---
title: "Configure Red Hat OpenShift Dev Spaces for enterprise security"
description: "Red Hat OpenShift Dev Spaces can be hardened for enterprise use by centralizing SCM authentication with OAuth, deploying a private OpenVSX extension registry, and enabling IntelliJ IDEA in restricted networks. The SCM integration uses a dedicated OAuth application and the scm-oauth-config Secret in the operator namespace, while disabling the default CA bundle mount reduces etcd overhead but requires an explicit corporate CA ConfigMap with keys ca.crt and githost to prevent TLS failures. A private OpenVSX registry with PostgreSQL-only architecture replaces external extensions, and automated governance rejects prereleases, timestamp builds, oversized patches, and previews through version-aware dependency resolution and idempotent publication tracking. For JetBrains support in air-gapped clusters, administrators mirror IDE tarballs to an internal repository and set editorsDownloadUrls; developers connect via JetBrains Gateway using either dashboard- or gateway-initiated workflows, both relying on an existing oc login session. This configuration gives platform teams oversight of authentication, extensions, and IDE tooling."
---

# Configure Red Hat OpenShift Dev Spaces for enterprise security

[Red Hat](https://yomu.fyi/company/red-hat) · Ajay Kanse · Oct 14, 2026

**Type:** Tutorial

## Summary

Red Hat OpenShift Dev Spaces can be hardened for enterprise use by centralizing SCM authentication with OAuth, deploying a private OpenVSX extension registry, and enabling IntelliJ IDEA in restricted networks. The SCM integration uses a dedicated OAuth application and the scm-oauth-config Secret in the operator namespace, while disabling the default CA bundle mount reduces etcd overhead but requires an explicit corporate CA ConfigMap with keys ca.crt and githost to prevent TLS failures. A private OpenVSX registry with PostgreSQL-only architecture replaces external extensions, and automated governance rejects prereleases, timestamp builds, oversized patches, and previews through version-aware dependency resolution and idempotent publication tracking. For JetBrains support in air-gapped clusters, administrators mirror IDE tarballs to an internal repository and set editorsDownloadUrls; developers connect via JetBrains Gateway using either dashboard- or gateway-initiated workflows, both relying on an existing oc login session. This configuration gives platform teams oversight of authentication, extensions, and IDE tooling.

## Context

Follow-up guide to ‘Build a multi-tenant platform with OpenShift Dev Spaces’, focusing on security hardening for enterprise environments.

## Approach / What changed

Centralize SCM authentication via OAuth and explicit CA trust, replace external extension registry with air-gapped OpenVSX using PostgreSQL, enforce automated publishing governance, and enable JetBrains IDEs by mirroring binaries and configuring editorsDownloadUrls.

## Takeaways

- Disabling the default CA bundle mount via disableWorkspaceCaBundleMount: true reduces etcd overhead but requires an explicit corporate CA ConfigMap with ca.crt and githost keys to prevent TLS handshake failures.
- An internal OpenVSX registry with PostgreSQL-only architecture and automated governance can enforce extension approval by rejecting prereleases, timestamp builds, oversized patch versions, and previews, with idempotent publication tracking.
- Enabling JetBrains IntelliJ IDEA in air-gapped clusters requires mirroring the IDE binary to an internal artifact repository and setting editorsDownloadUrls in the CheCluster CR, with developers connecting via JetBrains Gateway using an existing oc login session.

## FAQ

### What is the trade-off of setting disableWorkspaceCaBundleMount to true?

It stops the default per-namespace CA bundle mount, reducing etcd overhead, but workspaces depend entirely on the static contents of your corporate CA ConfigMap. When certificates rotate, the ConfigMap must be manually updated and workspaces restarted.

### How does the automated publishing governance filter extensions?

It rejects versions with prerelease identifiers (like -beta), timestamp-like patch components (8+ digits), oversized patch numbers (>999), and package.json preview flags. Dependency resolution ensures required dependencies are published first, and idempotent tracking prevents re-publishing.

### What authentication does JetBrains Gateway use to connect to workspaces?

JetBrains Gateway reads an existing authenticated session from the local oc login against the OpenShift cluster. No separate token entry is required; the Gateway provider plug-in uses the OpenShift client configuration.

**Tags:** [IntelliJ IDEA](https://yomu.fyi/topic/intellij-idea), [Kubernetes](https://yomu.fyi/topic/kubernetes), [Red Hat OpenShift](https://yomu.fyi/topic/red-hat-openshift), [Security](https://yomu.fyi/topic/security)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/10/14/configure-red-hat-openshift-dev-spaces-enterprise-security)
- Source URL: https://developers.redhat.com/articles/2026/10/14/configure-red-hat-openshift-dev-spaces-enterprise-security
- Ingested by Yomu: 2026-10-14T15:00:13.579Z

[Read original post](https://developers.redhat.com/articles/2026/10/14/configure-red-hat-openshift-dev-spaces-enterprise-security)