eclipse-che · gtrivedi88 · Jul 27, 2026
@@ -7,25 +7,27 @@
 ** xref:running-at-scale.adoc[]
 ** xref:installing-the-chectl-management-tool.adoc[]
 // Installing
-* xref:installing-che.adoc[]
-** Deploy on OpenShift
-*** xref:proc_installing-che-on-openshift-using-cli.adoc[]
-*** xref:proc_installing-che-on-openshift-using-the-web-console.adoc[]
-*** xref:proc_installing-che-on-openshift-with-keycloak-as-oidc.adoc[]
-** Deploy on {kubernetes}
-*** xref:installing-che-on-microsoft-azure.adoc[]
-*** xref:installing-che-on-amazon-elastic-kubernetes-service.adoc[]
-*** xref:proc_installing-che-on-the-virtual-kubernetes-cluster.adoc[]
-** Deploy locally
-*** xref:proc_installing-che-on-red-hat-openshift-local.adoc[]
-*** xref:proc_installing-che-on-minikube.adoc[]
-*** xref:proc_installing-che-on-minikube-keycloak-oidc.adoc[]
-** Deploy in a restricted environment
-*** xref:proc_installing-che-in-a-restricted-environment.adoc[]
-** xref:using-chectl-to-configure-the-checluster-custom-resource-during-installation.adoc[]
-** Permissions
-*** xref:ref_permissions-to-install-che-on-openshift-using-cli.adoc[]
-*** xref:ref_permissions-to-install-che-on-openshift-using-the-web-console.adoc[]
+* Deploy using GitOps
+** xref:proc_deploying-che-using-gitops.adoc[]
+** xref:proc_deploying-che-using-gitops-in-a-restricted-environment.adoc[]
+* Deploy on OpenShift
+** xref:proc_installing-che-on-openshift-using-cli.adoc[]
+** xref:proc_installing-che-on-openshift-using-the-web-console.adoc[]
+** xref:proc_installing-che-on-openshift-with-keycloak-as-oidc.adoc[]
+* Deploy on {kubernetes}
+** xref:installing-che-on-microsoft-azure.adoc[]
+** xref:installing-che-on-amazon-elastic-kubernetes-service.adoc[]
+** xref:proc_installing-che-on-the-virtual-kubernetes-cluster.adoc[]
+* Deploy locally
+** xref:proc_installing-che-on-red-hat-openshift-local.adoc[]
+** xref:proc_installing-che-on-minikube.adoc[]
+** xref:proc_installing-che-on-minikube-keycloak-oidc.adoc[]
+* Deploy in a restricted environment
+** xref:proc_installing-che-in-a-restricted-environment.adoc[]
+* xref:using-chectl-to-configure-the-checluster-custom-resource-during-installation.adoc[]
+* Permissions
+** xref:ref_permissions-to-install-che-on-openshift-using-cli.adoc[]
+** xref:ref_permissions-to-install-che-on-openshift-using-the-web-console.adoc[]
 * xref:proc_verifying-the-installation.adoc[]
 * xref:proc_finding-the-fully-qualified-domain-name-fqdn.adoc[]
 * xref:con_next-steps-after-installation.adoc[]

@@ -11,6 +11,8 @@
 [role="_abstract"]
 Size your cluster by calculating the CPU and memory requirements for the {prod-short} Operator, {devworkspace} Controller, and user workspaces so that your cluster can handle the expected number of concurrent users.
 
+include::partial$snip_persona-admin.adoc[]
+
 The {prod-short} Operator, {devworkspace} Controller, and user workspaces consist of a set of pods.
 The pods contribute to the resource consumption in CPU and memory limits and requests.
 

@@ -9,28 +9,36 @@
 [role="_abstract"]
 {prod-short} deploys on {orch-name} as an Operator that manages a gateway, dashboard, server, and plug-in registry. The installation method you choose depends on your cluster environment and need for configuration control.
 
+include::partial$snip_persona-admin.adoc[]
+
 {prod-short} consists of an Operator, a user dashboard, a gateway, and a plug-in registry. The Operator manages the full lifecycle of all server components. You deploy {prod-short} by installing the Operator and creating a `CheCluster` custom resource.
 
