipse-che-preview-kubernetes

olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.1/eclipse-che-preview-openshift.crd.yaml

@@ -0,0 +1,827 @@
+#
+#  Copyright (c) 2012-2020 Red Hat, Inc.
+#    This program and the accompanying materials are made
+#    available under the terms of the Eclipse Public License 2.0
+#    which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+#  SPDX-License-Identifier: EPL-2.0
+#
+#  Contributors:
+#    Red Hat, Inc. - initial API and implementation
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: checlusters.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheCluster
+    listKind: CheClusterList
+    plural: checlusters
+    singular: checluster
+  preserveUnknownFields: false
+  scope: Namespaced
+  subresources:
+    status: {}
+  validation:
+    openAPIV3Schema:
+      description: The `CheCluster` custom resource allows defining and managing a
+        Che server installation
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: Desired configuration of the Che installation. Based on these
+            settings, the operator automatically creates and maintains several config
+            maps that will contain the appropriate environment variables the various
+            components of the Che installation. These generated config maps should
+            NOT be updated manually.
+          properties:
+            auth:
+              description: Configuration settings related to the Authentication used
+                by the Che installation.
+              properties:
+                externalIdentityProvider:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated Identity Provider (Keycloak or RH SSO instance). By
+                    default a dedicated Identity Provider server is deployed as part
+                    of the Che installation. But if `externalIdentityProvider` is
+                    `true`, then no dedicated identity provider will be deployed by
+                    the operator and you might need to provide details about the external
+                    identity provider you want to use. See also all the other fields
+                    starting with: `identityProvider`.'
+                  type: boolean
+                identityProviderAdminUserName:
+                  description: Overrides the name of the Identity Provider admin user.
+                    Defaults to `admin`.
+                  type: string
+                identityProviderClientId:
+                  description: Name of a Identity provider (Keycloak / RH SSO) `client-id`
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field suffixed with `-public`.
+                  type: string
+                identityProviderContainerResources:
+                  description: Identity provider container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                identityProviderImage:
+                  description: Overrides the container image used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. This includes the image
+                    tag. Omit it or leave it empty to use the defaut container image
+                    provided by the operator.
+                  type: string
+                identityProviderImagePullPolicy:
+                  description: Overrides the image pull policy used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. Default value is `Always`
+                    for `nightly` or `latest` images, and `IfNotPresent` in other
+                    cases.
+                  type: string
+                identityProviderIngress:
+                  description: Ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderPassword:
+                  description: Overrides the password of Keycloak admin user. This
+                    is useful to override it ONLY if you use an external Identity
+                    Provider (see the `externalIdentityProvider` field). If omitted
+                    or left blank, it will be set to an auto-generated password.
+                  type: string
+                identityProviderPostgresPassword:
+                  description: Password for The Identity Provider (Keycloak / RH SSO)
+                    to connect to the database. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to an auto-generated
+                    password.
+                  type: string
+                identityProviderPostgresSecret:
+                  description: 'The secret that contains `password` for The Identity
+                    Provider (Keycloak / RH SSO) to connect to the database. If the
+                    secret is defined then `identityProviderPostgresPassword` will
+                    be ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `identityProviderPostgresPassword` is defined,
+                    then it will be used to connect to the database. 2. `identityProviderPostgresPassword`
+                    is not defined, then a new secret with the name `che-identity-postgres-secret`
+                    will be created with an auto-generated value for `password`.'
+                  type: string
+                identityProviderRealm:
+                  description: Name of a Identity provider (Keycloak / RH SSO) realm
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field.
+                  type: string
+                identityProviderRoute:
+                  description: Route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderSecret:
+                  description: 'The secret that contains `user` and `password` for
+                    Identity Provider. If the secret is defined then `identityProviderAdminUserName`
+                    and `identityProviderPassword` are ignored. If the value is omitted
+                    or left blank then there are two scenarios: 1. `identityProviderAdminUserName`
+                    and `identityProviderPassword` are defined, then they will be
+                    used. 2. `identityProviderAdminUserName` or `identityProviderPassword`
+                    are not defined, then a new secret with the name `che-identity-secret`
+                    will be created with default value `admin` for `user` and with
+                    an auto-generated value for `password`.'
+                  type: string
+                identityProviderURL:
+                  description: Public URL of the Identity Provider server (Keycloak
+                    / RH SSO server). You should set it ONLY if you use an external
+                    Identity Provider (see the `externalIdentityProvider` field).
+                    By default this will be automatically calculated and set by the
+                    operator.
+                  type: string
+                oAuthClientName:
+                  description: Name of the OpenShift `OAuthClient` resource used to
+                    setup identity federation on the OpenShift side. Auto-generated
+                    if left blank. See also the `OpenShiftoAuth` field.
+                  type: string
+                oAuthSecret:
+                  description: Name of the secret set in the OpenShift `OAuthClient`
+                    resource used to setup identity federation on the OpenShift side.
+                    Auto-generated if left blank. See also the `OAuthClientName` field.
+                  type: string
+                openShiftoAuth:
+                  description: 'Enables the integration of the identity provider (Keycloak
+                    / RHSSO) with OpenShift OAuth. Empty value on the OpenShift platform
+                    by default. If user changes this empty value to true/false, then
+                    che-operator respect this value. Otherwise che-operator tries
+                    to auto detect if Openshift oAuth can be enabled and change empty
+                    value, correspondly to auto-detection result. This property allows
+                    users to directly login with their Openshift user through the
+                    Openshift login, and have their workspaces created under personal
+                    OpenShift namespaces. WARNING: the `kubeadmin` user is NOT supported,
+                    and logging through it will NOT allow accessing the Che Dashboard.'
+                  type: boolean
+                updateAdminPassword:
+                  description: Forces the default `admin` Che user to update password
+                    on first login. Defaults to `false`.
+                  type: boolean
+              type: object
+            database:
+              description: Configuration settings related to the database used by
+                the Che installation.
+              properties:
+                chePostgresContainerResources:
+                  description: Postgres container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                chePostgresDb:
+                  description: Postgres database name that the Che server uses to
+                    connect to the DB. Defaults to `dbche`.
+                  type: string
+                chePostgresHostName:
+                  description: Postgres Database hostname that the Che server uses
+                    to connect to. Defaults to postgres. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresPassword:
+                  description: Postgres password that the Che server should use to
+                    connect to the DB. If omitted or left blank, it will be set to
+                    an auto-generated value.
+                  type: string
+                chePostgresPort:
+                  description: Postgres Database port that the Che server uses to
+                    connect to. Defaults to 5432. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresSecret:
+                  description: 'The secret that contains Postgres `user` and `password`
+                    that the Che server should use to connect to the DB. If the secret
+                    is defined then `chePostgresUser` and `chePostgresPassword` are
+                    ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `chePostgresUser` and `chePostgresPassword`
+                    are defined, then they will be used to connect to the DB. 2. `chePostgresUser`
+                    or `chePostgresPassword` are not defined, then a new secret with
+                    the name `che-postgres-secret` will be created with default value
+                    of `pgche` for `user` and with an auto-generated value for `password`.'
+                  type: string
+                chePostgresUser:
+                  description: Postgres user that the Che server should use to connect
+                    to the DB. Defaults to `pgche`.
+                  type: string
+                externalDb:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated database. By default a dedicated Postgres database
+                    is deployed as part of the Che installation. But if `externalDb`
+                    is `true`, then no dedicated database will be deployed by the
+                    operator and you might need to provide connection details to the
+                    external DB you want to use. See also all the fields starting
+                    with: `chePostgres`.'
+                  type: boolean
+                postgresImage:
+                  description: Overrides the container image used in the Postgres
+                    database deployment. This includes the image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                postgresImagePullPolicy:
+                  description: Overrides the image pull policy used in the Postgres
+                    database deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+              type: object
+            imagePuller:
+              description: Kubernetes Image Puller configuration
+              properties:
+                enable:
+                  description: "Install and configure the Community Supported Kubernetes\
+                    \ Image Puller Operator. If true and no spec is provided, it will\
+                    \ create a default KubernetesImagePuller object to be managed\
+                    \ by the Operator. If false, the KubernetesImagePuller object\
+                    \ will be deleted, and the operator will be uninstalled, regardless\
+                    \ of whether or not a spec is provided. \n Please note that while\
+                    \ this operator and its behavior is community-supported, its payload\
+                    \ may be commercially-supported if you use it for pulling commercially-supported\
+                    \ images."
+                  type: boolean
+                spec:
+                  description: A KubernetesImagePullerSpec to configure the image
+                    puller in the CheCluster
+                  properties:
+                    cachingCPULimit:
+                      type: string
+                    cachingCPURequest:
+                      type: string
+                    cachingIntervalHours:
+                      type: string
+                    cachingMemoryLimit:
+                      type: string
+                    cachingMemoryRequest:
+                      type: string
+                    configMapName:
+                      type: string
+                    daemonsetName:
+                      type: string
+                    deploymentName:
+                      type: string
+                    images:
+                      type: string
+                    nodeSelector:
+                      type: string
+                  type: object
+              type: object
+            k8s:
+              description: Configuration settings specific to Che installations made
+                on upstream Kubernetes.
+              properties:
+                ingressClass:
+                  description: 'Ingress class that will define the which controler
+                    will manage ingresses. Defaults to `nginx`. NB: This drives the
+                    `is kubernetes.io/ingress.class` annotation on Che-related ingresses.'
+                  type: string
+                ingressDomain:
+                  description: 'Global ingress domain for a K8S cluster. This MUST
+                    be explicitly specified: there are no defaults.'
+                  type: string
+                ingressStrategy:
+                  description: Strategy for ingress creation. This can be `multi-host`
+                    (host is explicitly provided in ingress), `single-host` (host
+                    is provided, path-based rules) and `default-host.*`(no host is
+                    provided, path-based rules). Defaults to `"multi-host` Deprecated
+                    in favor of "serverExposureStrategy" in the "server" section,
+                    which defines this regardless of the cluster type. If both are
+                    defined, `serverExposureStrategy` takes precedence.
+                  type: string
+                securityContextFsGroup:
+                  description: FSGroup the Che pod and Workspace pods containers should
+                    run in. Defaults to `1724`.
+                  type: string
+                securityContextRunAsUser:
+                  description: ID of the user the Che pod and Workspace pods containers
+                    should run as. Default to `1724`.
+                  type: string
+                singleHostExposureType:
+                  description: When the serverExposureStrategy is set to "single-host",
+                    the way the server, registries and workspaces are exposed is further
+                    configured by this property. The possible values are "native"
+                    (which means that the server and workspaces are exposed using
+                    ingresses on K8s) or "gateway" where the server and workspaces
+                    are exposed using a custom gateway based on Traefik. All the endpoints
+                    whether backed by the ingress or gateway "route" always point
+                    to the subpaths on the same domain. Defaults to "native".
+                  type: string
+                tlsSecretName:
+                  description: Name of a secret that is used to set ingress TLS termination
+                    if TLS is enabled. If the specified secret does not exist, a self-signed
+                    certificate will be created. If the value is empty or omitted,
+                    the default ingress controller certificate will be used. See also
+                    the `tlsSupport` field. Note, when switching to the default ingress
+                    controller certificate, `self-signed-certificate` secret should
+                    be deleted manually.
+                  type: string
+              type: object
+            metrics:
+              description: Configuration settings related to the metrics collection
+                used by the Che installation.
+              properties:
+                enable:
+                  description: Enables `metrics` Che server endpoint. Default to `true`.
+                  type: boolean
+              type: object
+            server:
+              description: General configuration settings related to the Che server
+                and the plugin and devfile registries
+              properties:
+                airGapContainerRegistryHostname:
+                  description: Optional hostname (or url) to an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry hostname defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                airGapContainerRegistryOrganization:
+                  description: Optional repository name of an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry organization defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                allowUserDefinedWorkspaceNamespaces:
+                  description: Defines if a user is able to specify Kubernetes namespace
+                    (or OpenShift project) different from the default. It's NOT RECOMMENDED
+                    to configured true without OAuth configured. This property is
+                    also used by the OpenShift infra.
+                  type: boolean
+                cheClusterRoles:
+                  description: Comma-separated list of ClusterRoles that will be assigned
+                    to che ServiceAccount. Be aware that che-operator has to already
+                    have all permissions in these ClusterRoles to be able to grant
+                    them.
+                  type: string
+                cheDebug:
+                  description: Enables the debug mode for Che server. Defaults to
+                    `false`.
+                  type: string
+                cheFlavor:
+                  description: Flavor of the installation. This is either `che` for
+                    upstream Che installations, or `codeready` for CodeReady Workspaces
+                    installation. In most cases the default value should not be overridden.
+                  type: string
+                cheHost:
+                  description: Public hostname of the installed Che server. If value
+                    is omitted then it will be automatically set by the operator.
+                    (see the `cheHostTLSSecret` field).
+                  type: string
+                cheHostTLSSecret:
+                  description: Name of a secret containing certificates to secure
+                    ingress/route for the custom hostname of the installed Che server.
+                    (see the `cheHost` field).
+                  type: string
+                cheImage:
+                  description: Overrides the container image used in Che deployment.
+                    This does NOT include the container image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                cheImagePullPolicy:
+                  description: Overrides the image pull policy used in Che deployment.
+                    Default value is `Always` for `nightly` or `latest` images, and
+                    `IfNotPresent` in other cases.
+                  type: string
+                cheImageTag:
+                  description: Overrides the tag of the container image used in Che
+                    deployment. Omit it or leave it empty to use the defaut image
+                    tag provided by the operator.
+                  type: string
+                cheLogLevel:
+                  description: 'Log level for the Che server: `INFO` or `DEBUG`. Defaults
+                    to `INFO`.'
+                  type: string
+                cheServerIngress:
+                  description: Che server ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheServerRoute:
+                  description: Che server route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheWorkspaceClusterRole:
+                  description: Custom cluster role bound to the user for the Che workspaces.
+                    The default roles are used if this is omitted or left blank.
+                  type: string
+                customCheProperties:
+                  additionalProperties:
+                    type: string
+                  description: Map of additional environment variables that will be
+                    applied in the generated `che` config map to be used by the Che
+                    server, in addition to the values already generated from other
+                    fields of the `CheCluster` custom resource (CR). If `customCheProperties`
+                    contains a property that would be normally generated in `che`
+                    config map from other CR fields, then the value defined in the
+                    `customCheProperties` will be used instead.
+                  type: object
+                devfileRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                devfileRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                devfileRegistryImage:
+                  description: Overrides the container image used in the Devfile registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the defaut container image provided by the operator.
+                  type: string
+                devfileRegistryIngress:
+                  description: Devfile registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Devfile registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                devfileRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Devfile registry
+                    deployment In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                devfileRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Devfile
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                devfileRegistryRoute:
+                  description: Devfile registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryUrl:
+                  description: Public URL of the Devfile registry, that serves sample,
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalDevfileRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                externalDevfileRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Devfile registry server. By default a dedicated devfile
+                    registry server is started. But if `externalDevfileRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `devfileRegistryUrl` field
+                  type: boolean
+                externalPluginRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Plugin registry server. By default a dedicated plugin
+                    registry server is started. But if `externalPluginRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `pluginRegistryUrl` field.
+                  type: boolean
+                gitSelfSignedCert:
+                  description: If enabled, then the certificate from `che-git-self-signed-cert`
+                    config map will be propagated to the Che components and provide
+                    particular configuration for Git.
+                  type: boolean
+                nonProxyHosts:
+                  description: 'List of hosts that should not use the configured proxy.
+                    So specify wild card domain use the following form `.<DOMAIN>`
+                    and `|` as delimiter, eg: `localhost|.my.host.com|123.42.12.32`
+                    Only use when configuring a proxy is required. Operator respects
+                    OpenShift cluster wide proxy configuration and no additional configuration
+                    is required, but defining `nonProxyHosts` in a custom resource
+                    leads to merging non proxy hosts lists from the cluster proxy
+                    configuration and ones defined in the custom resources. (see the
+                    doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyURL` fields).'
+                  type: string
+                pluginRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                pluginRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                pluginRegistryImage:
+                  description: Overrides the container image used in the Plugin registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the default container image provided by the operator.
+                  type: string
+                pluginRegistryIngress:
+                  description: Plugin registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                pluginRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                pluginRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Plugin
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                pluginRegistryRoute:
+                  description: Plugin registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryUrl:
+                  description: Public URL of the Plugin registry, that serves sample
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalPluginRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                proxyPassword:
+                  description: Password of the proxy server Only use when proxy configuration
+                    is required (see also the `proxyURL`, `proxyUser` and `proxySecret`
+                    fields).
+                  type: string
+                proxyPort:
+                  description: Port of the proxy server. Only use when configuring
+                    a proxy is required. (see also the `proxyURL` and `nonProxyHosts`
+                    fields).
+                  type: string
+                proxySecret:
+                  description: The secret that contains `user` and `password` for
+                    a proxy server. If the secret is defined then `proxyUser` and
+                    `proxyPassword` are ignored
+                  type: string
+                proxyURL:
+                  description: URL (protocol+hostname) of the proxy server. This drives
+                    the appropriate changes in the `JAVA_OPTS` and `https(s)_proxy`
+                    variables in the Che server and workspaces containers. Only use
+                    when configuring a proxy is required. Operator respects OpenShift
+                    cluster wide proxy configuration and no additional configuration
+                    is required, but defining `proxyUrl` in a custom resource leads
+                    to overrides the cluster proxy configuration with fields `proxyUrl`,
+                    `proxyPort`, `proxyUser` and `proxyPassword` from the custom resource.
+                    (see the doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyPort` and `nonProxyHosts` fields).
+                  type: string
+                proxyUser:
+                  description: User name of the proxy server. Only use when configuring
+                    a proxy is required (see also the `proxyURL`, `proxyPassword`
+                    and `proxySecret` fields).
+                  type: string
+                selfSignedCert:
+                  description: Deprecated. The value of this flag is ignored. Che
+                    operator will automatically detect if router certificate is self-signed.
+                    If so it will be propagated to Che server and some other components.
+                  type: boolean
+                serverCpuLimit:
+                  description: Overrides the cpu limit used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 1.
+                  type: string
+                serverCpuRequest:
+                  description: Overrides the cpu request used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                serverExposureStrategy:
+                  description: Sets the server and workspaces exposure type. Possible
+                    values are "multi-host", "single-host", "default-host". Defaults
+                    to "multi-host" which creates a separate ingress (or route on
+                    OpenShift) for every required endpoint. "single-host" makes Che
+                    exposed on a single hostname with workspaces exposed on subpaths.
+                    Please read the docs to learn about the limitations of this approach.
+                    Also consult the `singleHostExposureType` property to further
+                    configure how the operator and Che server make that happen on
+                    Kubernetes. "default-host" exposes che server on the host of the
+                    cluster. Please read the docs to learn about the limitations of
+                    this approach.
+                  type: string
+                serverMemoryLimit:
+                  description: Overrides the memory limit used in the Che server deployment.
+                    In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024). Defaults
+                    to 1Gi.
+                  type: string
+                serverMemoryRequest:
+                  description: Overrides the memory request used in the Che server
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 512Mi.
+                  type: string
+                serverTrustStoreConfigMapName:
+                  description: Name of the config-map with public certificates to
+                    add to Java trust store of the Che server. This is usually required
+                    when adding the OpenShift OAuth provider which has https endpoint
+                    signed with self-signed cert. So, Che server must be aware of
+                    its CA cert to be able to request it. This is disabled by default.
+                  type: string
+                singleHostGatewayConfigMapLabels:
+                  additionalProperties:
+                    type: string
+                  description: The labels that need to be present (and are put) on
+                    the configmaps representing the gateway configuration.
+                  type: object
+                singleHostGatewayConfigSidecarImage:
+                  description: The image used for the gateway sidecar that provides
+                    configuration to the gateway. Omit it or leave it empty to use
+                    the defaut container image provided by the operator.
+                  type: string
+                singleHostGatewayImage:
+                  description: The image used for the gateway in the single host mode.
+                    Omit it or leave it empty to use the defaut container image provided
+                    by the operator.
+                  type: string
+                tlsSupport:
+                  description: Deprecated. Instructs the operator to deploy Che in
+                    TLS mode. This is enabled by default. Disabling TLS may cause
+                    malfunction of some Che components.
+                  type: boolean
+                useInternalClusterSVCNames:
+                  description: Use internal cluster svc names to communicate between
+                    components to speed up the traffic and avoid proxy issues. The
+                    default value is `true`.
+                  type: boolean
+                workspaceNamespaceDefault:
+                  description: 'Defines Kubernetes default namespace in which user''s
+                    workspaces are created if user does not override it. It''s possible
+                    to use <username>, <userid> and <workspaceid> placeholders (e.g.:
+                    che-workspace-<username>). In that case, new namespace will be
+                    created for each user (or workspace). Is used by OpenShift infra
+                    as well to specify Project'
+                  type: string
+              type: object
+            storage:
+              description: Configuration settings related to the persistent storage
+                used by the Che installation.
+              properties:
+                postgresPVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claim dedicated
+                    to the Postgres database. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+                preCreateSubPaths:
+                  description: Instructs the Che server to launch a special pod to
+                    pre-create a subpath in the Persistent Volumes. Defaults to `false`,
+                    however it might need to enable it according to the configuration
+                    of your K8S cluster.
+                  type: boolean
+                pvcClaimSize:
+                  description: Size of the persistent volume claim for workspaces.
+                    Defaults to `1Gi`
+                  type: string
+                pvcJobsImage:
+                  description: Overrides the container image used to create sub-paths
+                    in the Persistent Volumes. This includes the image tag. Omit it
+                    or leave it empty to use the defaut container image provided by
+                    the operator. See also the `preCreateSubPaths` field.
+                  type: string
+                pvcStrategy:
+                  description: Persistent volume claim strategy for the Che server.
+                    This Can be:`common` (all workspaces PVCs in one volume), `per-workspace`
+                    (one PVC per workspace for all declared volumes) and `unique`
+                    (one PVC per declared volume). Defaults to `common`.
+                  type: string
+                workspacePVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claims dedicated
+                    to the Che workspaces. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+              type: object
+          type: object
+        status:
+          description: CheClusterStatus defines the observed state of Che installation
+          properties:
+            cheClusterRunning:
+              description: Status of a Che installation. Can be `Available`, `Unavailable`,
+                or `Available, Rolling Update in Progress`
+              type: string
+            cheURL:
+              description: Public URL to the Che server
+              type: string
+            cheVersion:
+              description: Current installed Che version
+              type: string
+            dbProvisioned:
+              description: Indicates if or not a Postgres instance has been correctly
+                provisioned
+              type: boolean
+            devfileRegistryURL:
+              description: Public URL to the Devfile registry
+              type: string
+            gitHubOAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the GitHub OAuth.
+              type: boolean
+            helpLink:
+              description: A URL that can point to some URL where to find help related
+                to the current Operator status.
+              type: string
+            keycloakProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been provisioned with realm, client and user
+              type: boolean
+            keycloakURL:
+              description: Public URL to the Identity Provider server (Keycloak /
+                RH SSO).
+              type: string
+            message:
+              description: A human readable message indicating details about why the
+                pod is in this condition.
+              type: string
+            openShiftoAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the OpenShift OAuth.
+              type: boolean
+            pluginRegistryURL:
+              description: Public URL to the Plugin registry
+              type: string
+            reason:
+              description: A brief CamelCase message indicating details about why
+                the pod is in this state.
+              type: string
+          type: object
+      type: object
+  version: v1
+  versions:
+    - name: v1
+      served: true
+      storage: true

olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.1/eclipse-che-preview-openshift.v7.25.1.clusterserviceversion.yaml.diff

@@ -0,0 +1,492 @@
+--- /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.0/eclipse-che-preview-openshift.v7.25.0.clusterserviceversion.yaml	2021-01-29 07:41:24.324094137 +0000
++++ /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.1/eclipse-che-preview-openshift.v7.25.1.clusterserviceversion.yaml	2021-01-29 08:28:21.521288986 +0000
+@@ -74,14 +74,14 @@
+     capabilities: Seamless Upgrades
+     categories: Developer Tools, OpenShift Optional
+     certified: "false"
+-    containerImage: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
+-    createdAt: "2021-01-26T10:46:10Z"
++    containerImage: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++    createdAt: "2021-01-29T08:27:32Z"
+     description: A Kube-native development solution that delivers portable and collaborative
+       developer workspaces in OpenShift.
+     operatorframework.io/suggested-namespace: eclipse-che
+     repository: https://github.com/eclipse/che-operator
+     support: Eclipse Foundation
+-  name: eclipse-che-preview-openshift.v7.25.0
++  name: eclipse-che-preview-openshift.v7.25.1
+   namespace: placeholder
+ spec:
+   apiservicedefinitions: {}
+@@ -328,19 +328,19 @@
+                       - name: OPERATOR_NAME
+                         value: che-operator
+                       - name: CHE_VERSION
+-                        value: 7.25.0
++                        value: 7.25.1
+                       - name: RELATED_IMAGE_che_server
+-                        value: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
++                        value: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+                       - name: RELATED_IMAGE_plugin_registry
+-                        value: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
++                        value: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+                       - name: RELATED_IMAGE_devfile_registry
+-                        value: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
++                        value: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+                       - name: RELATED_IMAGE_pvc_jobs
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_postgres
+                         value: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+                       - name: RELATED_IMAGE_keycloak
+-                        value: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
++                        value: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_metadata
+                         value: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_artifacts
+@@ -383,8 +383,8 @@
+                         value: quay.io/eclipse/che-buildah-base@sha256:417203d8629edd92f187afd3ebb3d8dc28338d34809eb75ffc2e08a400f8d56b
+                       - name: RELATED_IMAGE_che_buildkit_base_plugin_registry_image_GAXDOLRRFVRGCY3CGA3DS___
+                         value: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
++                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MFZWG2LJMRXWGLJVGMZTOZRYGA______
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MJQXUZLMFVTDCNLDGVSDM___
+@@ -437,53 +437,53 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+                       - name: RELATED_IMAGE_che_sidecar_workspace_data_sync_plugin_registry_image_GAXDALRR
+                         value: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
++                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+                       - name: RELATED_IMAGE_mta_vscode_extension_plugin_registry_image_NRQXIZLTOQ______
+                         value: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+                       - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWCOJRGVSGEN3CMVRWCOBXGE4TQZTDMQ3TQNRQGA4DMOJYHFTGKODBGMZDOYJRME2GMNRVGA4DAMRVMI3DIYLCGI4GMY3DG42DEM3CGI______
+                         value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:a915db7beca87198fcd7860086989fe8a327a1a4f6508025b64ab28fcc7423b2
+                       - name: RELATED_IMAGE_che__centos__mysql_57_centos7_devfile_registry_image_NRQXIZLTOQWWKMBYMVSTIZBUGNRDOMZVGY3DANZWHA2WENRZMJSGKNRTGM2WKMRXMNTDEMDDGAZDAZRTGQ2WENTDGZRTKOJUGAYDCOBTHA4DENZWGQ______
+                         value: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGA______
+-                        value: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
++                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGE______
++                        value: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+                       - name: RELATED_IMAGE_ubi8_minimal_devfile_registry_image_HAXDG___
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_ubi_minimal_devfile_registry_image_
+                         value: registry.access.redhat.com/ubi8/ubi-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+-                    image: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
++                    image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+                     imagePullPolicy: IfNotPresent
+                     livenessProbe:
+                       failureThreshold: 10
+@@ -657,12 +657,12 @@
+   maturity: stable
+   provider:
+     name: Eclipse Foundation
+-  replaces: eclipse-che-preview-openshift.v7.24.2
+-  version: 7.25.0
++  replaces: eclipse-che-preview-openshift.v7.25.0
++  version: 7.25.1
+   relatedImages:
+-    - name: che-operator-7.25.0
+-      image: quay.io/eclipse/che-operator@sha256:22bb6fdfbcd7cca4c0b4db9fa0b50f65e5a963e93f7173c4028c30276d80ab97
+-      # tag: quay.io/eclipse/che-operator:7.25.0
++    - name: che-operator-7.25.1
++      image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++      # tag: quay.io/eclipse/che-operator:7.25.1
+     - name: code-server-@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+       image: docker.io/codercom/code-server@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+       # tag: docker.io/codercom/code-server@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+@@ -708,63 +708,63 @@
+     - name: che-buildkit-base-@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-    - name: che-cpp-rhel7-@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-      # tag: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-    - name: che-devfile-registry-7.25.0
+-      image: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
+-      # tag: quay.io/eclipse/che-devfile-registry:7.25.0
+-    - name: che-devfile-registry-@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
+-      image: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
+-      # tag: quay.io/eclipse/che-devfile-registry@sha256:d7c13ef4ecd77c4520a8a80ba265029e8bee3d69dd2bee8ad5339814aa651230
+-    - name: che-dotnet-2.2-@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-      # tag: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-    - name: che-dotnet-3.1-@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-      # tag: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-    - name: che-golang-1.14-@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-      image: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-      # tag: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-    - name: che-java11-gradle-@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-      image: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-      # tag: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-    - name: che-java11-maven-@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-      image: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-      # tag: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-    - name: che-java8-maven-@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-      image: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-      # tag: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
++    - name: che-cpp-rhel7-@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++      # tag: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++    - name: che-devfile-registry-7.25.1
++      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++      # tag: quay.io/eclipse/che-devfile-registry:7.25.1
++    - name: che-devfile-registry-@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++      # tag: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++    - name: che-dotnet-2.2-@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++      # tag: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++    - name: che-dotnet-3.1-@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++      # tag: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++    - name: che-golang-1.14-@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++      # tag: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++    - name: che-java11-gradle-@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++      # tag: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++    - name: che-java11-maven-@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++      # tag: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++    - name: che-java8-maven-@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++      # tag: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+     - name: che-jwtproxy-0.10.0
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy:0.10.0
+     - name: che-jwtproxy-@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+-    - name: che-keycloak-7.25.0
+-      image: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
+-      # tag: quay.io/eclipse/che-keycloak:7.25.0
+-    - name: che-keycloak-@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
+-      image: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
+-      # tag: quay.io/eclipse/che-keycloak@sha256:a7ce0f5343469b42079f0bd79dd0f4344e9de8fa439d39d94413466b96ba28af
+-    - name: che-machine-exec-@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
+-      image: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
+-      # tag: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
+-    - name: che-nodejs10-community-@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-      # tag: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-    - name: che-nodejs10-ubi-@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-      # tag: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-    - name: che-nodejs12-community-@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-      # tag: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-    - name: che-nodejs8-centos-@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-      # tag: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-    - name: che-php-7-@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-      image: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-      # tag: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
++    - name: che-keycloak-7.25.1
++      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++      # tag: quay.io/eclipse/che-keycloak:7.25.1
++    - name: che-keycloak-@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++      # tag: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++    - name: che-machine-exec-@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++      # tag: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++    - name: che-nodejs10-community-@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++      # tag: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++    - name: che-nodejs10-ubi-@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++      # tag: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++    - name: che-nodejs12-community-@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++      # tag: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++    - name: che-nodejs8-centos-@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++      # tag: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++    - name: che-php-7-@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++      # tag: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+     - name: che-plugin-artifacts-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-artifacts-broker@sha256:4891a6e19be9eae59372f4b31144653f9bd1284e0301ecfe896a099ca6a12b58
+       # tag: quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0
+@@ -777,12 +777,12 @@
+     - name: che-plugin-metadata-broker-@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       image: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       # tag: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+-    - name: che-plugin-registry-7.25.0
+-      image: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
+-      # tag: quay.io/eclipse/che-plugin-registry:7.25.0
+-    - name: che-plugin-registry-@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
+-      image: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
+-      # tag: quay.io/eclipse/che-plugin-registry@sha256:4ca8ef9eaf2f059ed936b6ae83793a98190291ea89cd99d7cb4b9ac05cef648c
++    - name: che-plugin-registry-7.25.1
++      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++      # tag: quay.io/eclipse/che-plugin-registry:7.25.1
++    - name: che-plugin-registry-@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++      # tag: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+     - name: che-plugin-sidecar-@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+@@ -858,33 +858,33 @@
+     - name: che-plugin-sidecar-@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+-    - name: che-python-3.7-@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-      image: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-      # tag: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-    - name: che-python-3.8-@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-      image: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-      # tag: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-    - name: che-quarkus-@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-      image: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-      # tag: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-    - name: che-rust-1.39-@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
+-      image: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
+-      # tag: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
+-    - name: che-server-7.25.0
+-      image: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
+-      # tag: quay.io/eclipse/che-server:7.25.0
+-    - name: che-server-@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
+-      image: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
+-      # tag: quay.io/eclipse/che-server@sha256:f48b84be09094ec2b6ee5d9fad41b52e89051776110133c6b03c92e94d16d7e9
++    - name: che-python-3.7-@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++      # tag: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++    - name: che-python-3.8-@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++      # tag: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++    - name: che-quarkus-@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++      # tag: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++    - name: che-rust-1.39-@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++      # tag: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++    - name: che-server-7.25.1
++      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++      # tag: quay.io/eclipse/che-server:7.25.1
++    - name: che-server-@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++      # tag: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+     - name: che-sidecar-workspace-data-sync-@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-    - name: che-theia-endpoint-runtime-binary-@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-    - name: che-theia-@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
+-      image: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
+-      # tag: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
++    - name: che-theia-endpoint-runtime-binary-@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++    - name: che-theia-@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++      # tag: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+     - name: che-tls-secret-creator-@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       image: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       # tag: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+@@ -921,9 +921,9 @@
+     - name: che-buildkit-base-0.7.1-bacb069
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base:0.7.1-bacb069
+-    - name: che-machine-exec-7.25.0
+-      image: quay.io/eclipse/che-machine-exec@sha256:7ec846d087ee1f11bc213e7a7488750611e4048f98cb0d7347b72fe7d087b616
+-      # tag: quay.io/eclipse/che-machine-exec:7.25.0
++    - name: che-machine-exec-7.25.1
++      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++      # tag: quay.io/eclipse/che-machine-exec:7.25.1
+     - name: che-plugin-sidecar-asciidoc-5337f80
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+       # tag: quay.io/eclipse/che-plugin-sidecar:asciidoc-5337f80
+@@ -1002,12 +1002,12 @@
+     - name: che-sidecar-workspace-data-sync-0.0.1
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync:0.0.1
+-    - name: che-theia-endpoint-runtime-binary-7.25.0
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:50c4eea1fbbd0f3fab0fb5347e33dae7fd12bb8f30b3459750dd948ef2a79ac7
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.0
+-    - name: che-theia-7.25.0
+-      image: quay.io/eclipse/che-theia@sha256:c69b4701fd65f79f80833df18c17ea34fd8876d7bd95f6a808b428e3b6cb47a0
+-      # tag: quay.io/eclipse/che-theia:7.25.0
++    - name: che-theia-endpoint-runtime-binary-7.25.1
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.1
++    - name: che-theia-7.25.1
++      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++      # tag: quay.io/eclipse/che-theia:7.25.1
+     - name: mta-vscode-extension-latest
+       image: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+       # tag: quay.io/windupeng/mta-vscode-extension:latest
+@@ -1017,54 +1017,54 @@
+     - name: che--centos--mysql-57-centos7-latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       image: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       # tag: quay.io/eclipse/che--centos--mysql-57-centos7:latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-    - name: che-cpp-rhel7-7.25.0
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:61061f00950100441ad86124c5ef1a4a77fe44362372fe5a0925449a1f67b3ba
+-      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.0
+-    - name: che-dotnet-2.2-7.25.0
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:7abad700feb5ca051d636af0003ca6c1e44c755dbf6a0b000f6fd30a4649ed39
+-      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.0
+-    - name: che-dotnet-3.1-7.25.0
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:edc458c9acf7260e951f41a52f55b072459b8016958945ca9e3aa79a3ed2abee
+-      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.0
+-    - name: che-golang-1.14-7.25.0
+-      image: quay.io/eclipse/che-golang-1.14@sha256:85c9a7702fa62000ee743bda18ae236aa208a97520690a798fb0e522c04f5acd
+-      # tag: quay.io/eclipse/che-golang-1.14:7.25.0
+-    - name: che-java11-gradle-7.25.0
+-      image: quay.io/eclipse/che-java11-gradle@sha256:fcf158878ccf999ec4d0ec4b94d813c7c0b5d506c023a63b24358ac736ce3849
+-      # tag: quay.io/eclipse/che-java11-gradle:7.25.0
+-    - name: che-java11-maven-7.25.0
+-      image: quay.io/eclipse/che-java11-maven@sha256:edf270bd09599790072414bc36eee15ba86cbbafc7643b71e9c4de346eb1d783
+-      # tag: quay.io/eclipse/che-java11-maven:7.25.0
+-    - name: che-java8-maven-7.25.0
+-      image: quay.io/eclipse/che-java8-maven@sha256:9ec9cb95961ef3d022636ea701a21123aeac8ec1a829b4eb4d2ff7feceb5f800
+-      # tag: quay.io/eclipse/che-java8-maven:7.25.0
+-    - name: che-nodejs10-community-7.25.0
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:f52281cbfbb295f5064efd83d2a0fc5f854cbc357e6f74b4da392052742b0156
+-      # tag: quay.io/eclipse/che-nodejs10-community:7.25.0
+-    - name: che-nodejs10-ubi-7.25.0
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:84d1593553b373ff0d976d792cac313dc2aeb2f4d4bf908776752cb799d13da1
+-      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.0
+-    - name: che-nodejs12-community-7.25.0
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:45b69cab2aff3c646ab6c756438761cae2c2a01d6d59e1ac1f3ec97d8c1c3d4f
+-      # tag: quay.io/eclipse/che-nodejs12-community:7.25.0
+-    - name: che-nodejs8-centos-7.25.0
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:3b2d38eb73e8e5dc351924d6e7e787394d7157effe28ae0dd402ebe7dd9c06f5
+-      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.0
+-    - name: che-php-7-7.25.0
+-      image: quay.io/eclipse/che-php-7@sha256:bc8e69bd17a1a7b6549086c3aaacbc038ad0e523b636b947f326af93991e830b
+-      # tag: quay.io/eclipse/che-php-7:7.25.0
+-    - name: che-python-3.7-7.25.0
+-      image: quay.io/eclipse/che-python-3.7@sha256:a5187abba32d6bef1b23ebe55174ef892f8f59c653ee2a77594b35d37134aec5
+-      # tag: quay.io/eclipse/che-python-3.7:7.25.0
+-    - name: che-python-3.8-7.25.0
+-      image: quay.io/eclipse/che-python-3.8@sha256:6f289152120b737c0d1776b45419d1f659e81a9bded37985616f73a50e1faa72
+-      # tag: quay.io/eclipse/che-python-3.8:7.25.0
+-    - name: che-quarkus-7.25.0
+-      image: quay.io/eclipse/che-quarkus@sha256:e0e9c54749aa2fffb4f0012bb79adc0b4d05107c61a2e14c49124d673a0c78cc
+-      # tag: quay.io/eclipse/che-quarkus:7.25.0
+-    - name: che-rust-1.39-7.25.0
+-      image: quay.io/eclipse/che-rust-1.39@sha256:0e9af0b0818e70327f465b9ad98bdc9e9109935da9ce058013c8d8b827ad298d
+-      # tag: quay.io/eclipse/che-rust-1.39:7.25.0
++    - name: che-cpp-rhel7-7.25.1
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
++      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.1
++    - name: che-dotnet-2.2-7.25.1
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
++      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.1
++    - name: che-dotnet-3.1-7.25.1
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
++      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.1
++    - name: che-golang-1.14-7.25.1
++      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
++      # tag: quay.io/eclipse/che-golang-1.14:7.25.1
++    - name: che-java11-gradle-7.25.1
++      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
++      # tag: quay.io/eclipse/che-java11-gradle:7.25.1
++    - name: che-java11-maven-7.25.1
++      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
++      # tag: quay.io/eclipse/che-java11-maven:7.25.1
++    - name: che-java8-maven-7.25.1
++      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++      # tag: quay.io/eclipse/che-java8-maven:7.25.1
++    - name: che-nodejs10-community-7.25.1
++      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
++      # tag: quay.io/eclipse/che-nodejs10-community:7.25.1
++    - name: che-nodejs10-ubi-7.25.1
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
++      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.1
++    - name: che-nodejs12-community-7.25.1
++      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
++      # tag: quay.io/eclipse/che-nodejs12-community:7.25.1
++    - name: che-nodejs8-centos-7.25.1
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
++      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.1
++    - name: che-php-7-7.25.1
++      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++      # tag: quay.io/eclipse/che-php-7:7.25.1
++    - name: che-python-3.7-7.25.1
++      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
++      # tag: quay.io/eclipse/che-python-3.7:7.25.1
++    - name: che-python-3.8-7.25.1
++      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
++      # tag: quay.io/eclipse/che-python-3.8:7.25.1
++    - name: che-quarkus-7.25.1
++      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
++      # tag: quay.io/eclipse/che-quarkus:7.25.1
++    - name: che-rust-1.39-7.25.1
++      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++      # tag: quay.io/eclipse/che-rust-1.39:7.25.1
+     - name: ubi8-minimal-8.3
+       image: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+       # tag: registry.access.redhat.com/ubi8-minimal:8.3

olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.2/eclipse-che-preview-openshift.crd.yaml

