Restrict which URLs can create workspaces

Restrict which source URLs can create Cloud Development Environments (CDEs), so that workspaces can only be launched from authorized repositories. Wildcard patterns such as https://example.com/* allow all paths within a domain.

Prerequisites

  • An active kubectl session with administrative permissions to the destination Kubernetes cluster. See Overview of kubectl.

Procedure

  1. Configure allowed sources:

    kubectl patch checluster/eclipse-che \
    --namespace eclipse-che \
    --type='merge' \
    -p \
'{
   "spec": {
     "devEnvironments": {
       "allowedSources": {
         "urls": ["url_1", "url_2"] (1)
       }
     }
   }
 }'
1 The array of approved URLs for starting Cloud Development Environments (CDEs). CDEs can only be initiated from these URLs. Wildcards * are supported in URLs. For example, https://example.com/* would allow CDEs to be initiated from any path within example.com.
Additional resources