Set workspace policies for all users

Set workspace limits, Git certificate trust, node scheduling, allowed URLs, and container capabilities that apply to every developer on the platform.

Workspace policies are cluster-wide settings in the CheCluster custom resource that override individual developer preferences. They take effect immediately for new workspaces and on next restart for running workspaces.

What you can control

  • Resource limits: Cap the number of workspaces each developer can keep, and limit how many workspaces can run simultaneously across the cluster. These policies prevent resource exhaustion on shared infrastructure.
  • Security and trust: Inject self-signed Git server certificates so workspaces can clone from enterprise Git hosts over TLS. Restrict which repository URLs are allowed to create workspaces, blocking untrusted sources. Grant container capabilities for nested container builds when required.
  • Scheduling and placement: Control which nodes run workspace pods using node selectors and tolerations. Use this to isolate developer workloads on dedicated nodes or specific availability zones.

Where policies are defined

All workspace policies are fields in the CheCluster custom resource under spec.devEnvironments. Changes applied with oc patch or through the OpenShift web console take effect without restarting the Dev Spaces server.