@@ -0,0 +1,827 @@
+#
+#  Copyright (c) 2012-2020 Red Hat, Inc.
+#    This program and the accompanying materials are made
+#    available under the terms of the Eclipse Public License 2.0
+#    which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+#  SPDX-License-Identifier: EPL-2.0
+#
+#  Contributors:
+#    Red Hat, Inc. - initial API and implementation
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: checlusters.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheCluster
+    listKind: CheClusterList
+    plural: checlusters
+    singular: checluster
+  preserveUnknownFields: false
+  scope: Namespaced
+  subresources:
+    status: {}
+  validation:
+    openAPIV3Schema:
+      description: The `CheCluster` custom resource allows defining and managing a
+        Che server installation
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: Desired configuration of the Che installation. Based on these
+            settings, the operator automatically creates and maintains several config
+            maps that will contain the appropriate environment variables the various
+            components of the Che installation. These generated config maps should
+            NOT be updated manually.
+          properties:
+            auth:
+              description: Configuration settings related to the Authentication used
+                by the Che installation.
+              properties:
+                externalIdentityProvider:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated Identity Provider (Keycloak or RH SSO instance). By
+                    default a dedicated Identity Provider server is deployed as part
+                    of the Che installation. But if `externalIdentityProvider` is
+                    `true`, then no dedicated identity provider will be deployed by
+                    the operator and you might need to provide details about the external
+                    identity provider you want to use. See also all the other fields
+                    starting with: `identityProvider`.'
+                  type: boolean
+                identityProviderAdminUserName:
+                  description: Overrides the name of the Identity Provider admin user.
+                    Defaults to `admin`.
+                  type: string
+                identityProviderClientId:
+                  description: Name of a Identity provider (Keycloak / RH SSO) `client-id`
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field suffixed with `-public`.
+                  type: string
+                identityProviderContainerResources:
+                  description: Identity provider container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                identityProviderImage:
+                  description: Overrides the container image used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. This includes the image
+                    tag. Omit it or leave it empty to use the defaut container image
+                    provided by the operator.
+                  type: string
+                identityProviderImagePullPolicy:
+                  description: Overrides the image pull policy used in the Identity
+                    Provider (Keycloak / RH SSO) deployment. Default value is `Always`
+                    for `nightly` or `latest` images, and `IfNotPresent` in other
+                    cases.
+                  type: string
+                identityProviderIngress:
+                  description: Ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderPassword:
+                  description: Overrides the password of Keycloak admin user. This
+                    is useful to override it ONLY if you use an external Identity
+                    Provider (see the `externalIdentityProvider` field). If omitted
+                    or left blank, it will be set to an auto-generated password.
+                  type: string
+                identityProviderPostgresPassword:
+                  description: Password for The Identity Provider (Keycloak / RH SSO)
+                    to connect to the database. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to an auto-generated
+                    password.
+                  type: string
+                identityProviderPostgresSecret:
+                  description: 'The secret that contains `password` for The Identity
+                    Provider (Keycloak / RH SSO) to connect to the database. If the
+                    secret is defined then `identityProviderPostgresPassword` will
+                    be ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `identityProviderPostgresPassword` is defined,
+                    then it will be used to connect to the database. 2. `identityProviderPostgresPassword`
+                    is not defined, then a new secret with the name `che-identity-postgres-secret`
+                    will be created with an auto-generated value for `password`.'
+                  type: string
+                identityProviderRealm:
+                  description: Name of a Identity provider (Keycloak / RH SSO) realm
+                    that should be used for Che. This is useful to override it ONLY
+                    if you use an external Identity Provider (see the `externalIdentityProvider`
+                    field). If omitted or left blank, it will be set to the value
+                    of the `flavour` field.
+                  type: string
+                identityProviderRoute:
+                  description: Route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                identityProviderSecret:
+                  description: 'The secret that contains `user` and `password` for
+                    Identity Provider. If the secret is defined then `identityProviderAdminUserName`
+                    and `identityProviderPassword` are ignored. If the value is omitted
+                    or left blank then there are two scenarios: 1. `identityProviderAdminUserName`
+                    and `identityProviderPassword` are defined, then they will be
+                    used. 2. `identityProviderAdminUserName` or `identityProviderPassword`
+                    are not defined, then a new secret with the name `che-identity-secret`
+                    will be created with default value `admin` for `user` and with
+                    an auto-generated value for `password`.'
+                  type: string
+                identityProviderURL:
+                  description: Public URL of the Identity Provider server (Keycloak
+                    / RH SSO server). You should set it ONLY if you use an external
+                    Identity Provider (see the `externalIdentityProvider` field).
+                    By default this will be automatically calculated and set by the
+                    operator.
+                  type: string
+                oAuthClientName:
+                  description: Name of the OpenShift `OAuthClient` resource used to
+                    setup identity federation on the OpenShift side. Auto-generated
+                    if left blank. See also the `OpenShiftoAuth` field.
+                  type: string
+                oAuthSecret:
+                  description: Name of the secret set in the OpenShift `OAuthClient`
+                    resource used to setup identity federation on the OpenShift side.
+                    Auto-generated if left blank. See also the `OAuthClientName` field.
+                  type: string
+                openShiftoAuth:
+                  description: 'Enables the integration of the identity provider (Keycloak
+                    / RHSSO) with OpenShift OAuth. Empty value on the OpenShift platform
+                    by default. If user changes this empty value to true/false, then
+                    che-operator respect this value. Otherwise che-operator tries
+                    to auto detect if Openshift oAuth can be enabled and change empty
+                    value, correspondly to auto-detection result. This property allows
+                    users to directly login with their Openshift user through the
+                    Openshift login, and have their workspaces created under personal
+                    OpenShift namespaces. WARNING: the `kubeadmin` user is NOT supported,
+                    and logging through it will NOT allow accessing the Che Dashboard.'
+                  type: boolean
+                updateAdminPassword:
+                  description: Forces the default `admin` Che user to update password
+                    on first login. Defaults to `false`.
+                  type: boolean
+              type: object
+            database:
+              description: Configuration settings related to the database used by
+                the Che installation.
+              properties:
+                chePostgresContainerResources:
+                  description: Postgres container custom settings
+                  properties:
+                    limits:
+                      description: Limits describes the maximum amount of compute
+                        resources allowed.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                    request:
+                      description: Requests describes the minimum amount of compute
+                        resources required.
+                      properties:
+                        cpu:
+                          description: CPU, in cores. (500m = .5 cores)
+                          type: string
+                        memory:
+                          description: Memory, in bytes. (500Gi = 500GiB = 500 * 1024
+                            * 1024 * 1024)
+                          type: string
+                      type: object
+                  type: object
+                chePostgresDb:
+                  description: Postgres database name that the Che server uses to
+                    connect to the DB. Defaults to `dbche`.
+                  type: string
+                chePostgresHostName:
+                  description: Postgres Database hostname that the Che server uses
+                    to connect to. Defaults to postgres. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresPassword:
+                  description: Postgres password that the Che server should use to
+                    connect to the DB. If omitted or left blank, it will be set to
+                    an auto-generated value.
+                  type: string
+                chePostgresPort:
+                  description: Postgres Database port that the Che server uses to
+                    connect to. Defaults to 5432. This value should be overridden
+                    ONLY when using an external database (see field `externalDb`).
+                    In the default case it will be automatically set by the operator.
+                  type: string
+                chePostgresSecret:
+                  description: 'The secret that contains Postgres `user` and `password`
+                    that the Che server should use to connect to the DB. If the secret
+                    is defined then `chePostgresUser` and `chePostgresPassword` are
+                    ignored. If the value is omitted or left blank then there are
+                    two scenarios: 1. `chePostgresUser` and `chePostgresPassword`
+                    are defined, then they will be used to connect to the DB. 2. `chePostgresUser`
+                    or `chePostgresPassword` are not defined, then a new secret with
+                    the name `che-postgres-secret` will be created with default value
+                    of `pgche` for `user` and with an auto-generated value for `password`.'
+                  type: string
+                chePostgresUser:
+                  description: Postgres user that the Che server should use to connect
+                    to the DB. Defaults to `pgche`.
+                  type: string
+                externalDb:
+                  description: 'Instructs the operator on whether or not to deploy
+                    a dedicated database. By default a dedicated Postgres database
+                    is deployed as part of the Che installation. But if `externalDb`
+                    is `true`, then no dedicated database will be deployed by the
+                    operator and you might need to provide connection details to the
+                    external DB you want to use. See also all the fields starting
+                    with: `chePostgres`.'
+                  type: boolean
+                postgresImage:
+                  description: Overrides the container image used in the Postgres
+                    database deployment. This includes the image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                postgresImagePullPolicy:
+                  description: Overrides the image pull policy used in the Postgres
+                    database deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+              type: object
+            imagePuller:
+              description: Kubernetes Image Puller configuration
+              properties:
+                enable:
+                  description: "Install and configure the Community Supported Kubernetes\
+                    \ Image Puller Operator. If true and no spec is provided, it will\
+                    \ create a default KubernetesImagePuller object to be managed\
+                    \ by the Operator. If false, the KubernetesImagePuller object\
+                    \ will be deleted, and the operator will be uninstalled, regardless\
+                    \ of whether or not a spec is provided. \n Please note that while\
+                    \ this operator and its behavior is community-supported, its payload\
+                    \ may be commercially-supported if you use it for pulling commercially-supported\
+                    \ images."
+                  type: boolean
+                spec:
+                  description: A KubernetesImagePullerSpec to configure the image
+                    puller in the CheCluster
+                  properties:
+                    cachingCPULimit:
+                      type: string
+                    cachingCPURequest:
+                      type: string
+                    cachingIntervalHours:
+                      type: string
+                    cachingMemoryLimit:
+                      type: string
+                    cachingMemoryRequest:
+                      type: string
+                    configMapName:
+                      type: string
+                    daemonsetName:
+                      type: string
+                    deploymentName:
+                      type: string
+                    images:
+                      type: string
+                    nodeSelector:
+                      type: string
+                  type: object
+              type: object
+            k8s:
+              description: Configuration settings specific to Che installations made
+                on upstream Kubernetes.
+              properties:
+                ingressClass:
+                  description: 'Ingress class that will define the which controler
+                    will manage ingresses. Defaults to `nginx`. NB: This drives the
+                    `is kubernetes.io/ingress.class` annotation on Che-related ingresses.'
+                  type: string
+                ingressDomain:
+                  description: 'Global ingress domain for a K8S cluster. This MUST
+                    be explicitly specified: there are no defaults.'
+                  type: string
+                ingressStrategy:
+                  description: Strategy for ingress creation. This can be `multi-host`
+                    (host is explicitly provided in ingress), `single-host` (host
+                    is provided, path-based rules) and `default-host.*`(no host is
+                    provided, path-based rules). Defaults to `"multi-host` Deprecated
+                    in favor of "serverExposureStrategy" in the "server" section,
+                    which defines this regardless of the cluster type. If both are
+                    defined, `serverExposureStrategy` takes precedence.
+                  type: string
+                securityContextFsGroup:
+                  description: FSGroup the Che pod and Workspace pods containers should
+                    run in. Defaults to `1724`.
+                  type: string
+                securityContextRunAsUser:
+                  description: ID of the user the Che pod and Workspace pods containers
+                    should run as. Default to `1724`.
+                  type: string
+                singleHostExposureType:
+                  description: When the serverExposureStrategy is set to "single-host",
+                    the way the server, registries and workspaces are exposed is further
+                    configured by this property. The possible values are "native"
+                    (which means that the server and workspaces are exposed using
+                    ingresses on K8s) or "gateway" where the server and workspaces
+                    are exposed using a custom gateway based on Traefik. All the endpoints
+                    whether backed by the ingress or gateway "route" always point
+                    to the subpaths on the same domain. Defaults to "native".
+                  type: string
+                tlsSecretName:
+                  description: Name of a secret that is used to set ingress TLS termination
+                    if TLS is enabled. If the specified secret does not exist, a self-signed
+                    certificate will be created. If the value is empty or omitted,
+                    the default ingress controller certificate will be used. See also
+                    the `tlsSupport` field. Note, when switching to the default ingress
+                    controller certificate, `self-signed-certificate` secret should
+                    be deleted manually.
+                  type: string
+              type: object
+            metrics:
+              description: Configuration settings related to the metrics collection
+                used by the Che installation.
+              properties:
+                enable:
+                  description: Enables `metrics` Che server endpoint. Default to `true`.
+                  type: boolean
+              type: object
+            server:
+              description: General configuration settings related to the Che server
+                and the plugin and devfile registries
+              properties:
+                airGapContainerRegistryHostname:
+                  description: Optional hostname (or url) to an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry hostname defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                airGapContainerRegistryOrganization:
+                  description: Optional repository name of an alternate container
+                    registry to pull images from. This value overrides the container
+                    registry organization defined in all the default container images
+                    involved in a Che deployment. This is particularly useful to install
+                    Che in an air-gapped environment.
+                  type: string
+                allowUserDefinedWorkspaceNamespaces:
+                  description: Defines if a user is able to specify Kubernetes namespace
+                    (or OpenShift project) different from the default. It's NOT RECOMMENDED
+                    to configured true without OAuth configured. This property is
+                    also used by the OpenShift infra.
+                  type: boolean
+                cheClusterRoles:
+                  description: Comma-separated list of ClusterRoles that will be assigned
+                    to che ServiceAccount. Be aware that che-operator has to already
+                    have all permissions in these ClusterRoles to be able to grant
+                    them.
+                  type: string
+                cheDebug:
+                  description: Enables the debug mode for Che server. Defaults to
+                    `false`.
+                  type: string
+                cheFlavor:
+                  description: Flavor of the installation. This is either `che` for
+                    upstream Che installations, or `codeready` for CodeReady Workspaces
+                    installation. In most cases the default value should not be overridden.
+                  type: string
+                cheHost:
+                  description: Public hostname of the installed Che server. If value
+                    is omitted then it will be automatically set by the operator.
+                    (see the `cheHostTLSSecret` field).
+                  type: string
+                cheHostTLSSecret:
+                  description: Name of a secret containing certificates to secure
+                    ingress/route for the custom hostname of the installed Che server.
+                    (see the `cheHost` field).
+                  type: string
+                cheImage:
+                  description: Overrides the container image used in Che deployment.
+                    This does NOT include the container image tag. Omit it or leave
+                    it empty to use the defaut container image provided by the operator.
+                  type: string
+                cheImagePullPolicy:
+                  description: Overrides the image pull policy used in Che deployment.
+                    Default value is `Always` for `nightly` or `latest` images, and
+                    `IfNotPresent` in other cases.
+                  type: string
+                cheImageTag:
+                  description: Overrides the tag of the container image used in Che
+                    deployment. Omit it or leave it empty to use the defaut image
+                    tag provided by the operator.
+                  type: string
+                cheLogLevel:
+                  description: 'Log level for the Che server: `INFO` or `DEBUG`. Defaults
+                    to `INFO`.'
+                  type: string
+                cheServerIngress:
+                  description: Che server ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheServerRoute:
+                  description: Che server route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                cheWorkspaceClusterRole:
+                  description: Custom cluster role bound to the user for the Che workspaces.
+                    The default roles are used if this is omitted or left blank.
+                  type: string
+                customCheProperties:
+                  additionalProperties:
+                    type: string
+                  description: Map of additional environment variables that will be
+                    applied in the generated `che` config map to be used by the Che
+                    server, in addition to the values already generated from other
+                    fields of the `CheCluster` custom resource (CR). If `customCheProperties`
+                    contains a property that would be normally generated in `che`
+                    config map from other CR fields, then the value defined in the
+                    `customCheProperties` will be used instead.
+                  type: object
+                devfileRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                devfileRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Devfile registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                devfileRegistryImage:
+                  description: Overrides the container image used in the Devfile registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the defaut container image provided by the operator.
+                  type: string
+                devfileRegistryIngress:
+                  description: Devfile registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Devfile registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                devfileRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Devfile registry
+                    deployment In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                devfileRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Devfile
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                devfileRegistryRoute:
+                  description: Devfile registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                devfileRegistryUrl:
+                  description: Public URL of the Devfile registry, that serves sample,
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalDevfileRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                externalDevfileRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Devfile registry server. By default a dedicated devfile
+                    registry server is started. But if `externalDevfileRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `devfileRegistryUrl` field
+                  type: boolean
+                externalPluginRegistry:
+                  description: Instructs the operator on whether or not to deploy
+                    a dedicated Plugin registry server. By default a dedicated plugin
+                    registry server is started. But if `externalPluginRegistry` is
+                    `true`, then no such dedicated server will be started by the operator
+                    and you will have to manually set the `pluginRegistryUrl` field.
+                  type: boolean
+                gitSelfSignedCert:
+                  description: If enabled, then the certificate from `che-git-self-signed-cert`
+                    config map will be propagated to the Che components and provide
+                    particular configuration for Git.
+                  type: boolean
+                nonProxyHosts:
+                  description: 'List of hosts that should not use the configured proxy.
+                    So specify wild card domain use the following form `.<DOMAIN>`
+                    and `|` as delimiter, eg: `localhost|.my.host.com|123.42.12.32`
+                    Only use when configuring a proxy is required. Operator respects
+                    OpenShift cluster wide proxy configuration and no additional configuration
+                    is required, but defining `nonProxyHosts` in a custom resource
+                    leads to merging non proxy hosts lists from the cluster proxy
+                    configuration and ones defined in the custom resources. (see the
+                    doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyURL` fields).'
+                  type: string
+                pluginRegistryCpuLimit:
+                  description: Overrides the cpu limit used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 500m.
+                  type: string
+                pluginRegistryCpuRequest:
+                  description: Overrides the cpu request used in the Plugin registry
+                    deployment. In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                pluginRegistryImage:
+                  description: Overrides the container image used in the Plugin registry
+                    deployment. This includes the image tag. Omit it or leave it empty
+                    to use the default container image provided by the operator.
+                  type: string
+                pluginRegistryIngress:
+                  description: Plugin registry ingress custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryMemoryLimit:
+                  description: Overrides the memory limit used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 256Mi.
+                  type: string
+                pluginRegistryMemoryRequest:
+                  description: Overrides the memory request used in the Plugin registry
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 32Mi.
+                  type: string
+                pluginRegistryPullPolicy:
+                  description: Overrides the image pull policy used in the Plugin
+                    registry deployment. Default value is `Always` for `nightly` or
+                    `latest` images, and `IfNotPresent` in other cases.
+                  type: string
+                pluginRegistryRoute:
+                  description: Plugin registry route custom settings
+                  properties:
+                    labels:
+                      description: Comma separated list of labels that can be used
+                        to organize and categorize (scope and select) objects.
+                      type: string
+                  type: object
+                pluginRegistryUrl:
+                  description: Public URL of the Plugin registry, that serves sample
+                    ready-to-use devfiles. You should set it ONLY if you use an external
+                    devfile registry (see the `externalPluginRegistry` field). By
+                    default this will be automatically calculated by the operator.
+                  type: string
+                proxyPassword:
+                  description: Password of the proxy server Only use when proxy configuration
+                    is required (see also the `proxyURL`, `proxyUser` and `proxySecret`
+                    fields).
+                  type: string
+                proxyPort:
+                  description: Port of the proxy server. Only use when configuring
+                    a proxy is required. (see also the `proxyURL` and `nonProxyHosts`
+                    fields).
+                  type: string
+                proxySecret:
+                  description: The secret that contains `user` and `password` for
+                    a proxy server. If the secret is defined then `proxyUser` and
+                    `proxyPassword` are ignored
+                  type: string
+                proxyURL:
+                  description: URL (protocol+hostname) of the proxy server. This drives
+                    the appropriate changes in the `JAVA_OPTS` and `https(s)_proxy`
+                    variables in the Che server and workspaces containers. Only use
+                    when configuring a proxy is required. Operator respects OpenShift
+                    cluster wide proxy configuration and no additional configuration
+                    is required, but defining `proxyUrl` in a custom resource leads
+                    to overrides the cluster proxy configuration with fields `proxyUrl`,
+                    `proxyPort`, `proxyUser` and `proxyPassword` from the custom resource.
+                    (see the doc https://docs.openshift.com/container-platform/4.4/networking/enable-cluster-wide-proxy.html)
+                    (see also the `proxyPort` and `nonProxyHosts` fields).
+                  type: string
+                proxyUser:
+                  description: User name of the proxy server. Only use when configuring
+                    a proxy is required (see also the `proxyURL`, `proxyPassword`
+                    and `proxySecret` fields).
+                  type: string
+                selfSignedCert:
+                  description: Deprecated. The value of this flag is ignored. Che
+                    operator will automatically detect if router certificate is self-signed.
+                    If so it will be propagated to Che server and some other components.
+                  type: boolean
+                serverCpuLimit:
+                  description: Overrides the cpu limit used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 1.
+                  type: string
+                serverCpuRequest:
+                  description: Overrides the cpu request used in the Che server deployment
+                    In cores. (500m = .5 cores). Default to 100m.
+                  type: string
+                serverExposureStrategy:
+                  description: Sets the server and workspaces exposure type. Possible
+                    values are "multi-host", "single-host", "default-host". Defaults
+                    to "multi-host" which creates a separate ingress (or route on
+                    OpenShift) for every required endpoint. "single-host" makes Che
+                    exposed on a single hostname with workspaces exposed on subpaths.
+                    Please read the docs to learn about the limitations of this approach.
+                    Also consult the `singleHostExposureType` property to further
+                    configure how the operator and Che server make that happen on
+                    Kubernetes. "default-host" exposes che server on the host of the
+                    cluster. Please read the docs to learn about the limitations of
+                    this approach.
+                  type: string
+                serverMemoryLimit:
+                  description: Overrides the memory limit used in the Che server deployment.
+                    In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024). Defaults
+                    to 1Gi.
+                  type: string
+                serverMemoryRequest:
+                  description: Overrides the memory request used in the Che server
+                    deployment. In bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024).
+                    Defaults to 512Mi.
+                  type: string
+                serverTrustStoreConfigMapName:
+                  description: Name of the config-map with public certificates to
+                    add to Java trust store of the Che server. This is usually required
+                    when adding the OpenShift OAuth provider which has https endpoint
+                    signed with self-signed cert. So, Che server must be aware of
+                    its CA cert to be able to request it. This is disabled by default.
+                  type: string
+                singleHostGatewayConfigMapLabels:
+                  additionalProperties:
+                    type: string
+                  description: The labels that need to be present (and are put) on
+                    the configmaps representing the gateway configuration.
+                  type: object
+                singleHostGatewayConfigSidecarImage:
+                  description: The image used for the gateway sidecar that provides
+                    configuration to the gateway. Omit it or leave it empty to use
+                    the defaut container image provided by the operator.
+                  type: string
+                singleHostGatewayImage:
+                  description: The image used for the gateway in the single host mode.
+                    Omit it or leave it empty to use the defaut container image provided
+                    by the operator.
+                  type: string
+                tlsSupport:
+                  description: Deprecated. Instructs the operator to deploy Che in
+                    TLS mode. This is enabled by default. Disabling TLS may cause
+                    malfunction of some Che components.
+                  type: boolean
+                useInternalClusterSVCNames:
+                  description: Use internal cluster svc names to communicate between
+                    components to speed up the traffic and avoid proxy issues. The
+                    default value is `true`.
+                  type: boolean
+                workspaceNamespaceDefault:
+                  description: 'Defines Kubernetes default namespace in which user''s
+                    workspaces are created if user does not override it. It''s possible
+                    to use <username>, <userid> and <workspaceid> placeholders (e.g.:
+                    che-workspace-<username>). In that case, new namespace will be
+                    created for each user (or workspace). Is used by OpenShift infra
+                    as well to specify Project'
+                  type: string
+              type: object
+            storage:
+              description: Configuration settings related to the persistent storage
+                used by the Che installation.
+              properties:
+                postgresPVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claim dedicated
+                    to the Postgres database. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+                preCreateSubPaths:
+                  description: Instructs the Che server to launch a special pod to
+                    pre-create a subpath in the Persistent Volumes. Defaults to `false`,
+                    however it might need to enable it according to the configuration
+                    of your K8S cluster.
+                  type: boolean
+                pvcClaimSize:
+                  description: Size of the persistent volume claim for workspaces.
+                    Defaults to `1Gi`
+                  type: string
+                pvcJobsImage:
+                  description: Overrides the container image used to create sub-paths
+                    in the Persistent Volumes. This includes the image tag. Omit it
+                    or leave it empty to use the defaut container image provided by
+                    the operator. See also the `preCreateSubPaths` field.
+                  type: string
+                pvcStrategy:
+                  description: Persistent volume claim strategy for the Che server.
+                    This Can be:`common` (all workspaces PVCs in one volume), `per-workspace`
+                    (one PVC per workspace for all declared volumes) and `unique`
+                    (one PVC per declared volume). Defaults to `common`.
+                  type: string
+                workspacePVCStorageClassName:
+                  description: Storage class for the Persistent Volume Claims dedicated
+                    to the Che workspaces. If omitted or left blank, default storage
+                    class is used.
+                  type: string
+              type: object
+          type: object
+        status:
+          description: CheClusterStatus defines the observed state of Che installation
+          properties:
+            cheClusterRunning:
+              description: Status of a Che installation. Can be `Available`, `Unavailable`,
+                or `Available, Rolling Update in Progress`
+              type: string
+            cheURL:
+              description: Public URL to the Che server
+              type: string
+            cheVersion:
+              description: Current installed Che version
+              type: string
+            dbProvisioned:
+              description: Indicates if or not a Postgres instance has been correctly
+                provisioned
+              type: boolean
+            devfileRegistryURL:
+              description: Public URL to the Devfile registry
+              type: string
+            gitHubOAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the GitHub OAuth.
+              type: boolean
+            helpLink:
+              description: A URL that can point to some URL where to find help related
+                to the current Operator status.
+              type: string
+            keycloakProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been provisioned with realm, client and user
+              type: boolean
+            keycloakURL:
+              description: Public URL to the Identity Provider server (Keycloak /
+                RH SSO).
+              type: string
+            message:
+              description: A human readable message indicating details about why the
+                pod is in this condition.
+              type: string
+            openShiftoAuthProvisioned:
+              description: Indicates whether an Identity Provider instance (Keycloak
+                / RH SSO) has been configured to integrate with the OpenShift OAuth.
+              type: boolean
+            pluginRegistryURL:
+              description: Public URL to the Plugin registry
+              type: string
+            reason:
+              description: A brief CamelCase message indicating details about why
+                the pod is in this state.
+              type: string
+          type: object
+      type: object
+  version: v1
+  versions:
+    - name: v1
+      served: true
+      storage: true

olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.2/eclipse-che-preview-openshift.v7.25.2.clusterserviceversion.yaml.diff

@@ -0,0 +1,548 @@
+--- /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.1/eclipse-che-preview-openshift.v7.25.1.clusterserviceversion.yaml	2021-02-05 12:12:12.334510145 +0000
++++ /home/runner/work/che-operator/che-operator/olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/7.25.2/eclipse-che-preview-openshift.v7.25.2.clusterserviceversion.yaml	2021-02-05 12:55:52.176100650 +0000
+@@ -74,14 +74,14 @@
+     capabilities: Seamless Upgrades
+     categories: Developer Tools, OpenShift Optional
+     certified: "false"
+-    containerImage: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+-    createdAt: "2021-01-29T08:27:32Z"
++    containerImage: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
++    createdAt: "2021-02-05T12:55:03Z"
+     description: A Kube-native development solution that delivers portable and collaborative
+       developer workspaces in OpenShift.
+     operatorframework.io/suggested-namespace: eclipse-che
+     repository: https://github.com/eclipse/che-operator
+     support: Eclipse Foundation
+-  name: eclipse-che-preview-openshift.v7.25.1
++  name: eclipse-che-preview-openshift.v7.25.2
+   namespace: placeholder
+ spec:
+   apiservicedefinitions: {}
+@@ -328,19 +328,19 @@
+                       - name: OPERATOR_NAME
+                         value: che-operator
+                       - name: CHE_VERSION
+-                        value: 7.25.1
++                        value: 7.25.2
+                       - name: RELATED_IMAGE_che_server
+-                        value: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++                        value: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
+                       - name: RELATED_IMAGE_plugin_registry
+-                        value: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++                        value: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
+                       - name: RELATED_IMAGE_devfile_registry
+-                        value: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
++                        value: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
+                       - name: RELATED_IMAGE_pvc_jobs
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_postgres
+                         value: quay.io/eclipse/che--centos--postgresql-96-centos7@sha256:b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+                       - name: RELATED_IMAGE_keycloak
+-                        value: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
++                        value: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_metadata
+                         value: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+                       - name: RELATED_IMAGE_che_workspace_plugin_broker_artifacts
+@@ -383,8 +383,8 @@
+                         value: quay.io/eclipse/che-buildah-base@sha256:417203d8629edd92f187afd3ebb3d8dc28338d34809eb75ffc2e08a400f8d56b
+                       - name: RELATED_IMAGE_che_buildkit_base_plugin_registry_image_GAXDOLRRFVRGCY3CGA3DS___
+                         value: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
++                      - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MFZWG2LJMRXWGLJVGMZTOZRYGA______
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_MJQXUZLMFVTDCNLDGVSDM___
+@@ -403,8 +403,6 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:55703ae5faebedee56fdce3879fa2281cc260488d8a488ff77ed3d40f778ddf7
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_M5XS2YZZGM4WEYJU
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:8615a29435b0256bffaf85ab2cf9327b059f14eaa6614346dfd51e3a6dd9f041
+-                      - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NBQXG23FNRWC2YRWGQYDGOLG
+-                        value: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NJQXMYJNMI4GMMBVGI4A____
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:70836fd2fc01198c1a31f44d0af9cdf2d7445035be54f0bc7ae2cbfe262e0231
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_NJQXMYJYFVRDQZRQGUZDQ___
+@@ -421,8 +419,6 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:491c62a3ac775d5426d72a59ac18bdd50f5f5d61d07fbfb34e0cd7fed3d4da21
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OB4XI2DPNYWTEZTDMYZTIMI_
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:64311210e710ca1614839f897285fc1d39b2ca17215d56c165d091aafd19a14b
+-                      - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OJ2WE6JNMI3DIMBTHFTA____
+-                        value: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_OJ2XG5BNGUZGMOLFHFQQ____
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+                       - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_ONRWC3DBFUYWEZJWHA3TO___
+@@ -437,53 +433,53 @@
+                         value: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+                       - name: RELATED_IMAGE_che_sidecar_workspace_data_sync_plugin_registry_image_GAXDALRR
+                         value: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++                      - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++                      - name: RELATED_IMAGE_che_theia_plugin_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
+                       - name: RELATED_IMAGE_mta_vscode_extension_plugin_registry_image_NRQXIZLTOQ______
+                         value: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+                       - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWCOJRGVSGEN3CMVRWCOBXGE4TQZTDMQ3TQNRQGA4DMOJYHFTGKODBGMZDOYJRME2GMNRVGA4DAMRVMI3DIYLCGI4GMY3DG42DEM3CGI______
+                         value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:a915db7beca87198fcd7860086989fe8a327a1a4f6508025b64ab28fcc7423b2
+                       - name: RELATED_IMAGE_che__centos__mysql_57_centos7_devfile_registry_image_NRQXIZLTOQWWKMBYMVSTIZBUGNRDOMZVGY3DANZWHA2WENRZMJSGKNRTGM2WKMRXMNTDEMDDGAZDAZRTGQ2WENTDGZRTKOJUGAYDCOBTHA4DENZWGQ______
+                         value: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGE______
+-                        value: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
++                      - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++                      - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++                      - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++                      - name: RELATED_IMAGE_che_golang_1_14_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++                      - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++                      - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++                      - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++                      - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++                      - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++                      - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++                      - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++                      - name: RELATED_IMAGE_che_php_7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++                      - name: RELATED_IMAGE_che_python_3_7_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++                      - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++                      - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++                      - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_G4XDENJOGI______
++                        value: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
+                       - name: RELATED_IMAGE_ubi8_minimal_devfile_registry_image_HAXDG___
+                         value: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+                       - name: RELATED_IMAGE_ubi_minimal_devfile_registry_image_
+                         value: registry.access.redhat.com/ubi8/ubi-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+-                    image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
++                    image: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
+                     imagePullPolicy: IfNotPresent
+                     livenessProbe:
+                       failureThreshold: 10
+@@ -657,12 +653,12 @@
+   maturity: stable
+   provider:
+     name: Eclipse Foundation
+-  replaces: eclipse-che-preview-openshift.v7.25.0
+-  version: 7.25.1
++  replaces: eclipse-che-preview-openshift.v7.25.1
++  version: 7.25.2
+   relatedImages:
+-    - name: che-operator-7.25.1
+-      image: quay.io/eclipse/che-operator@sha256:dbf5e81187901f9f78a5e55e11439578d6a5ecf3e2b4896741a55a9d2256e0c0
+-      # tag: quay.io/eclipse/che-operator:7.25.1
++    - name: che-operator-7.25.2
++      image: quay.io/eclipse/che-operator@sha256:eaaf23aef2d721be21f03ee2863e868de51f5c5d9899ca09e34909dcdf0e8bdd
++      # tag: quay.io/eclipse/che-operator:7.25.2
+     - name: code-server-@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+       image: docker.io/codercom/code-server@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+       # tag: docker.io/codercom/code-server@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+@@ -708,63 +704,63 @@
+     - name: che-buildkit-base-@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+-    - name: che-cpp-rhel7-@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-      # tag: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-    - name: che-devfile-registry-7.25.1
+-      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+-      # tag: quay.io/eclipse/che-devfile-registry:7.25.1
+-    - name: che-devfile-registry-@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+-      image: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+-      # tag: quay.io/eclipse/che-devfile-registry@sha256:26e3403cd8a86cefe91870376733062d54ddf0a9640ffefd8004296bfd73e104
+-    - name: che-dotnet-2.2-@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-      # tag: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-    - name: che-dotnet-3.1-@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-      # tag: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-    - name: che-golang-1.14-@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-      # tag: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-    - name: che-java11-gradle-@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-      # tag: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-    - name: che-java11-maven-@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-      # tag: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-    - name: che-java8-maven-@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-      # tag: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
++    - name: che-cpp-rhel7-@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++      # tag: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++    - name: che-devfile-registry-7.25.2
++      image: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
++      # tag: quay.io/eclipse/che-devfile-registry:7.25.2
++    - name: che-devfile-registry-@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
++      image: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
++      # tag: quay.io/eclipse/che-devfile-registry@sha256:d0e873f2ceb1ba2affa10f98b1968862f82ed695045ba01a3f502bd5a8476343
++    - name: che-dotnet-2.2-@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++      # tag: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++    - name: che-dotnet-3.1-@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++      # tag: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++    - name: che-golang-1.14-@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++      image: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++      # tag: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++    - name: che-java11-gradle-@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++      image: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++      # tag: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++    - name: che-java11-maven-@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++      image: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++      # tag: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++    - name: che-java8-maven-@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++      image: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++      # tag: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
+     - name: che-jwtproxy-0.10.0
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy:0.10.0
+     - name: che-jwtproxy-@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       image: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+       # tag: quay.io/eclipse/che-jwtproxy@sha256:881d1c91e7f5840314f25104ef5c0acee59ed484a5f9ef39daf3008725ea1033
+-    - name: che-keycloak-7.25.1
+-      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+-      # tag: quay.io/eclipse/che-keycloak:7.25.1
+-    - name: che-keycloak-@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+-      image: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+-      # tag: quay.io/eclipse/che-keycloak@sha256:846350743fc027b277aa70624162a4566987c3520c17c6b192d57745002aee82
+-    - name: che-machine-exec-@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+-      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+-      # tag: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+-    - name: che-nodejs10-community-@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-      # tag: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-    - name: che-nodejs10-ubi-@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-      # tag: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-    - name: che-nodejs12-community-@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-      # tag: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-    - name: che-nodejs8-centos-@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-      # tag: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-    - name: che-php-7-@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-      # tag: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
++    - name: che-keycloak-7.25.2
++      image: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
++      # tag: quay.io/eclipse/che-keycloak:7.25.2
++    - name: che-keycloak-@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
++      image: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
++      # tag: quay.io/eclipse/che-keycloak@sha256:136d6a88383466465517b24ca7e99213f7481a99054d4a22a0a8894e4e2a808a
++    - name: che-machine-exec-@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
++      image: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
++      # tag: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
++    - name: che-nodejs10-community-@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++      image: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++      # tag: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++    - name: che-nodejs10-ubi-@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++      # tag: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++    - name: che-nodejs12-community-@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++      image: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++      # tag: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++    - name: che-nodejs8-centos-@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++      # tag: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++    - name: che-php-7-@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++      image: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++      # tag: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
+     - name: che-plugin-artifacts-broker-v3.4.0
+       image: quay.io/eclipse/che-plugin-artifacts-broker@sha256:4891a6e19be9eae59372f4b31144653f9bd1284e0301ecfe896a099ca6a12b58
+       # tag: quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0
+@@ -777,12 +773,12 @@
+     - name: che-plugin-metadata-broker-@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       image: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+       # tag: quay.io/eclipse/che-plugin-metadata-broker@sha256:df1ea2eadb28dbc97761adf4ea984af5ca941025a67b39c6abe373816a84bba9
+-    - name: che-plugin-registry-7.25.1
+-      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+-      # tag: quay.io/eclipse/che-plugin-registry:7.25.1
+-    - name: che-plugin-registry-@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+-      image: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
+-      # tag: quay.io/eclipse/che-plugin-registry@sha256:2578d451270f27b34f190aa27a1493f72201dfd7837a77ec93519e68f31321d3
++    - name: che-plugin-registry-7.25.2
++      image: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
++      # tag: quay.io/eclipse/che-plugin-registry:7.25.2
++    - name: che-plugin-registry-@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
++      image: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
++      # tag: quay.io/eclipse/che-plugin-registry@sha256:96941f7c013202e078b65af27d54da09227a96d2a03dfc4a8497cc135d9c5bad
+     - name: che-plugin-sidecar-@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:08025eadc2594140e77d5dbec5d65af8ec8512e5266936745924d55dd467482a
+@@ -840,51 +836,45 @@
+     - name: che-plugin-sidecar-@sha256:ae5124e3198ac6977ca973aaf4885a14e800d647c96a23d15a2b6babbe8fef2a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:ae5124e3198ac6977ca973aaf4885a14e800d647c96a23d15a2b6babbe8fef2a
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:ae5124e3198ac6977ca973aaf4885a14e800d647c96a23d15a2b6babbe8fef2a
+-    - name: che-plugin-sidecar-@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+-      # tag: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+     - name: che-plugin-sidecar-@sha256:db86c92418b9f40b2654b8fc473073569e0dc8a01d7adc31c9925e5469d2b114
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:db86c92418b9f40b2654b8fc473073569e0dc8a01d7adc31c9925e5469d2b114
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:db86c92418b9f40b2654b8fc473073569e0dc8a01d7adc31c9925e5469d2b114
+     - name: che-plugin-sidecar-@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+-    - name: che-plugin-sidecar-@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+-      # tag: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+     - name: che-plugin-sidecar-@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:f25f9b8eef7e2a7aea3e842ee13626935b98f96327f5c56b6bbf48b49754c45d
