add auto-stop for idle workspaces

api/v1alpha1/operatorconfig_types.go

@@ -56,6 +56,9 @@ const (
 
 	// DefaultWorkspacePVCSize is the default PVC size for workspace storage
 	DefaultWorkspacePVCSize = "10Gi"
+
+	// DefaultAutoPauseTimeoutMinutes is the default idle timeout in minutes before a workspace is auto-paused
+	DefaultAutoPauseTimeoutMinutes int32 = 30
 )
 
 // ImagesConfig defines container image references used by the operator
@@ -351,6 +354,14 @@ type WorkspacesConfig struct {
 	// BuildCacheSize is the size of the PVC created for build cache persistence (default: "20Gi")
 	// +optional
 	BuildCacheSize string `json:"buildCacheSize,omitempty"`
+
+	// AutoPauseTimeoutMinutes is the cluster-wide default idle timeout in minutes before
+	// a workspace is automatically paused. Overridden per-workspace via spec.autoPauseTimeoutMinutes.
+	// Must be > 0. To disable auto-pause for a specific workspace, set its
+	// spec.autoPauseTimeoutMinutes to 0.
+	// Default: 30
+	// +optional
+	AutoPauseTimeoutMinutes int32 `json:"autoPauseTimeoutMinutes,omitempty"`
 }
 
 // GetToolchainImage returns the toolchain image, falling back to the default
@@ -406,6 +417,15 @@ func (c *WorkspacesConfig) GetTolerations() []corev1.Toleration {
 	return nil
 }
 
+// GetAutoPauseTimeoutMinutes returns the global auto-pause timeout in minutes.
+// Returns DefaultAutoPauseTimeoutMinutes (30) when not configured.
+func (c *WorkspacesConfig) GetAutoPauseTimeoutMinutes() int32 {
+	if c != nil && c.AutoPauseTimeoutMinutes > 0 {
+		return c.AutoPauseTimeoutMinutes
+	}
+	return DefaultAutoPauseTimeoutMinutes
+}
+
 // OperatorConfigSpec defines the desired state of OperatorConfig
 type OperatorConfigSpec struct {
 	// OSBuilds defines the configuration for OS build operations

api/v1alpha1/workspace_types.go

@@ -64,6 +64,14 @@ type WorkspaceSpec struct {
 	// When true, the controller deletes the pod but preserves the PVC.
 	// +optional
 	Stopped bool `json:"stopped,omitempty"`
+
+	// AutoPauseTimeoutMinutes overrides the global auto-pause timeout for this workspace.
+	// nil = use global default from OperatorConfig (default: 30 minutes)
+	// 0 = disable auto-pause for this workspace
+	// >0 = custom timeout in minutes
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	AutoPauseTimeoutMinutes *int32 `json:"autoPauseTimeoutMinutes,omitempty"`
 }
 
 // WorkspaceStatus defines the observed state of a Workspace.
@@ -85,6 +93,11 @@ type WorkspaceStatus struct {
 	// Created lazily on first build referencing this workspace.
 	// +optional
 	BuildCachePVCName string `json:"buildCachePVCName,omitempty"`
+
+	// LastActivityTime is the last time activity was detected in the workspace pod.
+	// Used by the auto-pause controller to determine idle duration.
+	// +optional
+	LastActivityTime *metav1.Time `json:"lastActivityTime,omitempty"`
 }
 
 // +kubebuilder:object:root=true

cmd/caib/workspace/workspace.go

@@ -50,6 +50,9 @@ var (
 	// wait flag (shared by create and start)
 	waitForRunningFlag bool
 
+	// auto-pause flag
+	autoPauseTimeout int
+
 	// deploy flags
 	artifactMappings []string
 )
@@ -126,6 +129,7 @@ Examples:
 	cmd.Flags().StringVar(&cpuRequest, "cpu", "", "CPU request/limit (e.g., \"1\", \"500m\")")
 	cmd.Flags().StringVar(&memoryRequest, "memory", "", "memory request/limit (e.g., \"2Gi\", \"512Mi\")")
 	cmd.Flags().BoolVar(&tmpfsBuildDir, "tmpfs", false, "mount a tmpfs volume at /tmp/build for faster compilation (uses RAM)")
+	cmd.Flags().IntVar(&autoPauseTimeout, "auto-pause-timeout", -1, "auto-pause timeout in minutes (0=disable, -1=use global default)")
 	cmd.Flags().BoolVarP(&waitForRunningFlag, "wait", "w", true, "wait for workspace to be running")
 
