fix: propagate discoverable endpoint Service conflicts

[akurinnoy]

What does this PR do?

Propagates DWO discoverable-Service conflicts through Che routing reconciliation, preserving typed errors and stopping before gateway or routing resources are generated.

Temporarily replaces the canonical DWO dependency with fork commit 4d93c089127763eff4b7a14023e7c971fb47dc5e (v0.0.0-20261008102644-4d93c0891277). Keep this PR draft until DWO #1521 merges; then pin its immutable upstream merge revision and repeat dependency generation and verification.

Screenshot/screencast of this PR

Not applicable.

What issues does this PR fix or reference?

• Companion to DWO #1521
• Che #23231

How to test this PR?

1. Deploy the operator:

OpenShift

oc create namespace devworkspace-controller
oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml

DWO_IMAGE='replace-with-image-built-from-4d93c089127763eff4b7a14023e7c971fb47dc5e'
oc -n devworkspace-controller set image deployment/devworkspace-controller-manager devworkspace-controller=${DWO_IMAGE}
oc -n devworkspace-controller rollout status deployment/devworkspace-controller-manager

OPERATOR_IMAGE='replace-with-Che-operator-image-built-from-this-branch'
sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f -
oc wait --for=condition=Ready pod -l app.kubernetes.io/component=che-operator -n eclipse-che --timeout=60s
oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active --timeout=120s

Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh
DWO_IMAGE='replace-with-image-built-from-4d93c089127763eff4b7a14023e7c971fb47dc5e'
kubectl -n devworkspace-controller set image deployment/devworkspace-controller-manager devworkspace-controller=${DWO_IMAGE}
kubectl -n devworkspace-controller rollout status deployment/devworkspace-controller-manager

Confirm the Che and DWO deployments use the images built above before continuing.

Before applying the workspace YAML, replace <NAMESPACE> with an existing Che workspace namespace and set the shell variable to the same value:

NAMESPACE='<NAMESPACE>'

2. Create a normal workspace with one discoverable and one ordinary endpoint. Save this as endpoint-normal.yaml and run kubectl apply -f endpoint-normal.yaml:

apiVersion: workspace.devfile.io/v1alpha2
kind: DevWorkspace
metadata:
  name: endpoint-normal
  namespace: <NAMESPACE>
spec:
  started: true
  routingClass: che
  template:
    components:
      - name: app
        container:
          image: quay.io/devfile/universal-developer-image:latest
          command: ["sleep", "infinity"]
          endpoints:
            - name: catalog-api
              targetPort: 8080
              exposure: public
              attributes:
                discoverable: "true"
            - name: metrics
              targetPort: 8081
              exposure: public

Confirm it starts, the catalog-api Service exists, and each Route/Ingress targets the expected Service (catalog-api for the discoverable endpoint and the workspace Service for metrics).

3. Save this as foreign-service.yaml and apply it in the same namespace. It deliberately carries another workspace ID:

apiVersion: v1
kind: Service
metadata:
  name: foreign-api
  namespace: <NAMESPACE>
  labels:
    controller.devfile.io/devworkspace_id: foreign-workspace
    controller.devfile.io/devworkspace_name: foreign-workspace
spec:
  type: ClusterIP
  selector:
    app: foreign-workspace
  ports:
    - name: foreign
      port: 9999
      targetPort: 9999

Run kubectl apply -f foreign-service.yaml and save the existing Service with kubectl get service foreign-api -n "$NAMESPACE" -o yaml > before.yaml. Apply a copy of endpoint-normal.yaml named endpoint-conflict, changing its discoverable endpoint name from catalog-api to foreign-api. Confirm reconciliation reports a Service conflict, then run kubectl get service foreign-api -n "$NAMESPACE" -o yaml > after.yaml && diff -u before.yaml after.yaml and confirm there is no diff.

Common Test Scenarios

• Deploy Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete — upstream pin pending
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated
• Automated dependency-license check passes (currently blocked by missing ClearlyDefined records)

Local validation: 83 solver tests passed, including the race check; full make test, build, vet, lint, formatting, license headers, and tidy/vendor consistency passed.

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

🐳 New images available:

• quay.io/eclipse/che-operator:pr-2220-amd64
• quay.io/eclipse/che-operator:pr-2220-arm64
• quay.io/eclipse/eclipse-che-olm-catalog:pr-2220-amd64
• quay.io/eclipse/eclipse-che-olm-catalog:pr-2220-arm64