+     - name: che-plugin-sidecar-@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+       # tag: quay.io/eclipse/che-plugin-sidecar@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+-    - name: che-python-3.7-@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-      # tag: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-    - name: che-python-3.8-@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-      # tag: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-    - name: che-quarkus-@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-      # tag: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-    - name: che-rust-1.39-@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+-      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+-      # tag: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+-    - name: che-server-7.25.1
+-      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+-      # tag: quay.io/eclipse/che-server:7.25.1
+-    - name: che-server-@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+-      image: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
+-      # tag: quay.io/eclipse/che-server@sha256:3ab3664f942f68ac148df4dfaa4e3817bda6bcddcaa79441c1aadf6c1b1371ce
++    - name: che-python-3.7-@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++      image: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++      # tag: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++    - name: che-python-3.8-@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++      image: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++      # tag: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++    - name: che-quarkus-@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++      image: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++      # tag: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++    - name: che-rust-1.39-@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
++      image: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
++      # tag: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
++    - name: che-server-7.25.2
++      image: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
++      # tag: quay.io/eclipse/che-server:7.25.2
++    - name: che-server-@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
++      image: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
++      # tag: quay.io/eclipse/che-server@sha256:5ad78983b667e2e6752aa29b3a9500eca480723f497e9bb753461c8c6a2fa441
+     - name: che-sidecar-workspace-data-sync-@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+-    - name: che-theia-endpoint-runtime-binary-@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-    - name: che-theia-@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+-      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+-      # tag: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
++    - name: che-theia-endpoint-runtime-binary-@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++    - name: che-theia-@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
++      image: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
++      # tag: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
+     - name: che-tls-secret-creator-@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       image: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+       # tag: quay.io/eclipse/che-tls-secret-creator@sha256:6f0433641e60851454e2dbbc559daf0b8e5f398e8947ca05286b4d1f9916e3e5
+@@ -921,9 +911,9 @@
+     - name: che-buildkit-base-0.7.1-bacb069
+       image: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+       # tag: quay.io/eclipse/che-buildkit-base:0.7.1-bacb069
+-    - name: che-machine-exec-7.25.1
+-      image: quay.io/eclipse/che-machine-exec@sha256:ad6ed4044651639ce47350d11c3cefad408944f137c0e9aed79857a1d83c068a
+-      # tag: quay.io/eclipse/che-machine-exec:7.25.1
++    - name: che-machine-exec-7.25.2
++      image: quay.io/eclipse/che-machine-exec@sha256:90a6f2065410b35a7e32dbdca6913406cf38b41c005004c99f3bd7f635116632
++      # tag: quay.io/eclipse/che-machine-exec:7.25.2
+     - name: che-plugin-sidecar-asciidoc-5337f80
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:3a5f128b217625c211f69fd2277300ae611fcf7da287c2786e522f13a81ed701
+       # tag: quay.io/eclipse/che-plugin-sidecar:asciidoc-5337f80
+@@ -951,9 +941,6 @@
+     - name: che-plugin-sidecar-go-c939ba4
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:8615a29435b0256bffaf85ab2cf9327b059f14eaa6614346dfd51e3a6dd9f041
+       # tag: quay.io/eclipse/che-plugin-sidecar:go-c939ba4
+-    - name: che-plugin-sidecar-haskell-b64039f
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:d2cb8859dcbc8f6a6732006a36d09061554a6e9baad2ad4b1f480c111853ca10
+-      # tag: quay.io/eclipse/che-plugin-sidecar:haskell-b64039f
+     - name: che-plugin-sidecar-java-b8f0528
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:70836fd2fc01198c1a31f44d0af9cdf2d7445035be54f0bc7ae2cbfe262e0231
+       # tag: quay.io/eclipse/che-plugin-sidecar:java-b8f0528
+@@ -978,9 +965,6 @@
+     - name: che-plugin-sidecar-python-2fcf341
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:64311210e710ca1614839f897285fc1d39b2ca17215d56c165d091aafd19a14b
+       # tag: quay.io/eclipse/che-plugin-sidecar:python-2fcf341
+-    - name: che-plugin-sidecar-ruby-b64039f
+-      image: quay.io/eclipse/che-plugin-sidecar@sha256:f13c14336366d0a497ef440c478bf0763e96c6e39ee4f569f9fc412b0dec3ced
+-      # tag: quay.io/eclipse/che-plugin-sidecar:ruby-b64039f
+     - name: che-plugin-sidecar-rust-52f9e9a
+       image: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+       # tag: quay.io/eclipse/che-plugin-sidecar:rust-52f9e9a
+@@ -1002,12 +986,12 @@
+     - name: che-sidecar-workspace-data-sync-0.0.1
+       image: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+       # tag: quay.io/eclipse/che-sidecar-workspace-data-sync:0.0.1
+-    - name: che-theia-endpoint-runtime-binary-7.25.1
+-      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:4a063336fb4bfb323c4533cd71fc2d08be063a089f201e050ad82554d673c914
+-      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.1
+-    - name: che-theia-7.25.1
+-      image: quay.io/eclipse/che-theia@sha256:116e3b195ef94ef1394a0303d85e8c260040a024fa9ff20bf046a6f30aa2043f
+-      # tag: quay.io/eclipse/che-theia:7.25.1
++    - name: che-theia-endpoint-runtime-binary-7.25.2
++      image: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:c3b136d8dda3120b30a80bccedb4d7f5030325e40a946a3da9dba33656bc7650
++      # tag: quay.io/eclipse/che-theia-endpoint-runtime-binary:7.25.2
++    - name: che-theia-7.25.2
++      image: quay.io/eclipse/che-theia@sha256:dd70ca1baa69b2c18520aaf2581b7e83028fb8444f617b3136c9df9a1bb481b0
++      # tag: quay.io/eclipse/che-theia:7.25.2
+     - name: mta-vscode-extension-latest
+       image: quay.io/windupeng/mta-vscode-extension@sha256:d362a2bded79134506a23f9a77498f5a7297df6cc9a3391447da8e1ba74eb6a5
+       # tag: quay.io/windupeng/mta-vscode-extension:latest
+@@ -1017,54 +1001,54 @@
+     - name: che--centos--mysql-57-centos7-latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       image: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+       # tag: quay.io/eclipse/che--centos--mysql-57-centos7:latest-e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+-    - name: che-cpp-rhel7-7.25.1
+-      image: quay.io/eclipse/che-cpp-rhel7@sha256:14ae97821096a4586854df6984269ab20975a4b2e47fb6c8e60325dad403015c
+-      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.1
+-    - name: che-dotnet-2.2-7.25.1
+-      image: quay.io/eclipse/che-dotnet-2.2@sha256:fe17864240810045474b181fd793b79e8fb53603b825f7bc635f23962f4318ba
+-      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.1
+-    - name: che-dotnet-3.1-7.25.1
+-      image: quay.io/eclipse/che-dotnet-3.1@sha256:7817f03b4c13871ef93e3f44f02c840246682e12a4f31effdf7b9786cfd47699
+-      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.1
+-    - name: che-golang-1.14-7.25.1
+-      image: quay.io/eclipse/che-golang-1.14@sha256:cfd5f667ee273bfddeb3ec3bce5c54022a01cf4cfa8cb4654494cedbb49e86d8
+-      # tag: quay.io/eclipse/che-golang-1.14:7.25.1
+-    - name: che-java11-gradle-7.25.1
+-      image: quay.io/eclipse/che-java11-gradle@sha256:1fcbd983f34fb024ba6da9ac31a65cee1b20472802037c9d518f0f6d31d71085
+-      # tag: quay.io/eclipse/che-java11-gradle:7.25.1
+-    - name: che-java11-maven-7.25.1
+-      image: quay.io/eclipse/che-java11-maven@sha256:dffe6149ac5d3b160e14ce3e7bff915f6069b2803590d3ed075d0b18c84a0941
+-      # tag: quay.io/eclipse/che-java11-maven:7.25.1
+-    - name: che-java8-maven-7.25.1
+-      image: quay.io/eclipse/che-java8-maven@sha256:26c211ed1e6445948449d554a837bf64fde11b4a6cca436aec9bc0b0fb5b7cd8
+-      # tag: quay.io/eclipse/che-java8-maven:7.25.1
+-    - name: che-nodejs10-community-7.25.1
+-      image: quay.io/eclipse/che-nodejs10-community@sha256:0902e7227c0da3cb254aa7c8db37582d93a3680cd16d91aa386181573f0ae1ac
+-      # tag: quay.io/eclipse/che-nodejs10-community:7.25.1
+-    - name: che-nodejs10-ubi-7.25.1
+-      image: quay.io/eclipse/che-nodejs10-ubi@sha256:fdb8864bf47ed8cbeb15cfc7f86f9c4f67c8f1cdb64311f0dbae7eff4a25c7ee
+-      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.1
+-    - name: che-nodejs12-community-7.25.1
+-      image: quay.io/eclipse/che-nodejs12-community@sha256:87b708d00ea737c0321ba7966982ce2dc2883704fe92defe96bcf2a65b96c2ea
+-      # tag: quay.io/eclipse/che-nodejs12-community:7.25.1
+-    - name: che-nodejs8-centos-7.25.1
+-      image: quay.io/eclipse/che-nodejs8-centos@sha256:74f68461213c708850d3323133ba86da11f02d4bf72f55a669532d4bd5f95f05
+-      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.1
+-    - name: che-php-7-7.25.1
+-      image: quay.io/eclipse/che-php-7@sha256:32735d669e9d3e90192e20ed6a83a6414b8861983857010ed2f7f03ab6eee353
+-      # tag: quay.io/eclipse/che-php-7:7.25.1
+-    - name: che-python-3.7-7.25.1
+-      image: quay.io/eclipse/che-python-3.7@sha256:03a94ad565397b90c6ecb30f4eaa906fb0aea84578c864c36ba13ebdd4531516
+-      # tag: quay.io/eclipse/che-python-3.7:7.25.1
+-    - name: che-python-3.8-7.25.1
+-      image: quay.io/eclipse/che-python-3.8@sha256:88534c569717fe25f4a86d6929003523cb096ca79a718925c61cb84e08d7dace
+-      # tag: quay.io/eclipse/che-python-3.8:7.25.1
+-    - name: che-quarkus-7.25.1
+-      image: quay.io/eclipse/che-quarkus@sha256:2a49fa6c706235277730ea8b67b3531c5e1a6a09d9e044cafb8f2c6b7bbbd580
+-      # tag: quay.io/eclipse/che-quarkus:7.25.1
+-    - name: che-rust-1.39-7.25.1
+-      image: quay.io/eclipse/che-rust-1.39@sha256:b19cbb7fe9794a7a705dbc11be89020dc086ee0ab9774b0d7e689b2ae4181a5b
+-      # tag: quay.io/eclipse/che-rust-1.39:7.25.1
++    - name: che-cpp-rhel7-7.25.2
++      image: quay.io/eclipse/che-cpp-rhel7@sha256:a69a78586a52def2f030cf1648d7a77e4dbdd67228ff6a8bcb11ccbdc2180bbc
++      # tag: quay.io/eclipse/che-cpp-rhel7:7.25.2
++    - name: che-dotnet-2.2-7.25.2
++      image: quay.io/eclipse/che-dotnet-2.2@sha256:6d28148fbffa76ecbd7085a75d1f1ff4fba1f31df1dfbf2ba8ad0bbb3349520d
++      # tag: quay.io/eclipse/che-dotnet-2.2:7.25.2
++    - name: che-dotnet-3.1-7.25.2
++      image: quay.io/eclipse/che-dotnet-3.1@sha256:139588b061d051dad52a71c7f7e779da2d22d1fb6c3332ba30bee4307c4c3e2c
++      # tag: quay.io/eclipse/che-dotnet-3.1:7.25.2
++    - name: che-golang-1.14-7.25.2
++      image: quay.io/eclipse/che-golang-1.14@sha256:b41a561cfcd2b5fd62a80d600f7b547c9f155b010627e47eccde962ac4253794
++      # tag: quay.io/eclipse/che-golang-1.14:7.25.2
++    - name: che-java11-gradle-7.25.2
++      image: quay.io/eclipse/che-java11-gradle@sha256:433546307e6b9cc4fa5c0eb54dd04a550e9c22f200503cd0caa0f51cfd28689f
++      # tag: quay.io/eclipse/che-java11-gradle:7.25.2
++    - name: che-java11-maven-7.25.2
++      image: quay.io/eclipse/che-java11-maven@sha256:dc3366db4a740606ba6ce5208f642ad0f8993ef38cfcc3c1215d3ea9e279ca2a
++      # tag: quay.io/eclipse/che-java11-maven:7.25.2
++    - name: che-java8-maven-7.25.2
++      image: quay.io/eclipse/che-java8-maven@sha256:f5784e53a598bf73f380a9873a571d686c817c57a2b09ad9e1581651a656b0d7
++      # tag: quay.io/eclipse/che-java8-maven:7.25.2
++    - name: che-nodejs10-community-7.25.2
++      image: quay.io/eclipse/che-nodejs10-community@sha256:3ae6654f3855c20c4083e6462527fb7af5bfc50f55d8f95877fe50cd9c35d29a
++      # tag: quay.io/eclipse/che-nodejs10-community:7.25.2
++    - name: che-nodejs10-ubi-7.25.2
++      image: quay.io/eclipse/che-nodejs10-ubi@sha256:67ed65f29c6ffc44c7fc401c4d9e7b5266ba9301173923e0083e0b468812b91f
++      # tag: quay.io/eclipse/che-nodejs10-ubi:7.25.2
++    - name: che-nodejs12-community-7.25.2
++      image: quay.io/eclipse/che-nodejs12-community@sha256:e0a180f53041b2f2b0e432082351a301dc6eb1c02ff96cc946a342c4e1edf53e
++      # tag: quay.io/eclipse/che-nodejs12-community:7.25.2
++    - name: che-nodejs8-centos-7.25.2
++      image: quay.io/eclipse/che-nodejs8-centos@sha256:8d5e3b93bb5fcdb47149038bed53ceee9f3cf9063b8ee6dba76ab8d93d8d95c0
++      # tag: quay.io/eclipse/che-nodejs8-centos:7.25.2
++    - name: che-php-7-7.25.2
++      image: quay.io/eclipse/che-php-7@sha256:1701391313dfbcafca5946586b9a4915faa2bdf6c32b1837a8021524bdfc9029
++      # tag: quay.io/eclipse/che-php-7:7.25.2
++    - name: che-python-3.7-7.25.2
++      image: quay.io/eclipse/che-python-3.7@sha256:d971f85f68b004a3245d3b75361cceddf4dae6055168d3d177b0cd7e04ad04a3
++      # tag: quay.io/eclipse/che-python-3.7:7.25.2
++    - name: che-python-3.8-7.25.2
++      image: quay.io/eclipse/che-python-3.8@sha256:9192bdb4c7e660b71f7ab30d8782b5bc0ef7319bac25d53574be39664c735eb4
++      # tag: quay.io/eclipse/che-python-3.8:7.25.2
++    - name: che-quarkus-7.25.2
++      image: quay.io/eclipse/che-quarkus@sha256:09f6332964ad28d0b70eb1b0126f8b8635a3faa498eb90cd4909f929de5e1e24
++      # tag: quay.io/eclipse/che-quarkus:7.25.2
++    - name: che-rust-1.39-7.25.2
++      image: quay.io/eclipse/che-rust-1.39@sha256:04ae0e0fbf3eab860159d7c601ae2f5f037bc12f6e48e96d97b0d683525aaed6
++      # tag: quay.io/eclipse/che-rust-1.39:7.25.2
+     - name: ubi8-minimal-8.3
+       image: registry.access.redhat.com/ubi8-minimal@sha256:4b9899b5c2906aae8e8fcd1012a5949e98bda68192c5e7bf6c1e171686c97d7a
+       # tag: registry.access.redhat.com/ubi8-minimal:8.3

olm/eclipse-che-preview-openshift/deploy/olm-catalog/eclipse-che-preview-openshift/eclipse-che-preview-openshift.package.yaml

@@ -1,5 +1,5 @@
 channels:
-- currentCSV: eclipse-che-preview-openshift.v7.25.0
+- currentCSV: eclipse-che-preview-openshift.v7.25.2
   name: stable
 defaultChannel: stable
 packageName: eclipse-che-preview-openshift

pkg/controller/che/che_controller.go

@@ -77,11 +77,12 @@ func newReconciler(mgr manager.Manager) (reconcile.Reconciler, error) {
 		return nil, err
 	}
 	return &ReconcileChe{
-		client:          mgr.GetClient(),
-		nonCachedClient: noncachedClient,
-		scheme:          mgr.GetScheme(),
-		discoveryClient: discoveryClient,
-		userHandler:     NewOpenShiftOAuthUserHandler(noncachedClient),
+		client:            mgr.GetClient(),
+		nonCachedClient:   noncachedClient,
+		scheme:            mgr.GetScheme(),
+		discoveryClient:   discoveryClient,
+		userHandler:       NewOpenShiftOAuthUserHandler(noncachedClient),
+		permissionChecker: &K8sApiPermissionChecker{},
 	}, nil
 }
 
@@ -260,8 +261,15 @@ func add(mgr manager.Manager, r reconcile.Reconciler) error {
 	return nil
 }
 
-var _ reconcile.Reconciler = &ReconcileChe{}
-var oAuthFinalizerName = "oauthclients.finalizers.che.eclipse.org"
+var (
+	_ reconcile.Reconciler = &ReconcileChe{}
+
+	oAuthFinalizerName                           = "oauthclients.finalizers.che.eclipse.org"
+	cheWorkspacesClusterPermissionsFinalizerName = "cheWorkspaces.clusterpermissions.finalizers.che.eclipse.org"
+
+	// CheServiceAccountName - service account name for che-server.
+	CheServiceAccountName = "che"
+)
 
 // ReconcileChe reconciles a CheCluster object
 type ReconcileChe struct {
@@ -279,6 +287,7 @@ type ReconcileChe struct {
 	scheme          *runtime.Scheme
 	tests           bool
 	userHandler     OpenShiftOAuthUserHandler
+	permissionChecker PermissionChecker
 }
 
 const (
@@ -336,6 +345,9 @@ func (r *ReconcileChe) Reconcile(request reconcile.Request) (reconcile.Result, e
 			return reconcile.Result{}, err
 		}
 	}
+	if r.reconcileWorkspacePermissionsFinalizer(instance, deployContext); err != nil {
+		return reconcile.Result{}, err
+	}
 
 	// Reconcile the imagePuller section of the CheCluster
 	imagePullerResult, err := deploy.ReconcileImagePuller(deployContext)
@@ -553,10 +565,10 @@ func (r *ReconcileChe) Reconcile(request reconcile.Request) (reconcile.Result, e
 		return reconcile.Result{}, err
 	}
 
-	// create service accounts:
-	// che is the one which token is used to create workspace objects
-	// che-workspace is SA used by plugins like exec and terminal with limited privileges
-	cheSA, err := deploy.SyncServiceAccountToCluster(deployContext, "che")
+	// Create service account "che" for che-server component.
+	// "che" is the one which token is used to create workspace objects.
+	// Notice: Also we have on more "che-workspace" SA used by plugins like exec, terminal, metrics with limited privileges.
+	cheSA, err := deploy.SyncServiceAccountToCluster(deployContext, CheServiceAccountName)
 	if cheSA == nil {
 		logrus.Info("Waiting on service account 'che' to be created")
 		if err != nil {
@@ -567,49 +579,50 @@ func (r *ReconcileChe) Reconcile(request reconcile.Request) (reconcile.Result, e
 		}
 	}
 
-	cheWorkspaceSA, err := deploy.SyncServiceAccountToCluster(deployContext, "che-workspace")
-	if cheWorkspaceSA == nil {
-		logrus.Info("Waiting on service account 'che-workspace' to be created")
+	if !util.IsOAuthEnabled(instance) && !util.IsWorkspaceInSameNamespaceWithChe(instance) {
+		clusterRole, err := deploy.GetClusterRole(CheWorkspacesClusterRoleNameTemplate, deployContext.ClusterAPI.Client)
 		if err != nil {
 			logrus.Error(err)
-		}
-		if !tests {
 			return reconcile.Result{RequeueAfter: time.Second}, err
 		}
+		if clusterRole == nil {
+			policies := append(getCheWorkspacesNamespacePolicy(), getCheWorkspacesPolicy()...)
+			deniedRules, err := r.permissionChecker.GetNotPermittedPolicyRules(policies, "")
+			if err != nil {
+				logrus.Error(err)
+				return reconcile.Result{RequeueAfter: time.Second}, err
+			}
+			// fall back to the "narrower" workspace namespace strategy
+			if len(deniedRules) > 0 {
+				logrus.Warnf("Not enough permissions to start a workspace in dedicated namespace. Denied policies: %v", deniedRules)
+				logrus.Warnf("Fall back to '%s' namespace for workspaces.", instance.Namespace)
+				delete(instance.Spec.Server.CustomCheProperties, "CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT")
+				instance.Spec.Server.WorkspaceNamespaceDefault = instance.Namespace
+				r.UpdateCheCRSpec(instance, "Default namespace for workspaces", instance.Namespace);
+				if err != nil {
+					logrus.Error(err)
+					return reconcile.Result{RequeueAfter: time.Second * 1}, err
+				}
+			} else {
+				reconcileResult, err := r.delegateWorkspacePermissionsInTheDifferNamespaceThanChe(instance, deployContext)
+				if err != nil {
+					logrus.Error(err)
+					return reconcile.Result{RequeueAfter: time.Second}, err
+				}
+				if reconcileResult.Requeue {
+					return reconcileResult, err
+				}
+			}
+		}
 	}
 