 	return cmd
@@ -290,6 +294,13 @@ func runCreate(_ *cobra.Command, args []string) {
 		Memory:        memoryRequest,
 		TmpfsBuildDir: tmpfsBuildDir,
 	}
+	if autoPauseTimeout < -1 {
+		handleError(fmt.Errorf("--auto-pause-timeout must be >= -1"))
+	}
+	if autoPauseTimeout >= 0 {
+		v := int32(autoPauseTimeout)
+		req.AutoPauseTimeoutMinutes = &v
+	}
 
 	var resp *buildapitypes.WorkspaceResponse
 	err = caibcommon.ExecuteWithReauth(serverURL, &authToken, insecureSkipTLS, func(client *buildapiclient.Client) error {
@@ -381,6 +392,10 @@ func runShow(_ *cobra.Command, args []string) {
 	if ws.Age != "" {
 		fmt.Printf("Age:          %s\n", ws.Age)
 	}
+	fmt.Printf("Auto-pause:   %s\n", ws.AutoPauseTimeout)
+	if ws.LastActivity != "" {
+		fmt.Printf("Last active:  %s\n", ws.LastActivity)
+	}
 }
 
 func runDelete(_ *cobra.Command, args []string) {

cmd/main.go

@@ -281,9 +281,10 @@ func main() {
 		}
 
 		workspaceReconciler := &workspace.Reconciler{
-			Client: mgr.GetClient(),
-			Scheme: mgr.GetScheme(),
-			Log:    ctrl.Log.WithName("controllers").WithName("Workspace"),
+			Client:     mgr.GetClient(),
+			Scheme:     mgr.GetScheme(),
+			Log:        ctrl.Log.WithName("controllers").WithName("Workspace"),
+			RestConfig: mgr.GetConfig(),
 		}
 		if err = workspaceReconciler.SetupWithManager(mgr); err != nil {
 			setupLog.Error(err, "unable to create controller", "controller", "Workspace")

config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yaml

@@ -823,6 +823,15 @@ spec:
               workspaces:
                 description: Workspaces defines configuration for developer workspaces
                 properties:
+                  autoPauseTimeoutMinutes:
+                    description: |-
+                      AutoPauseTimeoutMinutes is the cluster-wide default idle timeout in minutes before
+                      a workspace is automatically paused. Overridden per-workspace via spec.autoPauseTimeoutMinutes.
+                      Must be > 0. To disable auto-pause for a specific workspace, set its
+                      spec.autoPauseTimeoutMinutes to 0.
+                      Default: 30
+                    format: int32
+                    type: integer
                   buildCacheSize:
                     description: 'BuildCacheSize is the size of the PVC created for
                       build cache persistence (default: "20Gi")'

config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yaml

@@ -59,6 +59,15 @@ spec:
                 description: Architecture is the target architecture (e.g., "arm64",
                   "amd64")
                 type: string
+              autoPauseTimeoutMinutes:
+                description: |-
+                  AutoPauseTimeoutMinutes overrides the global auto-pause timeout for this workspace.
+                  nil = use global default from OperatorConfig (default: 30 minutes)
+                  0 = disable auto-pause for this workspace
+                  >0 = custom timeout in minutes
+                format: int32
+                minimum: 0
+                type: integer
               clientConfigSecretRef:
                 description: |-
                   ClientConfigSecretRef is the name of the Secret containing the Jumpstarter client config
@@ -169,6 +178,12 @@ spec:
                   BuildCachePVCName is the name of the PVC used for build cache storage.
                   Created lazily on first build referencing this workspace.
                 type: string
+              lastActivityTime:
+                description: |-
+                  LastActivityTime is the last time activity was detected in the workspace pod.
+                  Used by the auto-pause controller to determine idle duration.
+                format: date-time
+                type: string
               message:
                 description: Message provides additional detail about the current
                   phase

