Set up network access for workspaces

Set up network policies, TLS certificates, custom hostnames, and proxy settings so that OpenShift Dev Spaces workspaces communicate securely within your network environment.

By default, OpenShift Dev Spaces auto-detects the cluster domain, generates a self-signed TLS certificate, and allows all workspace pods to communicate freely across namespaces. The procedures in this section override those defaults to match your organization's network requirements.

What you can configure

  • TLS certificates: Import your corporate CA chain so the server, dashboard, and workspaces trust connections to proxies, identity providers, and Git hosts. You can also deploy with your own self-signed certificate instead of the auto-generated one.
  • Custom hostnames and domains: Replace the default cluster-assigned URLs with corporate DNS names for the dashboard and workspace endpoints. Use router sharding when Dev Spaces shares an ingress controller with other applications.
  • Proxy routing: Route all outbound traffic through an HTTP/HTTPS proxy. Dev Spaces propagates proxy settings to server components and workspace containers through environment variables.
  • Network isolation: Apply OpenShift NetworkPolicy resources to restrict pod-to-pod traffic between user namespaces. By default, any pod can reach any other pod across namespaces.

When to configure networking

Configure these settings after installation and before onboarding developers. TLS and proxy settings affect all workspaces; changes require a workspace restart to take effect in existing sessions.