 == Installation methods
 
+Argo CD (GitOps):: Store the Operator subscription and `CheCluster` configuration in a Git repository and let Argo CD reconcile the deployment. Choose this method for production deployments where every configuration change must be tracked in Git, auditable, and automatically reconciled.
+
 `{prod-cli}` command-line tool:: Choose this method when you need to quickly deploy {prod-short} for evaluation, customize the `CheCluster` configuration during installation, or manage {prod-short} from scripts.
 
 {orch-name} web console:: Choose this method when you prefer a graphical workflow through OperatorHub and do not need advanced configuration options during deployment.
 
-Both methods produce the same result: an Operator subscription and a `CheCluster` custom resource. For step-by-step deployment instructions, see Additional resources.
+All methods produce the same result: an Operator subscription and a `CheCluster` custom resource. For step-by-step deployment instructions, see Additional resources.
 
 == Deployment scenarios
 
-Standard deployment:: Your {orch-name} cluster has internet access. Both installation methods are available. The Operator pulls container images directly from `registry.redhat.io`.
+Standard deployment:: Your {orch-name} cluster has internet access. All installation methods are available. The Operator pulls container images directly from `registry.redhat.io`.
+
+GitOps deployment:: Your organization manages cluster configuration declaratively through Argo CD. Store the Operator subscription and `CheCluster` configuration in a Git repository and let Argo CD reconcile the desired state. Available for both connected and air-gapped clusters.
 
-Air-gapped deployment:: Your cluster has no internet access. Mirror the required container images and Operator catalogs to a private registry before installation.
+Air-gapped deployment:: Your cluster has no internet access. Mirror the required container images and Operator catalogs to a private registry before installation. Both GitOps and CLI methods are available.
 
 External identity provider:: Your organization manages authentication through an existing identity system such as {keycloak}. Deploy {prod-short} with an external OIDC provider instead of the default {orch-name} OAuth.
 
 [role="_additional-resources"]
 .Additional resources
 
+* xref:proc_deploying-che-using-gitops.adoc[]
 * xref:proc_installing-che-on-openshift-using-cli.adoc[]
 * xref:proc_installing-che-on-openshift-using-the-web-console.adoc[]
+* xref:proc_deploying-che-using-gitops-in-a-restricted-environment.adoc[]
 * xref:proc_installing-che-in-a-restricted-environment.adoc[]
 * xref:proc_installing-che-on-openshift-with-keycloak-as-oidc.adoc[]
@@ -9,6 +9,8 @@
 [role="_abstract"]
 Prepare {prod-short} for your team by completing these configuration tasks before inviting developers: customize the `CheCluster` resource, connect Git providers for credential-free repository access, and verify end-to-end functionality with a first workspace.
 
+include::partial$snip_persona-admin.adoc[]
+
 * Verify the platform end-to-end, configure Git provider OAuth, and share the dashboard URL with developers. For a walkthrough of each verification step, see Additional resources.
 * Customize the `CheCluster` custom resource to adjust {prod-short} behavior for your environment. For field-by-field configuration guidance, see Additional resources.
 * Create your first cloud development environment from a Git repository URL. For a step-by-step workspace creation walkthrough, see Additional resources.

@@ -9,6 +9,8 @@
 [role="_abstract"]
 To provide cloud development environments on AWS, deploy {prod-short} on an Amazon EKS cluster by configuring DNS, TLS certificates, and Keycloak as the OIDC identity provider.
 
+include::partial$snip_persona-admin.adoc[]
+
 .Prerequisites
 
 * You have `helm` installed. See link:https://helm.sh/docs/intro/install/[Installing Helm].

@@ -9,6 +9,8 @@
 [role="_abstract"]
 To provide cloud development environments on Microsoft Azure, deploy {prod-short} on an AKS cluster by configuring DNS, TLS certificates, and Keycloak as the OIDC identity provider.
 
+include::partial$snip_persona-admin.adoc[]
+
 .Prerequisites
 
 * You have `helm` installed. See link:https://helm.sh/docs/intro/install/[Installing Helm].