internal/buildapi/workspace.go

@@ -37,25 +37,28 @@ func shellQuote(s string) string {
 
 // WorkspaceRequest is the payload to create a workspace.
 type WorkspaceRequest struct {
-	Name          string `json:"name"`
-	FromBuild     string `json:"fromBuild,omitempty"` // ImageBuild name to extract lease from
-	Lease         string `json:"lease,omitempty"`     // Direct lease ID
-	Arch          string `json:"architecture,omitempty"`
-	Image         string `json:"toolchainImage,omitempty"`
-	ClientConfig  string `json:"clientConfig,omitempty"`  // Base64-encoded Jumpstarter client config
-	CPU           string `json:"cpu,omitempty"`           // CPU request (e.g., "1", "500m")
-	Memory        string `json:"memory,omitempty"`        // Memory request (e.g., "2Gi", "512Mi")
-	TmpfsBuildDir bool   `json:"tmpfsBuildDir,omitempty"` // Mount tmpfs at /tmp/build for fast compilation
+	Name                    string `json:"name"`
+	FromBuild               string `json:"fromBuild,omitempty"` // ImageBuild name to extract lease from
+	Lease                   string `json:"lease,omitempty"`     // Direct lease ID
+	Arch                    string `json:"architecture,omitempty"`
+	Image                   string `json:"toolchainImage,omitempty"`
+	ClientConfig            string `json:"clientConfig,omitempty"`            // Base64-encoded Jumpstarter client config
+	CPU                     string `json:"cpu,omitempty"`                     // CPU request (e.g., "1", "500m")
+	Memory                  string `json:"memory,omitempty"`                  // Memory request (e.g., "2Gi", "512Mi")
+	TmpfsBuildDir           bool   `json:"tmpfsBuildDir,omitempty"`           // Mount tmpfs at /tmp/build for fast compilation
+	AutoPauseTimeoutMinutes *int32 `json:"autoPauseTimeoutMinutes,omitempty"` // nil = use global default, 0 = disable
 }
 
 // WorkspaceResponse is returned by workspace operations.
 type WorkspaceResponse struct {
-	Name    string `json:"name"`
-	Phase   string `json:"phase"`
-	Lease   string `json:"lease,omitempty"`
-	Arch    string `json:"architecture"`
-	PodName string `json:"podName,omitempty"`
-	Age     string `json:"age,omitempty"`
+	Name             string `json:"name"`
+	Phase            string `json:"phase"`
+	Lease            string `json:"lease,omitempty"`
+	Arch             string `json:"architecture"`
+	PodName          string `json:"podName,omitempty"`
+	Age              string `json:"age,omitempty"`
+	AutoPauseTimeout string `json:"autoPauseTimeout,omitempty"` // e.g., "30m", "disabled"
+	LastActivity     string `json:"lastActivity,omitempty"`     // e.g., "2m ago", "just now"
 }
 
 // WorkspaceExecRequest is the payload to execute a command in a workspace.
@@ -283,16 +286,17 @@ func (a *APIServer) createWorkspace(c *gin.Context) {
 			Namespace: namespace,
 		},
 		Spec: automotivev1alpha1.WorkspaceSpec{
-			Architecture:          arch,
-			Image:                 image,
-			LeaseID:               leaseID,
-			Owner:                 requester,
-			ClientConfigSecretRef: jmpClientSecret,
-			PVCSize:               pvcSize,
-			Resources:             resources,
-			StorageClass:          wsConfig.GetStorageClass(),
-			NodeSelector:          wsConfig.GetNodeSelector(),
-			TmpfsBuildDir:         req.TmpfsBuildDir,
+			Architecture:            arch,
+			Image:                   image,
+			LeaseID:                 leaseID,
+			Owner:                   requester,
+			ClientConfigSecretRef:   jmpClientSecret,
+			PVCSize:                 pvcSize,
+			Resources:               resources,
+			StorageClass:            wsConfig.GetStorageClass(),
+			NodeSelector:            wsConfig.GetNodeSelector(),
+			TmpfsBuildDir:           req.TmpfsBuildDir,
+			AutoPauseTimeoutMinutes: req.AutoPauseTimeoutMinutes,
 		},
 	}
 	if err := k8sClient.Create(c.Request.Context(), ws); err != nil {
@@ -459,6 +463,24 @@ func (a *APIServer) getOwnedWorkspace(c *gin.Context, name string) (*automotivev
 	return ws, nil
 }
 
