chore: Configure DWO with tlsCertificateConfigmapRef when certificates imported to che-operator

[tolusha]

…s imported to che-operator

What does this PR do?

This PR configures the DevWorkspace Operator to use Che's merged CA bundle for TLS by setting tlsCertificateConfigmapRef in the DWI routing config when custom certificates are imported, and adding a watch label so DWO picks up changes. It also refactors the TLS certificate reconciliation to use newer client APIs, adds owner references, removes deprecated sync helpers, and splits a large test file into domain-specific ones.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

eclipse-che/che#23870

How to test this PR?

1. Deploy the operator:
   chectl server:deploy -p openshift --che-operator-image quay.io/abazko/che-operator:next

2. Create k8s resources to host a parent devfile:

apiVersion: v1
kind: Namespace
metadata:
  name: parent
---
apiVersion: v1
kind: Pod
metadata:
  name: server
  namespace: parent
  labels:
    app: file-server-app
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: httpd
      image: 'quay.io/abazko/operator:parent-devfile'
      ports:
        - containerPort: 8000
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
apiVersion: v1
kind: Service
metadata:
  name: file-server
  namespace: parent
spec:
  selector:
    app: file-server-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8000
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: parent
  namespace: parent
spec:
  to:
    name: file-server
    kind: Service
  tls:
    insecureEdgeTerminationPolicy: Redirect
    termination: edge
  port:
    targetPort: 8000

3. Ensure parent devfile is accessible by url
   https://parent-parent.<openshift-base-domain>/devfile.yaml (for instance https://parent-parent.apps-crc.testing/devfile.yaml)

4. Import certificate into Che

openssl s_client -connect parent-parent.apps-crc.testing:443 -showcerts < /dev/null | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > parent.crt

kubectl create configmap custom-ca-certificates \
    --from-file=parent.crt \
    --namespace=eclipse-che

kubectl label configmap custom-ca-certificates \
    app.kubernetes.io/component=ca-bundle \
    app.kubernetes.io/part-of=che.eclipse.org  \
    --namespace=eclipse-che

5. Check that DWO is configured
   oc get dwoc -n eclipse-che devworkspace-config -o jsonpath="{.config.routing}"

6. Start a workspace from https://gist.githubusercontent.com/tolusha/6c68d907a52d235b311f196478ce08b6/raw/d94a38042093d9a5fe021091d861cb9ea15ac78e/devfile.yaml

Common Test Scenarios

• Deploy Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant help — Show this help message

[tolusha]

/retest