@@ -11,6 +11,8 @@
 [role="_abstract"]
 Set up `{prod-cli}` on Linux, macOS, or Windows so that you can deploy, update, and manage {prod-short} from the command line.
 
+include::partial$snip_persona-admin.adoc[]
+
 include::example$proc_{project-context}-installing-the-chectl-management-tool-on-windows.adoc[leveloffset=+1]
 
 include::example$proc_{project-context}-installing-the-chectl-management-tool-on-linux-or-macos.adoc[leveloffset=+1]

@@ -0,0 +1,239 @@
+:_content-type: PROCEDURE
+:description: Deploy {prod-short} in a restricted network through Argo CD by mirroring the required container images to a private registry and storing the deployment manifests in an internal Git repository.
+:keywords: install, gitops, argo cd, air-gapped, restricted, disconnected
+:navtitle: Deploy in a restricted environment using GitOps
+
+[id="deploying-che-using-gitops-in-a-restricted-environment"]
+= Deploy in a restricted environment using GitOps
+
+[role="_abstract"]
+Deploy {prod-short} in a restricted network through Argo CD by mirroring the required container images to a private registry and storing the deployment manifests in an internal Git repository.
+
+include::partial$snip_persona-admin.adoc[]
+
+In a disconnected environment, the cluster cannot pull images from public registries or sync from external Git repositories. You mirror the required images to an internal registry, store the {prod-short} manifests in an internal Git repository, and let Argo CD reconcile the deployment from inside the network.
+
+.Prerequisites
+
+* You have a {kubernetes} or {orch-name} cluster operating on a restricted network with administrative access.
+
+* You have mirrored the required {prod-short} container images and Operator catalogs to a private registry. See xref:proc_installing-che-in-a-restricted-environment.adoc[].
+
+* You have an `ImageContentSourcePolicy` or `ImageDigestMirrorSet` configured to redirect image pulls to your private registry.
+
+* You have Argo CD installed on the cluster. See link:https://argo-cd.readthedocs.io/en/stable/getting_started/[Argo CD Getting Started].
+
+* You have an active `{orch-cli}` session with administrative permissions to the cluster.
+
+* You have an internal Git repository accessible from the cluster.
+
+.Procedure
+
+. Download and execute the mirroring script to install a custom Operator catalog and mirror the related images: xref:administration-guide:attachment$restricted-environment/prepare-restricted-environment.sh[prepare-restricted-environment.sh].
++
+[source,bash,subs="+attributes,+quotes"]
+----
+$ bash prepare-restricted-environment.sh \
+  --devworkspace_operator_index {devworkspace-operator-index-disconnected-install}\
+  --devworkspace_operator_version "v{devworkspace-operator-version-patch}" \
+  --prod_operator_index "{prod-operator-index}" \
+  --prod_operator_package_name "{prod-operator-package-name}" \
+  --prod_operator_bundle_name "{prod-operator-bundle-name}" \
+  --prod_operator_version "v{prod-ver-patch}" \
+  --my_registry "__<my_registry>__" <1>
+----
+<1> The private Docker registry where the images will be mirrored
+
+. In your internal Git repository, create a directory for the {prod-short} manifests with three files: the Operator subscription, the `CheCluster` custom resource, and a Kustomize configuration.
++
+.Repository structure
+[source,subs="+quotes"]
+----
+__<your-gitops-repo>__/
+└── che/
+    ├── subscription.yaml
+    ├── checluster.yaml
+    └── kustomization.yaml
+----
+
+. Create the `subscription.yaml` file with the namespace and Operator subscription pointing to the disconnected catalog source:
++
+[source,yaml,subs="+attributes,+quotes"]
+----
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {prod-namespace}
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: {prod-operator-package-name}
+  namespace: openshift-operators
+spec:
+  channel: {prod-stable-channel}
+  installPlanApproval: Automatic
+  name: {prod-operator-package-name}
+  source: {prod-operator-package-name}-disconnected-install
+  sourceNamespace: openshift-marketplace
+----
++
+The `source` field points to the disconnected catalog source created by the mirroring script.
+
