feat: add configurable field-level restrictions for container and pod overrides (#1653)

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

Author: tolusha

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -146,6 +146,24 @@ type RoutingConfig struct {
 	TLSCertificateConfigmapRef *ConfigmapReference `json:"tlsCertificateConfigmapRef,omitempty"`
 }
 
+// OverrideConfig defines configuration options for controlling which fields are restricted
+// in `container-overrides` and `pod-overrides` DevWorkspace attributes.
+// Entries support value-level restrictions: "fieldName" restricts the field entirely,
+// while "fieldName=value" restricts only that specific value (other values remain allowed).
+type OverrideConfig struct {
+	// RestrictedContainerOverrideFields defines a list of container-level fields that are restricted
+	// in `container-overrides` attributes. Note that the following fields are always implicitly
+	// restricted and cannot be permitted: `name`, `image`, `command`, `args`, `ports`, `env`.
+	// +kubebuilder:validation:Optional
+	RestrictedContainerOverrideFields []string `json:"restrictedContainerOverrideFields,omitempty"`
+
+	// RestrictedPodOverrideFields defines a list of pod-level fields that are restricted
+	// in `pod-overrides` attributes. Note that the following fields are always implicitly
+	// restricted and cannot be permitted: `containers`, `initContainers`.
+	// +kubebuilder:validation:Optional
+	RestrictedPodOverrideFields []string `json:"restrictedPodOverrideFields,omitempty"`
+}
+
 type WorkspaceConfig struct {
 	// ProjectCloneConfig defines configuration related to the project clone init container
 	// that is used to clone git projects into the DevWorkspace.
@@ -264,6 +282,9 @@ type WorkspaceConfig struct {
 	// InitContainers defines a list of Kubernetes init containers that are automatically injected into all workspace pods.
 	// Typical uses cases include injecting organization tools/configs, initializing persistent home, etc.
 	InitContainers []corev1.Container `json:"initContainers,omitempty"`
+	// Overrides defines configuration options for `container-overrides` and
+	// `pod-overrides` DevWorkspace attributes.
+	Overrides *OverrideConfig `json:"overrides,omitempty"`
 }
 
 type WebhookConfig struct {

apis/controller/v1alpha1/zz_generated.deepcopy.go

@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"github.com/devfile/devworkspace-operator/pkg/library/initcontainers"
+	"github.com/devfile/devworkspace-operator/pkg/library/overrides"
 	"github.com/devfile/devworkspace-operator/pkg/library/ssh"
 
 	dw "github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2"
@@ -338,6 +339,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		workspace.Config.Workspace.DefaultContainerResources,
 		workspace.Config.Workspace.ContainerResourceCaps,
 		workspace.Config.Workspace.PostStartTimeout,
+		overrides.GetRestrictedContainerOverrideFields(workspace),
 		postStartDebugTrapSleepDuration,
 	)
 	if err != nil {

controllers/workspace/devworkspace_controller.go

@@ -310,3 +310,94 @@ config:
 ### Execution Order
 
 Custom init containers are injected after the project-clone init container in the order they are defined in the configuration. The `init-persistent-home` container runs in this sequence along with other custom init containers.
+
+## Always-restricted override fields
+
+Regardless of configuration, certain fields are **always** rejected in overrides and
+cannot be unblocked by any configuration change.
+
+**Container overrides:** `name`, `image`, `command`, `args`, `ports`, `env`
+
+**Pod overrides:** `containers`, `initContainers`
+
+These implicit restrictions exist separately from the configurable restricted fields
+described below.
+
+## Restricting override fields
+
+The DevWorkspace Operator allows cluster administrators to restrict which fields
+can be set via `pod-overrides` and `container-overrides` attributes.
+
+The restrict list supports two formats:
+
+- `"fieldName"` -- restricts the field entirely, regardless of value
+- `"fieldName=value"` -- restricts only a specific value for the field
+
+For nested fields such as securityContext or volumes, use dot notation: `securityContext.privileged=true`.
+
+On Kubernetes, the operator ships with default restricted fields that align
+with the Pod Security Standards baseline profile.
+On OpenShift, no fields are restricted by default since Security Context Constraints (SCC)
+already enforce security policies at the admission level.
+
+**Important:** Configuring `restrictedContainerOverrideFields` or `restrictedPodOverrideFields`
+**replaces** the platform defaults entirely. Admins who want to extend the default
+restrict list must re-include the default entries alongside any additional restrictions.
+
+**Limitation for plain boolean fields in pod overrides:**
+Some `PodSpec` fields such as `hostNetwork`, `hostPID`, and `hostIPC` are plain `bool`
+types in the Kubernetes API (not `*bool` pointers). Because Go zero-initializes
+unset `bool` fields to `false`, the operator cannot distinguish between a field that
+was explicitly set to `false` and one that was simply omitted. As a result, using the
+bare field name format (e.g. `"hostNetwork"`) to restrict these fields entirely will reject
+**all** pod overrides, including those that never mention the field. To avoid this,
+use the value-specific format instead (e.g. `"hostNetwork=true"`). The default restricted
+fields already follow this pattern. This limitation does not affect `*bool` pointer
+fields (e.g. `automountServiceAccountToken`, `shareProcessNamespace`, `hostUsers`)
+or non-boolean fields.
+
+For example, on Kubernetes, to add `volumeMounts` and `lifecycle` restrictions
+while keeping the default restricted container fields:
+
+```yaml
+apiVersion: controller.devfile.io/v1alpha1
+kind: DevWorkspaceOperatorConfig
+metadata:
+  name: devworkspace-operator-config
+config:
+  workspace:
+    overrides:
+      restrictedContainerOverrideFields:
+        # Default Kubernetes restricted fields (must be re-listed to retain them)
+        - "securityContext.privileged=true"
+        - "securityContext.runAsNonRoot=false"
+        - "securityContext.runAsUser=0"
+        - "securityContext.allowPrivilegeEscalation=true"
+        - "securityContext.procMount=Unmasked"
+        - "securityContext.capabilities.add"
+        # Additional restrictions
+        - "volumeMounts"
+        - "lifecycle"
+```
+
+Similarly, to extend the default restricted pod override fields on Kubernetes:
+
+```yaml
+apiVersion: controller.devfile.io/v1alpha1
+kind: DevWorkspaceOperatorConfig
+metadata:
+  name: devworkspace-operator-config
+config:
+  workspace:
+    overrides:
+      restrictedPodOverrideFields:
+        # Default Kubernetes restricted fields (must be re-listed to retain them)
+        - "hostNetwork=true"
+        - "hostPID=true"
+        - "hostIPC=true"
+        - "securityContext.runAsNonRoot=false"
+        - "securityContext.runAsUser=0"
+        - "volumes.hostPath"
+        # Additional restrictions
+        - "hostUsers=false"
+```