Control which extensions users can install

Control Code - OSS extension installation by using a ConfigMap. Enforce a fine-grained allow or deny list by using the AllowedExtensions policy.

You can also block installs through the CLI, default extensions, and the workbench.extensions.command.installFromVSIX API command. The following properties are supported:

  • BlockCliExtensionsInstallation — when enabled, blocks installation of extensions through the CLI.

  • BlockDefaultExtensionsInstallation — when enabled, blocks installation of default extensions. See Preinstall extensions in every workspace.

  • BlockInstallFromVSIXCommandExtensionsInstallation — when enabled, blocks installation of extensions through the workbench.extensions.command.installFromVSIX API command.

  • AllowedExtensions — provides fine-grained control over Code - OSS extension installation. When this policy is applied, already installed extensions that are not allowed are disabled and display a warning. For conceptual background, see Configure allowed extensions.

Prerequisites

  • An active kubectl session with administrative permissions to the Kubernetes cluster. See Overview of kubectl.

Procedure

  1. Add a new ConfigMap to the eclipse-che namespace and specify the properties you want to add:

    kind: ConfigMap
apiVersion: v1
metadata:
  name: vscode-editor-configurations
  namespace: eclipse-che
  labels:
    app.kubernetes.io/component: workspaces-config
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /checode-config
    controller.devfile.io/read-only: 'true'
data:
  policy.json: |
    {
      "BlockCliExtensionsInstallation": true,
      "BlockDefaultExtensionsInstallation": true,
      "BlockInstallFromVSIXCommandExtensionsInstallation": true,
      "AllowedExtensions": {
          "*": true,
          "dbaeumer.vscode-eslint": false,
          "ms-python.python": false,
          "redhat": false
       }
    }

    Ensure that the ConfigMap contains data in a valid JSON format.

  2. Optional: To completely disable extension installation instead of using fine-grained control, set all extensions to disallowed:

    kind: ConfigMap
apiVersion: v1
metadata:
  name: vscode-editor-configurations
  namespace: eclipse-che
  labels:
    app.kubernetes.io/component: workspaces-config
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /checode-config
    controller.devfile.io/read-only: 'true'
data:
  policy.json: |
    {
      "AllowedExtensions": {
        "*": false
      }
    }

  3. Start or restart your workspace.

  4. Optional: Add the ConfigMap in the user’s namespace:

    kind: ConfigMap
apiVersion: v1
metadata:
  name: vscode-editor-configurations
  labels:
    controller.devfile.io/mount-to-devworkspace: 'true'
    controller.devfile.io/watch-configmap: 'true'
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /checode-config
    controller.devfile.io/read-only: 'true'
data:
  policy.json: |
    {
      "AllowedExtensions": {
          "*": false
       }
    }

    When the ConfigMap is stored in the user’s namespace, the user can edit its values.
Verification

  1. Verify that the BlockCliExtensionsInstallation property is applied:

    • Press F1, select Preferences: Open Settings (UI), and enter BlockCliExtensionsInstallation in search.

    • Provide a .vsix file and try CLI install. The installation fails with "Installation of extensions via CLI has been blocked by an administrator".

  2. Verify that the BlockDefaultExtensionsInstallation property is applied:

    • Check Settings for the property.

    • Configure default extensions and verify they are not installed on workspace start or restart.

  3. Verify that the BlockInstallFromVSIXCommandExtensionsInstallation property is applied:

    • Check Settings for the property.

    • The workbench.extensions.command.installFromVSIX API command is blocked.

  4. Verify that rules defined in the AllowedExtensions section are applied:

    • Check Settings → extensions.allowed.

    • Disallowed extensions display a "This extension cannot be installed because it is not in the allowed list" warning.

Additional resources