Scale OpenShift Dev Spaces in air-gapped environments

Summary

Scaling OpenShift Dev Spaces in air-gapped environments requires addressing four friction points: third-party monitoring agents, rootless container runtimes, custom install namespaces, and admission webhooks. Dynatrace OneAgent sidecar conflicts are resolved by labeling all Dev Spaces namespaces with dynatrace.com/inject: “false” to prevent init container injection. Rootless Podman inside workspace pods needs user namespace UID/GID ranges respecting a 65,536 UID ceiling; UDI 3.22 requires a manual script with a corrected range, while UDI 3.26 handles mapping automatically. Stale admission webhooks from a previous operator install namespace must be manually deleted before reinstalling into a different namespace to avoid conflicting definitions. A readiness checklist includes mirroring operator catalogs, deploying an internal Open VSX server with PostgreSQL, configuring PKI trust via ConfigMap, and disabling the default devfile registry.

Takeaways

1. 1

   Dynatrace OneAgent sidecar conflicts with OpenShift Dev Spaces workspace pods can be resolved by labeling all relevant namespaces with dynatrace.com/inject: “false” to prevent init container injection.

2. 2

   Rootless Podman inside workspace pods requires careful user namespace UID/GID range configuration; the hard ceiling of 65,536 UIDs means old scripts using large ranges (e.g., 2,147,483,646) fail, and the fix depends on the UDI image version.

3. 3

   When reinstalling the OpenShift Dev Spaces Operator into a different namespace, stale ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from the previous install must be manually deleted to avoid conflicting webhook definitions.

FAQ