-	// create exec role for CheCluster server and workspaces
-	execRole, err := deploy.SyncExecRoleToCluster(deployContext)
-	if execRole == nil {
-		logrus.Info("Waiting on role 'exec' to be created")
+	if util.IsOAuthEnabled(instance) || util.IsWorkspaceInSameNamespaceWithChe(instance) {
+		reconcile, err := r.delegateWorkspacePermissionsInTheSameNamespaceWithChe(deployContext)
 		if err != nil {
 			logrus.Error(err)
 		}
-		if !tests {
-			return reconcile.Result{RequeueAfter: time.Second}, err
-		}
-	}
-
-	// create view role for CheCluster server and workspaces
-	viewRole, err := deploy.SyncViewRoleToCluster(deployContext)
-	if viewRole == nil {
-		logrus.Info("Waiting on role 'view' to be created")
-		if err != nil {
-			logrus.Error(err)
-		}
-		if !tests {
-			return reconcile.Result{RequeueAfter: time.Second}, err
-		}
-	}
-
-	cheRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, "che", "che", "edit", "ClusterRole")
-	if cheRoleBinding == nil {
-		logrus.Info("Waiting on role binding 'che' to be created")
-		if err != nil {
-			logrus.Error(err)
-		}
-		if !tests {
-			return reconcile.Result{RequeueAfter: time.Second}, err
+		if reconcile.Requeue && !tests {
+			return reconcile, err
 		}
 	}
 
@@ -631,28 +644,6 @@ func (r *ReconcileChe) Reconcile(request reconcile.Request) (reconcile.Result, e
 		}
 	}
 
-	cheWSExecRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, "che-workspace-exec", "che-workspace", "exec", "Role")
-	if cheWSExecRoleBinding == nil {
-		logrus.Info("Waiting on role binding 'che-workspace-exec' to be created")
-		if err != nil {
-			logrus.Error(err)
-		}
-		if !tests {
-			return reconcile.Result{RequeueAfter: time.Second}, err
-		}
-	}
-
-	cheWSViewRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, "che-workspace-view", "che-workspace", "view", "Role")
-	if cheWSViewRoleBinding == nil {
-		logrus.Info("Waiting on role binding 'che-workspace-view' to be created")
-		if err != nil {
-			logrus.Error(err)
-		}
-		if !tests {
-			return reconcile.Result{RequeueAfter: time.Second}, err
-		}
-	}
-
 	// If the user specified an additional cluster role to use for the Che workspace, create a role binding for it
 	// Use a role binding instead of a cluster role binding to keep the additional access scoped to the workspace's namespace
 	workspaceClusterRole := instance.Spec.Server.CheWorkspaceClusterRole
@@ -968,7 +959,7 @@ func (r *ReconcileChe) Reconcile(request reconcile.Request) (reconcile.Result, e
 	deleted, err := r.ReconcileIdentityProvider(instance, isOpenShift4)
 	if deleted {
 		for {
-			if err := r.DeleteFinalizer(instance); err != nil &&
+			if err := r.DeleteOAuthFinalizer(instance); err != nil &&
 				errors.IsConflict(err) {
 				instance, _ = r.GetCR(request)
 				continue

pkg/controller/che/che_controller_test.go

@@ -14,6 +14,7 @@ package che
 import (
 	"context"
 	"fmt"
+	mocks "github.com/eclipse/che-operator/mocks"
 	"io/ioutil"
 	"os"
 
@@ -43,9 +44,9 @@ import (
 	"github.com/sirupsen/logrus"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	rbac "k8s.io/api/rbac/v1"
 
 	che_mocks "github.com/eclipse/che-operator/mocks/pkg/controller/che"
-	rbacapi "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -188,6 +189,7 @@ var (
 			},
 		},
 	}
+	route = &routev1.Route{}
 )
 
 func init() {
@@ -345,8 +347,7 @@ func TestCaseAutoDetectOAuth(t *testing.T) {
 			scheme.AddKnownTypes(oauth.SchemeGroupVersion, oAuthClient)
 			scheme.AddKnownTypes(userv1.SchemeGroupVersion, &userv1.UserList{}, &userv1.User{})
 			scheme.AddKnownTypes(oauth_config.SchemeGroupVersion, &oauth_config.OAuth{})
-			scheme.AddKnownTypes(routev1.SchemeGroupVersion, &routev1.Route{})
-
+			scheme.AddKnownTypes(routev1.GroupVersion, route)
 			initCR := InitCheWithSimpleCR().DeepCopy()
 			initCR.Spec.Auth.OpenShiftoAuth = testCase.initialOAuthValue
 			testCase.initObjects = append(testCase.initObjects, initCR)
@@ -562,6 +563,7 @@ func TestImagePullerConfiguration(t *testing.T) {
 			operatorsv1alpha1.AddToScheme(scheme.Scheme)
 			operatorsv1.AddToScheme(scheme.Scheme)
 			chev1alpha1.AddToScheme(scheme.Scheme)
+			routev1.AddToScheme(scheme.Scheme)
 			testCase.initObjects = append(testCase.initObjects, testCase.initCR)
 			cli := fake.NewFakeClientWithScheme(scheme.Scheme, testCase.initObjects...)
 			nonCachedClient := fake.NewFakeClientWithScheme(scheme.Scheme, testCase.initObjects...)
@@ -602,6 +604,7 @@ func TestImagePullerConfiguration(t *testing.T) {
 				nonCachedClient: nonCachedClient,
 				discoveryClient: fakeDiscovery,
 				scheme:          scheme.Scheme,
+				tests:           true,
 			}
 			req := reconcile.Request{
 				NamespacedName: types.NamespacedName{
@@ -768,7 +771,7 @@ func TestCheController(t *testing.T) {
 	}
 
 	// Get the custom role binding that should have been created for the role we passed in
-	rb := &rbacapi.RoleBinding{}
+	rb := &rbac.RoleBinding{}
 	if err := cl.Get(context.TODO(), types.NamespacedName{Name: "che-workspace-custom", Namespace: cheCR.Namespace}, rb); err != nil {
 		t.Errorf("Custom role binding %s not found: %s", rb.Name, err)
 	}
@@ -1144,7 +1147,7 @@ func TestShouldSetUpCorrectlyInternalIdentityProviderServiceURL(t *testing.T) {
 	}
 }
 
-func TestShouldUsePublicUrlForExternalPluginRegistryWhenInternalNetworkEnabled(t *testing.T) {
+func TestShouldSetUpCorrectlyInternalPluginRegistryServiceURL(t *testing.T) {
 	os.Setenv("OPENSHIFT_VERSION", "3")
 
 	type testCase struct {
@@ -1330,7 +1333,7 @@ func TestShouldUsePublicUrlForExternalPluginRegistryWhenInternalNetworkEnabled(t
 	}
 }
 
-func TestShouldUsePublicUrlForExternalDevfileRegistryWhenInternalNetworkEnabled(t *testing.T) {
+func TestShouldSetUpCorrectlyInternalDevfileRegistryServiceURL(t *testing.T) {
 	os.Setenv("OPENSHIFT_VERSION", "3")
 
 	type testCase struct {
@@ -1516,7 +1519,7 @@ func TestShouldUsePublicUrlForExternalDevfileRegistryWhenInternalNetworkEnabled(
 	}
 }
 
-func TestShouldUseCorrectUrlForInternalCheServerURLWhenInternalNetworkEnabled(t *testing.T) {
+func TestShouldSetUpCorrectlyInternalCheServerURL(t *testing.T) {
 	os.Setenv("OPENSHIFT_VERSION", "3")
 
 	type testCase struct {
@@ -1651,6 +1654,266 @@ func TestShouldUseCorrectUrlForInternalCheServerURLWhenInternalNetworkEnabled(t
 	}
 }
 
+func TestShouldDelegatePermissionsForCheWorkspaces(t *testing.T) {
+	os.Setenv("OPENSHIFT_VERSION", "3")
+	type testCase struct {
+		name        string
+		initObjects []runtime.Object
+
+		clusterRole bool
+		checluster  *orgv1.CheCluster
+	}
+
+	// the same namespace with Che
+	crWsInTheSameNs1 := InitCheWithSimpleCR().DeepCopy()
+	crWsInTheSameNs1.Spec.Server.WorkspaceNamespaceDefault = crWsInTheSameNs1.Namespace
+
+	crWsInTheSameNs2 := InitCheWithSimpleCR().DeepCopy()
+	crWsInTheSameNs2.Spec.Server.WorkspaceNamespaceDefault = ""
+
+	crWsInTheSameNs3 := InitCheWithSimpleCR().DeepCopy()
+	crWsInTheSameNs3.Spec.Server.CustomCheProperties = make(map[string]string)
+	crWsInTheSameNs3.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"] = ""
+
+	crWsInTheSameNs4 := InitCheWithSimpleCR().DeepCopy()
+	crWsInTheSameNs4.Spec.Server.CustomCheProperties = make(map[string]string)
+	crWsInTheSameNs4.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"] = crWsInTheSameNs1.Namespace
+
+	// differ namespace with Che
+	crWsInAnotherNs1 := InitCheWithSimpleCR().DeepCopy()
+	crWsInAnotherNs1.Spec.Server.WorkspaceNamespaceDefault = "some-test-namespace"
+
+	crWsInAnotherNs2 := InitCheWithSimpleCR().DeepCopy()
+	crWsInAnotherNs2.Spec.Server.CustomCheProperties = make(map[string]string)
+	crWsInAnotherNs2.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"] = "some-test-namespace"
+
+	crWsInAnotherNs3 := InitCheWithSimpleCR().DeepCopy()
+	crWsInAnotherNs3.Spec.Server.CustomCheProperties = make(map[string]string)
+	crWsInAnotherNs3.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"] = crWsInTheSameNs1.Namespace
+	crWsInAnotherNs3.Spec.Server.WorkspaceNamespaceDefault = "some-test-namespace"
+
+	testCases := []testCase{
+		{
+			name:        "che-operator should delegate permission for workspaces in the same namespace with Che. WorkspaceNamespaceDefault=" + crWsInTheSameNs1.Namespace,
+			initObjects: []runtime.Object{},
+			clusterRole: false,
+			checluster:  crWsInTheSameNs1,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in the same namespace with Che. WorkspaceNamespaceDefault=''",
+			initObjects: []runtime.Object{},
+			clusterRole: false,
+			checluster:  crWsInTheSameNs2,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in the same namespace with Che. Property CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT=''",
+			initObjects: []runtime.Object{},
+			clusterRole: false,
+			checluster:  crWsInTheSameNs3,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in the same namespace with Che. Property CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT=" + crWsInTheSameNs1.Namespace,
+			initObjects: []runtime.Object{},
+			clusterRole: false,
+			checluster:  crWsInTheSameNs4,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in differ namespace than Che. WorkspaceNamespaceDefault = 'some-test-namespace'",
+			initObjects: []runtime.Object{},
+			clusterRole: true,
+			checluster:  crWsInAnotherNs1,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in differ namespace than Che. Property CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT = 'some-test-namespace'",
+			initObjects: []runtime.Object{},
+			clusterRole: true,
+			checluster:  crWsInAnotherNs2,
+		},
+		{
+			name:        "che-operator should delegate permission for workspaces in differ namespace than Che. Property CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT points to Che namespace with higher priority WorkspaceNamespaceDefault = 'some-test-namespace'.",
+			initObjects: []runtime.Object{},
+			clusterRole: false,
+			checluster:  crWsInAnotherNs3,
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			logf.SetLogger(zap.LoggerTo(os.Stdout, true))
+
+			scheme := scheme.Scheme
+			orgv1.SchemeBuilder.AddToScheme(scheme)
+			scheme.AddKnownTypes(oauth.SchemeGroupVersion, oAuthClient)
+			scheme.AddKnownTypes(userv1.SchemeGroupVersion, &userv1.UserList{}, &userv1.User{})
+			scheme.AddKnownTypes(oauth_config.SchemeGroupVersion, &oauth_config.OAuth{})
+			scheme.AddKnownTypes(routev1.GroupVersion, route)
+
+			initCR := testCase.checluster
+			initCR.Spec.Auth.OpenShiftoAuth = util.NewBoolPointer(false)
+			testCase.initObjects = append(testCase.initObjects, initCR)
+
+			cli := fake.NewFakeClientWithScheme(scheme, testCase.initObjects...)
+			nonCachedClient := fake.NewFakeClientWithScheme(scheme, testCase.initObjects...)
+			clientSet := fakeclientset.NewSimpleClientset()
+			// todo do we need fake discovery
+			fakeDiscovery, ok := clientSet.Discovery().(*fakeDiscovery.FakeDiscovery)
+			fakeDiscovery.Fake.Resources = []*metav1.APIResourceList{}
+
+			if !ok {
+				t.Fatal("Error creating fake discovery client")
+			}
+
+			var m *mocks.MockPermissionChecker
+			if testCase.clusterRole {
+				ctrl := gomock.NewController(t)
+				m = mocks.NewMockPermissionChecker(ctrl)
+				m.EXPECT().GetNotPermittedPolicyRules(gomock.Any(), "").Return([]rbac.PolicyRule{}, nil).MaxTimes(2)
+				defer ctrl.Finish()
+			}
+
+			r := &ReconcileChe{
+				client:            cli,
+				nonCachedClient:   nonCachedClient,
+				discoveryClient:   fakeDiscovery,
+				scheme:            scheme,
+				permissionChecker: m,
+				tests:             true,
+			}
+			req := reconcile.Request{
+				NamespacedName: types.NamespacedName{
+					Name:      name,
+					Namespace: namespace,
+				},
+			}
+
+			_, err := r.Reconcile(req)
+			if err != nil {
+				t.Fatalf("Error reconciling: %v", err)
+			}
+			_, err = r.Reconcile(req)
+			if err != nil {
+				t.Fatalf("Error reconciling: %v", err)
+			}
+
+			if !testCase.clusterRole {
+				viewRole := &rbac.Role{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: deploy.ViewRoleName, Namespace: namespace}, viewRole); err != nil {
+					t.Errorf("role '%s' not found", deploy.ViewRoleName)
+				}
+				viewRoleBinding := &rbac.RoleBinding{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: ViewRoleBindingName, Namespace: namespace}, viewRoleBinding); err != nil {
+					t.Errorf("rolebinding '%s' not found", ViewRoleBindingName)
+				}
+
+				execRole := &rbac.Role{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: deploy.ExecRoleName, Namespace: namespace}, execRole); err != nil {
+					t.Errorf("role '%s' not found", deploy.ExecRoleName)
+				}
+				execRoleBinding := &rbac.RoleBinding{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: ExecRoleBindingName, Namespace: namespace}, execRoleBinding); err != nil {
+					t.Errorf("rolebinding '%s' not found", ExecRoleBindingName)
+				}
+
+				editRoleBinding := &rbac.RoleBinding{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: EditRoleBindingName, Namespace: namespace}, editRoleBinding); err != nil {
+					t.Errorf("rolebinding '%s' not found", EditRoleBindingName)
+				}
+			} else {
+				manageNamespacesClusterRoleName := fmt.Sprintf(CheWorkspacesNamespaceClusterRoleNameTemplate, namespace)
+				cheManageNamespaceClusterRole := &rbac.ClusterRole{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: manageNamespacesClusterRoleName}, cheManageNamespaceClusterRole); err != nil {
+					t.Errorf("role '%s' not found", manageNamespacesClusterRoleName)
+				}
+				cheManageNamespaceClusterRoleBinding := &rbac.ClusterRoleBinding{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: manageNamespacesClusterRoleName}, cheManageNamespaceClusterRoleBinding); err != nil {
+					t.Errorf("rolebinding '%s' not found", manageNamespacesClusterRoleName)
+				}
+
+				cheWorkspacesClusterRoleName := fmt.Sprintf(CheWorkspacesClusterRoleNameTemplate, namespace)
+				cheWorkspacesClusterRole := &rbac.ClusterRole{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: cheWorkspacesClusterRoleName}, cheWorkspacesClusterRole); err != nil {
+					t.Errorf("role '%s' not found", cheWorkspacesClusterRole)
+				}
+				cheWorkspacesClusterRoleBinding := &rbac.ClusterRoleBinding{}
+				if err := r.client.Get(context.TODO(), types.NamespacedName{Name: cheWorkspacesClusterRoleName}, cheWorkspacesClusterRoleBinding); err != nil {
+					t.Errorf("rolebinding '%s' not found", cheWorkspacesClusterRole)
+				}
+			}
+		})
+	}
+}
+
+func TestShouldFallBackWorspaceNamespaceDefaultBecauseNotEnoughtPermissions(t *testing.T) {
+	// the same namespace with Che
+	cr := InitCheWithSimpleCR().DeepCopy()
+	cr.Spec.Server.WorkspaceNamespaceDefault = "che-workspace-<username>"
+
+	logf.SetLogger(zap.LoggerTo(os.Stdout, true))
+
+	scheme := scheme.Scheme
+	orgv1.SchemeBuilder.AddToScheme(scheme)
+	scheme.AddKnownTypes(oauth.SchemeGroupVersion, oAuthClient)
+	scheme.AddKnownTypes(userv1.SchemeGroupVersion, &userv1.UserList{}, &userv1.User{})
+	scheme.AddKnownTypes(oauth_config.SchemeGroupVersion, &oauth_config.OAuth{})
+	scheme.AddKnownTypes(routev1.GroupVersion, route)
+
+	cr.Spec.Auth.OpenShiftoAuth = util.NewBoolPointer(false)
+
+	cli := fake.NewFakeClientWithScheme(scheme, cr)
+	nonCachedClient := fake.NewFakeClientWithScheme(scheme, cr)
+	clientSet := fakeclientset.NewSimpleClientset()
+	// todo do we need fake discovery
+	fakeDiscovery, ok := clientSet.Discovery().(*fakeDiscovery.FakeDiscovery)
+	fakeDiscovery.Fake.Resources = []*metav1.APIResourceList{}
+
+	if !ok {
+		t.Fatal("Error creating fake discovery client")
+	}
+
+	var m *mocks.MockPermissionChecker
+	ctrl := gomock.NewController(t)
+	m = mocks.NewMockPermissionChecker(ctrl)
+	m.EXPECT().GetNotPermittedPolicyRules(gomock.Any(), "").Return([]rbac.PolicyRule{
+		{
+			APIGroups: []string{""},
+			Resources: []string{"namespaces"},
+			Verbs:     []string{"get", "create", "update"},
+		},
+	}, nil).MaxTimes(2)
+	defer ctrl.Finish()
+
+	r := &ReconcileChe{
+		client:            cli,
+		nonCachedClient:   nonCachedClient,
+		discoveryClient:   fakeDiscovery,
+		scheme:            scheme,
+		permissionChecker: m,
+		tests:             true,
+	}
+	req := reconcile.Request{
+		NamespacedName: types.NamespacedName{
+			Name:      name,
+			Namespace: namespace,
+		},
+	}
+
+	_, err := r.Reconcile(req)
+	if err != nil {
+		t.Fatalf("Error reconciling: %v", err)
+	}
+	_, err = r.Reconcile(req)
+	if err != nil {
+		t.Fatalf("Error reconciling: %v", err)
+	}
+
+	cheCluster := &orgv1.CheCluster{}
+	if err := r.client.Get(context.TODO(), types.NamespacedName{Name: name, Namespace: namespace}, cheCluster); err != nil {
+		t.Errorf("Unable to get checluster")
+	}
+	if cheCluster.Spec.Server.WorkspaceNamespaceDefault != namespace {
+		t.Error("Failed fallback workspaceNamespaceDefault to execute workspaces in the same namespace with Che")
+	}
+}
+
 func Init() (client.Client, discovery.DiscoveryInterface, runtime.Scheme) {
 	objs, ds, scheme := createAPIObjects()
 