+. Create the `checluster.yaml` file with the {prod-short} instance configuration pointing to your private registry:
++
+[source,yaml,subs="+attributes,+quotes"]
+----
+apiVersion: org.eclipse.che/v2
+kind: CheCluster
+metadata:
+  name: {prod-checluster}
+  namespace: {prod-namespace}
+spec:
+  components:
+    cheServer:
+      debug: false
+      logLevel: INFO
+    metrics:
+      enable: true
+    pluginRegistry:
+      openVSXURL: ""
+  containerRegistry:
+    hostname: __<your-private-registry>__
+    organization: __<your-registry-organization>__
+  devEnvironments:
+    startTimeoutSeconds: 600
+    defaultEditor: che-incubator/che-code/latest
+    defaultNamespace:
+      autoProvision: true
+      template: <username>-{prod-id-short}
+    storage:
+      pvcStrategy: per-user
+----
++
+`containerRegistry.hostname`:: The hostname of your private container registry that holds the mirrored images.
+`containerRegistry.organization`:: The organization or project path in your private registry.
+`pluginRegistry.openVSXURL`:: Set to an empty string to disable external Open VSX access. Use an internal Open VSX instance if IDE extensions are required.
+`startTimeoutSeconds`:: Increased to 600 seconds to allow for slower image pulls from internal registries.
+
+. Create the `kustomization.yaml` file:
++
+[source,yaml]
+----
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - subscription.yaml
+  - checluster.yaml
+----
+
+. Commit and push the files to your internal Git repository.
+
+. Grant the Argo CD service account the permissions required to create namespaces and install Operators:
++
+[source,bash,subs="+attributes,+quotes"]
+----
+$ {orch-cli} apply -f - <<EOF
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-cluster-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-application-controller
+    namespace: argocd
+EOF
+----
++
+Adjust the `ServiceAccount` name and {orch-namespace} to match your Argo CD installation.
+
+. Create the Argo CD `Application` resource that points to your internal Git repository:
++
+[source,bash,subs="+attributes,+quotes"]
+----
+$ {orch-cli} apply -f - <<EOF
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {prod-id-short}
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: __<your-internal-git-repo-url>__
+    targetRevision: main
+    path: che
+  destination:
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    retry:
+      limit: 10
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      - SkipDryRunOnMissingResource=true
+EOF
+----
+
+. Wait for Argo CD to sync the resources. In a restricted environment, the Operator installation takes longer because images are pulled from the internal registry.
+
+.Verification
+
+. Verify that the Argo CD Application reports `Synced` and `Healthy`:
++
+[source,bash,subs="+attributes"]
+----
+$ {orch-cli} get application {prod-id-short} -n argocd \
+    -o jsonpath='{.status.sync.status}{" "}{.status.health.status}'
+----
++
+Expected output: `Synced Healthy`
+
+. Verify that the `CheCluster` is active:
++
+[source,bash,subs="+attributes"]
+----
+$ {orch-cli} get checluster {prod-checluster} -n {prod-namespace} \
+    -o jsonpath='{.status.chePhase}'
+----
++
+Expected output: `Active`
+
+. Retrieve the {prod-short} dashboard URL and open it in a browser:
++
+[source,bash,subs="+attributes"]
+----
+$ {orch-cli} get checluster {prod-checluster} -n {prod-namespace} \
+    -o jsonpath='{.status.cheURL}'
+----
+
+.Troubleshooting
+
+* *Image pull errors*: Verify that all required images are mirrored to your private registry and that the `ImageContentSourcePolicy` or `ImageDigestMirrorSet` is configured correctly.
+
+* *Sync fails with "CheCluster CRD not found"*: Verify that the Argo CD Application includes `SkipDryRunOnMissingResource=true` in the `syncOptions`.
+
+* *Sync retries but CheCluster is not created*: The Operator may still be installing. Wait for the ClusterServiceVersion to reach `Succeeded`:
++
+[source,bash,subs="+attributes"]
+----
+$ {orch-cli} get csv -A | grep {prod-operator-package-name}
+----
+
+.Additional resources
+
+* xref:proc_deploying-che-using-gitops.adoc[]
+* xref:proc_installing-che-in-a-restricted-environment.adoc[]
+* link:https://argo-cd.readthedocs.io/en/stable/getting_started/[Argo CD Getting Started]