+// touchWorkspaceActivity updates LastActivityTime on the workspace status.
+// Called from handlers that represent actual workspace usage (exec, shell, sync, deploy)
+// so the auto-pause controller knows the workspace is in use.
+func (a *APIServer) touchWorkspaceActivity(c *gin.Context, ws *automotivev1alpha1.Workspace) {
+	if ws.Spec.Stopped {
+		return
+	}
+	k8sClient, err := getClientFromRequest(c)
+	if err != nil {
+		return // best-effort, don't fail the operation
+	}
+
+	now := metav1.Now()
+	patch := client.MergeFrom(ws.DeepCopy())
+	ws.Status.LastActivityTime = &now
+	_ = k8sClient.Status().Patch(c.Request.Context(), ws, patch)
+}
+
 func (a *APIServer) syncWorkspace(c *gin.Context, name string) {
 	ws, err := a.getOwnedWorkspace(c, name)
 	if err != nil {
@@ -468,6 +490,7 @@ func (a *APIServer) syncWorkspace(c *gin.Context, name string) {
 		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf("workspace %q is not running (phase: %s)", name, ws.Status.Phase)})
 		return
 	}
+	a.touchWorkspaceActivity(c, ws)
 
 	namespace := ws.Namespace
 	podName := ws.Status.PodName
@@ -590,6 +613,7 @@ func (a *APIServer) execWorkspace(c *gin.Context, name string) {
 		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf("workspace %q is not running (phase: %s)", name, ws.Status.Phase)})
 		return
 	}
+	a.touchWorkspaceActivity(c, ws)
 
 	restCfg, err := getRESTConfigFromRequest(c)
 	if err != nil {
@@ -618,6 +642,7 @@ func (a *APIServer) shellWorkspace(c *gin.Context, name string) {
 		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf("workspace %q is not running (phase: %s)", name, ws.Status.Phase)})
 		return
 	}
+	a.touchWorkspaceActivity(c, ws)
 
 	namespace := ws.Namespace
 	podName := ws.Status.PodName
@@ -744,6 +769,7 @@ func (a *APIServer) deployWorkspace(c *gin.Context, name string) {
 		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf("workspace %q is not running (phase: %s)", name, ws.Status.Phase)})
 		return
 	}
+	a.touchWorkspaceActivity(c, ws)
 
 	if ws.Spec.LeaseID == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "no Jumpstarter lease associated with this workspace"})
@@ -914,13 +940,35 @@ func workspaceResponseFromCR(ws *automotivev1alpha1.Workspace) WorkspaceResponse
 	if !ws.CreationTimestamp.IsZero() {
 		age = time.Since(ws.CreationTimestamp.Time).Truncate(time.Second).String()
 	}
+	var autoPauseTimeout string
+	switch {
+	case ws.Spec.AutoPauseTimeoutMinutes == nil:
+		autoPauseTimeout = "default"
+	case *ws.Spec.AutoPauseTimeoutMinutes == 0:
+		autoPauseTimeout = "disabled"
+	default:
+		autoPauseTimeout = fmt.Sprintf("%dm", *ws.Spec.AutoPauseTimeoutMinutes)
+	}
+
+	lastActivity := ""
+	if ws.Status.LastActivityTime != nil {
+		elapsed := time.Since(ws.Status.LastActivityTime.Time)
+		if elapsed < time.Minute {
+			lastActivity = "just now"
+		} else {
+			lastActivity = elapsed.Truncate(time.Minute).String() + " ago"
+		}
+	}
+
 	return WorkspaceResponse{
-		Name:    ws.Name,
-		Phase:   phase,
-		Lease:   ws.Spec.LeaseID,
-		Arch:    ws.Spec.Architecture,
-		PodName: ws.Status.PodName,
-		Age:     age,
+		Name:             ws.Name,
+		Phase:            phase,
+		Lease:            ws.Spec.LeaseID,
+		Arch:             ws.Spec.Architecture,
+		PodName:          ws.Status.PodName,
+		Age:              age,
+		AutoPauseTimeout: autoPauseTimeout,
+		LastActivity:     lastActivity,
 	}
 }