@@ -1716,7 +1979,7 @@ func createAPIObjects() ([]runtime.Object, discovery.DiscoveryInterface, runtime
 	cli := fakeclientset.NewSimpleClientset()
 	fakeDiscovery, ok := cli.Discovery().(*fakeDiscovery.FakeDiscovery)
 	if !ok {
-		fmt.Errorf("Error creating fake discovery client")
+		logrus.Error("Error creating fake discovery client")
 		os.Exit(1)
 	}
 
@@ -1735,6 +1998,9 @@ func InitCheWithSimpleCR() *orgv1.CheCluster {
 			Server: orgv1.CheClusterSpecServer{
 				CheWorkspaceClusterRole: "cluster-admin",
 			},
+			Auth: orgv1.CheClusterSpecAuth{
+				OpenShiftoAuth: util.NewBoolPointer(false),
+			},
 		},
 	}
 }

pkg/controller/che/cluster_permissions_finalizer.go

@@ -0,0 +1,66 @@
+//
+// Copyright (c) 2012-2020 Red Hat, Inc.
+// This program and the accompanying materials are made
+// available under the terms of the Eclipse Public License 2.0
+// which is available at https://www.eclipse.org/legal/epl-2.0/
+//
+// SPDX-License-Identifier: EPL-2.0
+//
+// Contributors:
+//   Red Hat, Inc. - initial API and implementation
+//
+
+package che
+
+import (
+	"context"
+	"fmt"
+
+	orgv1 "github.com/eclipse/che-operator/pkg/apis/org/v1"
+	"github.com/eclipse/che-operator/pkg/deploy"
+	"github.com/eclipse/che-operator/pkg/util"
+	"github.com/sirupsen/logrus"
+)
+
+func (r *ReconcileChe) ReconcileCheWorkspacesClusterPermissionsFinalizer(instance *orgv1.CheCluster) (err error) {
+	if instance.ObjectMeta.DeletionTimestamp.IsZero() {
+		if !util.ContainsString(instance.ObjectMeta.Finalizers, cheWorkspacesClusterPermissionsFinalizerName) {
+			instance.ObjectMeta.Finalizers = append(instance.ObjectMeta.Finalizers, cheWorkspacesClusterPermissionsFinalizerName)
+			if err := r.client.Update(context.Background(), instance); err != nil {
+				return err
+			}
+		}
+	} else {
+		r.RemoveCheWorkspacesClusterPermissions(instance)
+	}
+	return nil
+}
+
+func (r *ReconcileChe) RemoveCheWorkspacesClusterPermissions(instance *orgv1.CheCluster) (err error) {
+	if util.ContainsString(instance.ObjectMeta.Finalizers, cheWorkspacesClusterPermissionsFinalizerName) {
+		logrus.Infof("Removing '%s'", cheWorkspacesClusterPermissionsFinalizerName)
+
+		cheWorkspacesNamespaceClusterRoleName := fmt.Sprintf(CheWorkspacesNamespaceClusterRoleNameTemplate, instance.Namespace)
+		cheWorkspacesClusterRoleName := fmt.Sprintf(CheWorkspacesClusterRoleNameTemplate, instance.Namespace)
+
+		if err := deploy.DeleteClusterRole(cheWorkspacesNamespaceClusterRoleName, r.nonCachedClient); err != nil {
+			return err
+		}
+		if err := deploy.DeleteClusterRoleBinding(cheWorkspacesNamespaceClusterRoleName, r.nonCachedClient); err != nil {
+			return err
+		}
+		if err := deploy.DeleteClusterRole(cheWorkspacesClusterRoleName, r.nonCachedClient); err != nil {
+			return err
+		}
+		if err := deploy.DeleteClusterRoleBinding(cheWorkspacesClusterRoleName, r.nonCachedClient); err != nil {
+			return err
+		}
+
+		instance.ObjectMeta.Finalizers = util.DoRemoveString(instance.ObjectMeta.Finalizers, cheWorkspacesClusterPermissionsFinalizerName)
+		if err := r.client.Update(context.Background(), instance); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

pkg/controller/che/finalizer.go

@@ -35,7 +35,7 @@ func (r *ReconcileChe) ReconcileFinalizer(instance *orgv1.CheCluster) (err error
 			oAuthClient, err := r.GetOAuthClient(oAuthClientName)
 			if err == nil {
 				if err := r.client.Delete(context.TODO(), oAuthClient); err != nil {
-					logrus.Errorf("Failed to delete %s oAuthClient: %s", oAuthClientName, err)
+					logrus.Errorf("Failed to delete %s oAuthClient: %s", oAuthClientName, err.Error())
 					return err
 				}
 			} else if !errors.IsNotFound(err) {
@@ -43,7 +43,6 @@ func (r *ReconcileChe) ReconcileFinalizer(instance *orgv1.CheCluster) (err error
 				return err
 			}
 			instance.ObjectMeta.Finalizers = util.DoRemoveString(instance.ObjectMeta.Finalizers, oAuthFinalizerName)
-			logrus.Infof("Updating %s CR", instance.Name)
 
 			if err := r.client.Update(context.Background(), instance); err != nil {
 				logrus.Errorf("Failed to update %s CR: %s", instance.Name, err)
@@ -55,7 +54,7 @@ func (r *ReconcileChe) ReconcileFinalizer(instance *orgv1.CheCluster) (err error
 	return nil
 }
 
-func (r *ReconcileChe) DeleteFinalizer(instance *orgv1.CheCluster) (err error) {
+func (r *ReconcileChe) DeleteOAuthFinalizer(instance *orgv1.CheCluster) (err error) {
 	instance.ObjectMeta.Finalizers = util.DoRemoveString(instance.ObjectMeta.Finalizers, oAuthFinalizerName)
 	logrus.Infof("Removing OAuth finalizer on %s CR", instance.Name)
 	if err := r.client.Update(context.Background(), instance); err != nil {

pkg/controller/che/permission_checker.go

@@ -0,0 +1,61 @@
+//
+// Copyright (c) 2012-2020 Red Hat, Inc.
+// This program and the accompanying materials are made
+// available under the terms of the Eclipse Public License 2.0
+// which is available at https://www.eclipse.org/legal/epl-2.0/
+//
+// SPDX-License-Identifier: EPL-2.0
+//
+// Contributors:	// Contributors:
+//   Red Hat, Inc. - initial API and implementation	//   Red Hat, Inc. - initial API and implementation
+//
+
+package che
+
+import (
+	"fmt"
+
+	"github.com/eclipse/che-operator/pkg/util"
+	authorizationv1 "k8s.io/api/authorization/v1"
+	rbac "k8s.io/api/rbac/v1"
+)
+
+type PermissionChecker interface {
+	GetNotPermittedPolicyRules(policies []rbac.PolicyRule, namespace string) ([]rbac.PolicyRule, error)
+}
+
+type K8sApiPermissionChecker struct {
+}
+
+func (pc *K8sApiPermissionChecker) GetNotPermittedPolicyRules(policies []rbac.PolicyRule, namespace string) ([]rbac.PolicyRule, error) {
+	var notPermittedPolicyRules []rbac.PolicyRule = []rbac.PolicyRule{}
+	for _, policy := range policies {
+		for _, apiGroup := range policy.APIGroups {
+			for _, verb := range policy.Verbs {
+				for _, resource := range policy.Resources {
+					resourceAttribute := &authorizationv1.ResourceAttributes{
+						Namespace: namespace,
+						Verb:      verb,
+						Group:     apiGroup,
+						Resource:  resource,
+					}
+					ok, err := util.K8sclient.IsResourceOperationPermitted(resourceAttribute)
+					if err != nil {
+						return notPermittedPolicyRules, fmt.Errorf("failed to check policy rule: %v", policy)
+					}
+					if !ok {
+						if len(notPermittedPolicyRules) == 0 {
+							notPermittedPolicyRules = append(notPermittedPolicyRules, policy)
+						} else {
+							lastNotPermittedRule := notPermittedPolicyRules[len(notPermittedPolicyRules)-1]
+							if lastNotPermittedRule.Resources[0] != policy.Resources[0] && lastNotPermittedRule.APIGroups[0] != policy.APIGroups[0] {
+								notPermittedPolicyRules = append(notPermittedPolicyRules, policy)
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return notPermittedPolicyRules, nil
+}

pkg/controller/che/proxy.go

@@ -43,7 +43,11 @@ func (r *ReconcileChe) getProxyConfiguration(checluster *orgv1.CheCluster) (*dep
 		// If proxy configuration exists in CR then cluster wide proxy configuration is ignored
 		// Non proxy hosts are merged
 		if cheClusterProxyConf.HttpProxy != "" {
-			cheClusterProxyConf.NoProxy = deploy.MergeNonProxy(cheClusterProxyConf.NoProxy, clusterWideProxyConf.NoProxy)
+			if clusterWideProxyConf.HttpProxy != "" {
+				cheClusterProxyConf.NoProxy = deploy.MergeNonProxy(cheClusterProxyConf.NoProxy, clusterWideProxyConf.NoProxy)
+			} else {
+				cheClusterProxyConf.NoProxy = deploy.MergeNonProxy(cheClusterProxyConf.NoProxy, ".svc")
+			}
 			return cheClusterProxyConf, nil
 		} else if clusterWideProxyConf.HttpProxy != "" {
 			clusterWideProxyConf.NoProxy = deploy.MergeNonProxy(clusterWideProxyConf.NoProxy, cheClusterProxyConf.NoProxy)

pkg/controller/che/proxy_test.go

@@ -90,7 +90,7 @@ func TestReadProxyConfiguration(t *testing.T) {
 				HttpsPassword:    "",
 				HttpsHost:        "proxy",
 				HttpsPort:        "3128",
-				NoProxy:          "host1",
+				NoProxy:          "host1,.svc",
 				TrustedCAMapName: "",
 			},
 		},

pkg/controller/che/workspace_namespace_permission.go

@@ -0,0 +1,378 @@
+//
+// Copyright (c) 2012-2019 Red Hat, Inc.
+// This program and the accompanying materials are made
+// available under the terms of the Eclipse Public License 2.0
+// which is available at https://www.eclipse.org/legal/epl-2.0/
+//
+// SPDX-License-Identifier: EPL-2.0
+//
+// Contributors:	// Contributors:
+//   Red Hat, Inc. - initial API and implementation	//   Red Hat, Inc. - initial API and implementation
+//
+
+package che
+
+import (
+	"fmt"
+	"time"
+
+	orgv1 "github.com/eclipse/che-operator/pkg/apis/org/v1"
+	"github.com/eclipse/che-operator/pkg/deploy"
+	"github.com/eclipse/che-operator/pkg/util"
+	"github.com/sirupsen/logrus"
+	rbac "k8s.io/api/rbac/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+const (
+	// EditClusterRoleName - default "edit" cluster role. This role is pre-created on the cluster.
+	// See more: https://kubernetes.io/blog/2017/10/using-rbac-generally-available-18/#granting-access-to-users
+	EditClusterRoleName = "edit"
+	// EditRoleBindingName - "edit" rolebinding for che-server.
+	EditRoleBindingName = "che"
+	// CheWorkspacesServiceAccount - service account created for Che workspaces.
+	CheWorkspacesServiceAccount = "che-workspace"
+	// ViewRoleBindingName - "view" role for "che-workspace" service account.
+	ViewRoleBindingName = "che-workspace-view"
+	// ExecRoleBindingName - "exec" role for "che-workspace" service account.
+	ExecRoleBindingName = "che-workspace-exec"
+	// CheWorkspacesNamespaceClusterRoleNameTemplate - manage namespaces "cluster role" and "clusterrolebinding" template name
+	CheWorkspacesNamespaceClusterRoleNameTemplate = "%s-cheworkspaces-namespaces-clusterrole"
+	// CheWorkspacesClusterRoleNameTemplate - manage workspaces "cluster role" and "clusterrolebinding" template name
+	CheWorkspacesClusterRoleNameTemplate = "%s-cheworkspaces-clusterrole"
+)
+
+// delegateWorkspacePermissionsInTheSameNamespaceWithChe - creates "che-workspace" service account(for Che workspaces) and
+// delegates "che-operator" SA permissions to the service accounts: "che" and "che-workspace".
+// Also this method binds "edit" default k8s clusterrole using rolebinding to "che" SA.
+func (r *ReconcileChe) delegateWorkspacePermissionsInTheSameNamespaceWithChe(deployContext *deploy.DeployContext) (reconcile.Result, error) {
+	tests := r.tests
+
+	// Create "che-workspace" service account.
+	// Che workspace components use this service account.
+	cheWorkspaceSA, err := deploy.SyncServiceAccountToCluster(deployContext, CheWorkspacesServiceAccount)
+	if cheWorkspaceSA == nil {
+		logrus.Infof("Waiting on service account '%s' to be created", CheWorkspacesServiceAccount)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+
+	// Create view role for "che-workspace" service account.
+	// This role used by exec terminals, tasks, metric che-theia plugin and so on.
+	viewRole, err := deploy.SyncViewRoleToCluster(deployContext)
+	if viewRole == nil {
+		logrus.Infof("Waiting on role '%s' to be created", deploy.ViewRoleName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+
+	cheWSViewRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, ViewRoleBindingName, CheWorkspacesServiceAccount, deploy.ViewRoleName, "Role")
+	if cheWSViewRoleBinding == nil {
+		logrus.Infof("Waiting on role binding '%s' to be created", ViewRoleBindingName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+
+	// Create exec role for "che-workspaces" service account.
+	// This role used by exec terminals, tasks and so on.
+	execRole, err := deploy.SyncExecRoleToCluster(deployContext)
+	if execRole == nil {
+		logrus.Infof("Waiting on role '%s' to be created", deploy.ExecRoleName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+
+	cheWSExecRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, ExecRoleBindingName, CheWorkspacesServiceAccount, deploy.ExecRoleName, "Role")
+	if cheWSExecRoleBinding == nil {
+		logrus.Infof("Waiting on role binding '%s' to be created", ExecRoleBindingName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+
+	// Bind "edit" cluster role for "che" service account.
+	// che-operator doesn't create "edit" role. This role is pre-created on the cluster.
+	// Warning: operator binds clusterrole using rolebinding(not clusterrolebinding).
+	// That's why "che" service account has got permissions only in the one namespace!
+	// So permissions are binding in "non-cluster" scope.
+	cheRoleBinding, err := deploy.SyncRoleBindingToCluster(deployContext, EditRoleBindingName, CheServiceAccountName, EditClusterRoleName, "ClusterRole")
+	if cheRoleBinding == nil {
+		logrus.Infof("Waiting on role binding '%s' to be created", EditRoleBindingName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{}, err
+		}
+	}
+	return reconcile.Result{}, nil
+}
+
+// Create cluster roles and cluster role bindings for "che" service account.
+// che-server uses "che" service account for creation new workspaces and workspace components.
+// Operator will create two cluster roles:
+// - "<workspace-namespace/project-name>-cheworkspaces-namespaces-clusterrole" - cluster role to mange namespace(for Kubernetes platform)
+//    or project(for Openshift platform) for new workspace.
+// - "<workspace-namespace/project-name>-cheworkspaces-clusterrole" - cluster role to create and manage k8s objects required for
+//    workspace components.
+// Notice: After permission delegation che-server will create service account "che-workspace" ITSELF with
+//         "exec" and "view" roles for each new workspace.
+func (r *ReconcileChe) delegateWorkspacePermissionsInTheDifferNamespaceThanChe(instance *orgv1.CheCluster, deployContext *deploy.DeployContext) (reconcile.Result, error) {
+	tests := r.tests
+
+	сheWorkspacesNamespaceClusterRoleName := fmt.Sprintf(CheWorkspacesNamespaceClusterRoleNameTemplate, instance.Namespace)
+	сheWorkspacesNamespaceClusterRoleBindingName := сheWorkspacesNamespaceClusterRoleName
+	// Create clusterrole "<workspace-namespace/project-name>-clusterrole-manage-namespaces" to manage namespace/projects for Che workspaces.
+	provisioned, err := deploy.SyncClusterRoleToCheCluster(deployContext, сheWorkspacesNamespaceClusterRoleName, getCheWorkspacesNamespacePolicy())
+	if !provisioned {
+		logrus.Infof("Waiting on clusterrole '%s' to be created", сheWorkspacesNamespaceClusterRoleName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{RequeueAfter: time.Second}, err
+		}
+	}
+	сheWorkspacesNamespaceClusterRoleBinding, err := deploy.SyncClusterRoleBindingToCluster(deployContext, сheWorkspacesNamespaceClusterRoleBindingName, CheServiceAccountName, сheWorkspacesNamespaceClusterRoleName)
+	if сheWorkspacesNamespaceClusterRoleBinding == nil {
+		logrus.Infof("Waiting on clusterrolebinding '%s' to be created", сheWorkspacesNamespaceClusterRoleBindingName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{RequeueAfter: time.Second}, err
+		}
+	}
+
+	сheWorkspacesClusterRoleName := fmt.Sprintf(CheWorkspacesClusterRoleNameTemplate, instance.Namespace)
+	сheWorkspacesClusterRoleBindingName := сheWorkspacesClusterRoleName
+	// Create clusterrole "<workspace-namespace/project-name>-cheworkspaces-namespaces-clusterrole" to create k8s components for Che workspaces.
+	provisioned, err = deploy.SyncClusterRoleToCheCluster(deployContext, сheWorkspacesClusterRoleName, getCheWorkspacesPolicy())
+	if !provisioned {
+		logrus.Infof("Waiting on clusterrole '%s' to be created", сheWorkspacesClusterRoleName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{RequeueAfter: time.Second}, err
+		}
+	}
+	cheManageNamespacesRolebinding, err := deploy.SyncClusterRoleBindingToCluster(deployContext, сheWorkspacesClusterRoleBindingName, CheServiceAccountName, сheWorkspacesClusterRoleName)
+	if cheManageNamespacesRolebinding == nil {
+		logrus.Infof("Waiting on clusterrolebinding '%s' to be created", сheWorkspacesClusterRoleBindingName)
+		if err != nil {
+			logrus.Error(err)
+		}
+		if !tests {
+			return reconcile.Result{RequeueAfter: time.Second}, err
+		}
+	}
+	return reconcile.Result{}, nil
+}
+
+// DeleteWorkspacesInSameNamespaceWithChePermissions - removes workspaces in same namespace with Che role and rolebindings.
+func (r *ReconcileChe) DeleteWorkspacesInSameNamespaceWithChePermissions(instance *orgv1.CheCluster, cli client.Client) error {
+
+	if err := deploy.DeleteRole(deploy.ExecRoleName, instance.Namespace, cli); err != nil {
+		return err
+	}
+	if err := deploy.DeleteRoleBinding(ExecRoleBindingName, instance.Namespace, cli); err != nil {
+		return err
+	}
+
+	if err := deploy.DeleteRole(deploy.ViewRoleName, instance.Namespace, cli); err != nil {
+		return err
+	}
+	if err := deploy.DeleteRoleBinding(ViewRoleBindingName, instance.Namespace, cli); err != nil {
+		return err
+	}
+
+	if err := deploy.DeleteRoleBinding(EditRoleBindingName, instance.Namespace, cli); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *ReconcileChe) reconcileWorkspacePermissionsFinalizer(instance *orgv1.CheCluster, deployContext *deploy.DeployContext) error {
+
+	if !util.IsOAuthEnabled(instance) {
+		if util.IsWorkspaceInSameNamespaceWithChe(instance) {
+			// Delete workspaces cluster permission set and finalizer from CR if deletion timestamp is not 0.
+			if err := r.RemoveCheWorkspacesClusterPermissions(instance); err != nil {
+				logrus.Errorf("workspace permissions finalizers was not removed from CR, cause %s", err.Error())
+				return err
+			}
+		} else {
+			// Delete permission set for configuration "same namespace for Che and workspaces".
+			if err := r.DeleteWorkspacesInSameNamespaceWithChePermissions(instance, deployContext.ClusterAPI.Client); err != nil {
+				logrus.Errorf("unable to delete workspaces in same namespace permission set, cause %s", err.Error())
+				return err
+			}
+			// Add workspaces cluster permission finalizer to the CR if deletion timestamp is 0.
+			// Or delete workspaces cluster permission set and finalizer from CR if deletion timestamp is not 0.
+			if err := r.ReconcileCheWorkspacesClusterPermissionsFinalizer(instance); err != nil {
+				logrus.Errorf("unable to add workspace permissions finalizers to the CR, cause %s", err.Error())
+				return err
+			}
+		}
+	} else {
+		// Delete workspaces cluster permission set and finalizer from CR if deletion timestamp is not 0.
+		if err := r.RemoveCheWorkspacesClusterPermissions(instance); err != nil {
+			logrus.Errorf("workspace permissions finalizers was not removed from CR, cause %s", err.Error())
+			return err
+		}
+	}
+
+	return nil
+}
+
+func getCheWorkspacesNamespacePolicy() []rbac.PolicyRule {
+	k8sPolicies :=  []rbac.PolicyRule{
+		{
+			APIGroups: []string{""},
+			Resources: []string{"namespaces"},
+			Verbs:     []string{"get", "create", "update"},
+		},
+	}
+
+	openshiftPolicies := []rbac.PolicyRule{	
+		{
+			APIGroups: []string{"project.openshift.io"},
+			Resources: []string{"projectrequests"},
+			Verbs:     []string{"create", "update"},
+		},
+		{
+			APIGroups: []string{"project.openshift.io"},
+			Resources: []string{"projects"},
+			Verbs:     []string{"get"},
+		},
+	}
+
+	if util.IsOpenShift {
+		return append(k8sPolicies, openshiftPolicies...)
+	}
+	return k8sPolicies
+}
+
+func getCheWorkspacesPolicy() []rbac.PolicyRule {
+	k8sPolicies := []rbac.PolicyRule{
+		{
+			APIGroups: []string{""},
+			Resources: []string{"serviceaccounts"},
+			Verbs:     []string{"get", "create", "watch"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"pods/exec"},
+			Verbs:     []string{"create"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"persistentvolumeclaims", "configmaps"},
+			Verbs:     []string{"list"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"secrets"},
+			Verbs:     []string{"list", "create", "delete"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"persistentvolumeclaims"},
+			Verbs:     []string{"get", "create", "watch"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"pods"},
+			Verbs:     []string{"get", "create", "list", "watch", "delete"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"services"},
+			Verbs:     []string{"create", "list", "delete"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"configmaps"},
+			Verbs:     []string{"get", "create", "delete"},
+		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"events"},
+			Verbs:     []string{"watch"},
+		},
+		{
+			APIGroups: []string{"apps"},
+			Resources: []string{"secrets"},
+			Verbs:     []string{"list"},
+		},
+		{
+			APIGroups: []string{"apps"},
+			Resources: []string{"deployments"},
+			Verbs:     []string{"get", "create", "list", "watch", "patch", "delete"},
+		},
+		{
+			APIGroups: []string{"apps"},
+			Resources: []string{"replicasets"},
+			Verbs:     []string{"list", "get", "patch", "delete"},
+		},
+		{
+			APIGroups: []string{"extensions"},
+			Resources: []string{"ingresses"},
+			Verbs:     []string{"list", "create", "watch", "get", "delete"},
+		},
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"roles"},
+			Verbs:     []string{"get", "create"},
+		},
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"rolebindings"},
+			Verbs:     []string{"get", "update", "create"},
+		},
+	}
+	openshiftPolicies := []rbac.PolicyRule{
+		{
+			APIGroups: []string{"route.openshift.io"},
+			Resources: []string{"routes"},
+			Verbs:     []string{"list", "create", "delete"},
+		},
+		{
+			APIGroups: []string{"authorization.openshift.io"},
+			Resources: []string{"roles"},
+			Verbs:     []string{"get", "create"},
+		},
+		{
+			APIGroups: []string{"authorization.openshift.io"},
+			Resources: []string{"rolebindings"},
+			Verbs:     []string{"get", "update", "create"},
+		},
+	}
+
+	if util.IsOpenShift {
+		return append(k8sPolicies, openshiftPolicies...)
+	}
+	return k8sPolicies
+}

pkg/deploy/clusterrole.go

@@ -0,0 +1,110 @@
+//
+// Copyright (c) 2012-2019 Red Hat, Inc.
+// This program and the accompanying materials are made
+// available under the terms of the Eclipse Public License 2.0
+// which is available at https://www.eclipse.org/legal/epl-2.0/
+//
+// SPDX-License-Identifier: EPL-2.0
+//
+// Contributors:
+//   Red Hat, Inc. - initial API and implementation
+//
+package deploy
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/sirupsen/logrus"
+	rbac "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	runtimeClient "sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var clusterRoleDiffOpts = cmp.Options{
+	cmpopts.IgnoreFields(rbac.ClusterRole{}, "TypeMeta", "ObjectMeta"),
+	cmpopts.IgnoreFields(rbac.PolicyRule{}, "ResourceNames", "NonResourceURLs"),
+}
+
+func SyncClusterRoleToCheCluster(
+	deployContext *DeployContext,
+	name string,
+	policyRule []rbac.PolicyRule) (bool, error) {
+
+	specClusterRole, err := getSpecClusterRole(deployContext, name, policyRule)
+	if err != nil {
+		return false, err
+	}
+
+	clusterRole, err := GetClusterRole(specClusterRole.Name, deployContext.ClusterAPI.Client)
+	if err != nil {
+		return false, err
+	}
+
+	if clusterRole == nil {
+		logrus.Infof("Creating a new object: %s, name %s", specClusterRole.Kind, specClusterRole.Name)
+		err := deployContext.ClusterAPI.Client.Create(context.TODO(), specClusterRole)
+		return false, err
+	}
+
+	diff := cmp.Diff(clusterRole, specClusterRole, clusterRoleDiffOpts)
+	if len(diff) > 0 {
+		logrus.Infof("Updating existed object: %s, name: %s", clusterRole.Kind, clusterRole.Name)
+		fmt.Printf("Difference:\n%s", diff)
+		clusterRole.Rules = specClusterRole.Rules
+		err := deployContext.ClusterAPI.Client.Update(context.TODO(), clusterRole)
+		return false, err
+	}
+
+	return true, nil
+}
+
+func GetClusterRole(name string, client runtimeClient.Client) (*rbac.ClusterRole, error) {
+	clusterRole := &rbac.ClusterRole{}
+	namespacedName := types.NamespacedName{
+		Name: name,
+	}
+	err := client.Get(context.TODO(), namespacedName, clusterRole)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return clusterRole, nil
+}
+
+func getSpecClusterRole(deployContext *DeployContext, name string, policyRule []rbac.PolicyRule) (*rbac.ClusterRole, error) {
+	labels := GetLabels(deployContext.CheCluster, DefaultCheFlavor(deployContext.CheCluster))
+	clusterRole := &rbac.ClusterRole{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ClusterRole",
+			APIVersion: rbac.SchemeGroupVersion.String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   name,
+			Labels: labels,
+		},
+		Rules: policyRule,
+	}
+
+	return clusterRole, nil
+}
+
+func DeleteClusterRole(clusterRoleName string, client runtimeClient.Client) error {
+	clusterRole := &rbac.ClusterRole{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterRoleName,
+		},
+	}
+	err := client.Delete(context.TODO(), clusterRole)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+
+	return nil
+}

pkg/deploy/clusterrolebinding.go

@@ -40,7 +40,7 @@ func SyncClusterRoleBindingToCluster(
 		return nil, err
 	}
 
-	clusterRB, err := getClusterRoleBiding(specCRB.Name, deployContext.ClusterAPI.Client)
+	clusterRB, err := GetClusterRoleBiding(specCRB.Name, deployContext.ClusterAPI.Client)
 	if err != nil {
 		return nil, err
 	}
@@ -64,7 +64,7 @@ func SyncClusterRoleBindingToCluster(
 	return clusterRB, nil
 }
 
-func getClusterRoleBiding(name string, client runtimeClient.Client) (*rbac.ClusterRoleBinding, error) {
+func GetClusterRoleBiding(name string, client runtimeClient.Client) (*rbac.ClusterRoleBinding, error) {
 	clusterRoleBinding := &rbac.ClusterRoleBinding{}
 	crbName := types.NamespacedName{Name: name}
 	err := client.Get(context.TODO(), crbName, clusterRoleBinding)
@@ -112,3 +112,17 @@ func getSpecClusterRoleBinding(
 
 	return clusterRoleBinding, nil
 }
+
+func DeleteClusterRoleBinding(clusterRoleBindingName string, client runtimeClient.Client) error {
+	clusterRoleBinding := &rbac.ClusterRoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterRoleBindingName,
+		},
+	}
+	err := client.Delete(context.TODO(), clusterRoleBinding)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+
+	return nil
+}

pkg/deploy/role.go

@@ -26,6 +26,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
 
+const (
+	// ViewRoleName role to get k8s object needed for Workspace components(metrics plugin, Che terminals, tasks etc.)
+	ViewRoleName = "view"
+	// ExecRoleName - role name to create Che terminals and tasks in the workspace.
+	ExecRoleName = "exec"
+)
+
 var roleDiffOpts = cmp.Options{
 	cmpopts.IgnoreFields(rbac.Role{}, "TypeMeta", "ObjectMeta"),
 	cmpopts.IgnoreFields(rbac.PolicyRule{}, "ResourceNames", "NonResourceURLs"),
@@ -62,7 +69,7 @@ func SyncExecRoleToCluster(deployContext *DeployContext) (*rbac.Role, error) {
 			},
 		},
 	}
-	return SyncRoleToCluster(deployContext, "exec", execPolicyRule)
+	return SyncRoleToCluster(deployContext, ExecRoleName, execPolicyRule)
 }
 
 func SyncViewRoleToCluster(deployContext *DeployContext) (*rbac.Role, error) {
@@ -90,7 +97,7 @@ func SyncViewRoleToCluster(deployContext *DeployContext) (*rbac.Role, error) {
 			},
 		},
 	}
-	return SyncRoleToCluster(deployContext, "view", viewPolicyRule)
+	return SyncRoleToCluster(deployContext, ViewRoleName, viewPolicyRule)
 }
 
 func SyncRoleToCluster(
@@ -103,7 +110,7 @@ func SyncRoleToCluster(
 		return nil, err
 	}
 
-	clusterRole, err := getClusterRole(specRole.Name, specRole.Namespace, deployContext.ClusterAPI.Client)
+	clusterRole, err := getCheClusterRole(specRole.Name, specRole.Namespace, deployContext.ClusterAPI.Client)
 	if err != nil {
 		return nil, err
 	}
@@ -126,7 +133,7 @@ func SyncRoleToCluster(
 	return clusterRole, nil
 }
 
-func getClusterRole(name string, namespace string, client runtimeClient.Client) (*rbac.Role, error) {
+func getCheClusterRole(name string, namespace string, client runtimeClient.Client) (*rbac.Role, error) {
 	role := &rbac.Role{}
 	namespacedName := types.NamespacedName{
 		Namespace: namespace,
@@ -164,3 +171,17 @@ func getSpecRole(deployContext *DeployContext, name string, policyRule []rbac.Po
 
 	return role, nil
 }
+
+func DeleteRole(name string, namespace string, client runtimeClient.Client) error {
+	role := &rbac.Role{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      name,
+		},
+	}
+	err := client.Delete(context.TODO(), role)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return nil
+}

pkg/deploy/rolebinding.go

@@ -104,3 +104,18 @@ func getSpecRoleBinding(
 
 	return roleBinding, nil
 }
+
+func DeleteRoleBinding(name string, namespace string, client runtimeClient.Client) error {
+	roleBinding := &rbac.RoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      name,
+		},
+	}
+	err := client.Delete(context.TODO(), roleBinding)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+
+	return nil
+}

pkg/deploy/server/che_configmap.go

@@ -115,17 +115,12 @@ func GetCheConfigMapData(deployContext *deploy.DeployContext) (cheEnv map[string
 	}
 	tls := "false"
 	openShiftIdentityProviderId := "NULL"
-	defaultTargetNamespaceDefault := deployContext.CheCluster.Namespace // By default Che SA has right in the namespace where Che in installed ...
 	if isOpenShift && util.IsOAuthEnabled(deployContext.CheCluster) {
-		// ... But if the workspace is created under the openshift identity of the end-user,
-		// Then we'll have rights to create any new namespace
-		defaultTargetNamespaceDefault = "<username>-" + cheFlavor
 		openShiftIdentityProviderId = "openshift-v3"
 		if isOpenshift4 {
 			openShiftIdentityProviderId = "openshift-v4"
 		}
 	}
-	defaultTargetNamespace := util.GetValue(deployContext.CheCluster.Spec.Server.WorkspaceNamespaceDefault, defaultTargetNamespaceDefault)
 	namespaceAllowUserDefined := strconv.FormatBool(deployContext.CheCluster.Spec.Server.AllowUserDefinedWorkspaceNamespaces)
 	tlsSupport := deployContext.CheCluster.Spec.Server.TlsSupport
 	protocol := "http"
@@ -180,6 +175,7 @@ func GetCheConfigMapData(deployContext *deploy.DeployContext) (cheEnv map[string
 	cheMultiUser := deploy.GetCheMultiUser(deployContext.CheCluster)
 	workspaceExposure := deploy.GetSingleHostExposureType(deployContext.CheCluster)
 	singleHostGatewayConfigMapLabels := labels.FormatLabels(util.GetMapValue(deployContext.CheCluster.Spec.Server.SingleHostGatewayConfigMapLabels, deploy.DefaultSingleHostGatewayConfigMapLabels))
+	workspaceNamespaceDefault := util.GetWorkspaceNamespaceDefault(deployContext.CheCluster)
 
 	cheAPI := protocol + "://" + cheHost + "/api"
 	var keycloakInternalURL, pluginRegistryInternalURL, devfileRegistryInternalURL, cheInternalAPI string
@@ -219,7 +215,7 @@ func GetCheConfigMapData(deployContext *deploy.DeployContext) (cheEnv map[string
 		CheDebugServer:                         cheDebug,
 		CheInfrastructureActive:                infra,
 		CheInfraKubernetesServiceAccountName:   "che-workspace",
-		DefaultTargetNamespace:                 defaultTargetNamespace,
+		DefaultTargetNamespace:                 workspaceNamespaceDefault,
 		NamespaceAllowUserDefined:              namespaceAllowUserDefined,
 		PvcStrategy:                            pvcStrategy,
 		PvcClaimSize:                           pvcClaimSize,
@@ -284,10 +280,7 @@ func GetCheConfigMapData(deployContext *deploy.DeployContext) (cheEnv map[string
 
 		// Add TLS key and server certificate to properties when user workspaces should be created in another
 		// than Che server namespace, from where the Che TLS secret is not accessable
-		k8sDefaultNamespace := deployContext.CheCluster.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"]
-		if (defaultTargetNamespace != "" && defaultTargetNamespace != deployContext.CheCluster.Namespace) ||
-			(k8sDefaultNamespace != "" && k8sDefaultNamespace != deployContext.CheCluster.Namespace) {
-
+		if !util.IsWorkspaceInSameNamespaceWithChe(deployContext.CheCluster) {
 			cheTLSSecret, err := deploy.GetClusterSecret(deployContext.CheCluster.Spec.K8s.TlsSecretName, deployContext.CheCluster.ObjectMeta.Namespace, deployContext.ClusterAPI)
 			if err != nil {
 				return nil, err

pkg/util/k8s_helpers.go

@@ -18,6 +18,7 @@ import (
 
 	v1 "github.com/eclipse/che-operator/pkg/apis/org/v1"
 	"github.com/sirupsen/logrus"
+	authorizationv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
@@ -220,3 +221,18 @@ func (cl *k8s) RunExec(command []string, podName, namespace string) (string, str
 
 	return stdout.String(), stderr.String(), nil
 }
+
+func (cl *k8s) IsResourceOperationPermitted(resourceAttr *authorizationv1.ResourceAttributes) (ok bool, err error) {
+	lsar := &authorizationv1.SelfSubjectAccessReview{
+		Spec: authorizationv1.SelfSubjectAccessReviewSpec{
+			ResourceAttributes: resourceAttr,
+		},
+	}
+
+	ssar, err := cl.clientset.AuthorizationV1().SelfSubjectAccessReviews().Create(lsar)
+	if err != nil {
+		return false, err
+	}
+
+	return ssar.Status.Allowed, nil
+}

pkg/util/util.go

@@ -347,7 +347,7 @@ func NewBoolPointer(value bool) *bool {
 	return &variable
 }
 
-// IsOAuthEnabled return true when oAuth is enable for CheCluster resource, otherwise false.
+// IsOAuthEnabled returns true when oAuth is enable for CheCluster resource, otherwise false.
 func IsOAuthEnabled(c *orgv1.CheCluster) bool {
 	if c.Spec.Auth.OpenShiftoAuth != nil && *c.Spec.Auth.OpenShiftoAuth {
 		return true
@@ -355,6 +355,27 @@ func IsOAuthEnabled(c *orgv1.CheCluster) bool {
 	return false
 }
 
+// IsWorkspaceInSameNamespaceWithChe return true when Che workspaces will be executed in the same namespace with Che, otherwise returns false.
+func IsWorkspaceInSameNamespaceWithChe(cr *orgv1.CheCluster) bool {
+	return GetWorkspaceNamespaceDefault(cr) == cr.Namespace
+}
+
+// GetWorkspaceNamespaceDefault - returns workspace namespace default strategy, which points on the namespaces used for workspaces execution.
+func GetWorkspaceNamespaceDefault(cr *orgv1.CheCluster) string {
+	if cr.Spec.Server.CustomCheProperties != nil {
+		k8sNamespaceDefault := cr.Spec.Server.CustomCheProperties["CHE_INFRA_KUBERNETES_NAMESPACE_DEFAULT"]
+		if k8sNamespaceDefault != "" {
+			return k8sNamespaceDefault
+		}
+	}
+
+	workspaceNamespaceDefault := cr.Namespace
+	if IsOpenShift && IsOAuthEnabled(cr) {
+		workspaceNamespaceDefault = "<username>-" + cr.Spec.Server.CheFlavor
+	}
+	return GetValue(cr.Spec.Server.WorkspaceNamespaceDefault, workspaceNamespaceDefault)
+}
+
 func GetResourceQuantity(value string, defaultValue string) resource.Quantity {
 	if value != "" {
 		return resource.MustParse(value)

vendor/modules.txt

@@ -410,7 +410,6 @@ sigs.k8s.io/controller-runtime/pkg/leaderelection
 sigs.k8s.io/controller-runtime/pkg/log
 sigs.k8s.io/controller-runtime/pkg/log/zap
 sigs.k8s.io/controller-runtime/pkg/manager
-sigs.k8s.io/controller-runtime/pkg/manager/signals
 sigs.k8s.io/controller-runtime/pkg/metrics
 sigs.k8s.io/controller-runtime/pkg/predicate
 sigs.k8s.io/controller-runtime/pkg/reconcile

vendor/sigs.k8s.io/controller-runtime/pkg/manager/signals/doc.go

@@ -1,20 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package signals contains libraries for handling signals to gracefully
-// shutdown the manager in combination with Kubernetes pod graceful termination
-// policy.
-package signals

vendor/sigs.k8s.io/controller-runtime/pkg/manager/signals/signal.go

@@ -1,43 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package signals
-
-import (
-	"os"
-	"os/signal"
-)
-
-var onlyOneSignalHandler = make(chan struct{})
-
-// SetupSignalHandler registers for SIGTERM and SIGINT. A stop channel is returned
-// which is closed on one of these signals. If a second signal is caught, the program
-// is terminated with exit code 1.
-func SetupSignalHandler() (stopCh <-chan struct{}) {
-	close(onlyOneSignalHandler) // panics when called twice
-
-	stop := make(chan struct{})
-	c := make(chan os.Signal, 2)
-	signal.Notify(c, shutdownSignals...)
-	go func() {
-		<-c
-		close(stop)
-		<-c
-		os.Exit(1) // second signal. Exit directly.
-	}()
-
-	return stop
-}

vendor/sigs.k8s.io/controller-runtime/pkg/manager/signals/signal_posix.go

@@ -1,26 +0,0 @@
-// +build !windows
-
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package signals
-
-import (
-	"os"
-	"syscall"
-)
-
-var shutdownSignals = []os.Signal{os.Interrupt, syscall.SIGTERM}

vendor/sigs.k8s.io/controller-runtime/pkg/manager/signals/signal_windows.go

@@ -1,23 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package signals
-
-import (
-	"os"
-)
-
-var shutdownSignals = []os.Signal{os.Interrupt}