eclipse-che / che-operator Goto Github PK
View Code? Open in Web Editor NEWLicense: Eclipse Public License 2.0
License: Eclipse Public License 2.0
I installed Eclipse Che on a brand new Kubernetes 1.16.3_1520 cluster on IBM Cloud by following the installation instructions on https://operatorhub.io/operator/eclipse-che.
Everything seemed to install correctly... I see all the expected pods running, etc...
When I create a workspace, everything appears OK at first. For example, you see the loading screen with appropriate messages:
However, once the workspace containers are running, and you expect to see an editor, I just see a "Welcome to nginx!" message:
I don't see any error messages in any of the pods (operator or workspace), and I'm not quite sure how to debug this further. I assume that something about the Eclipse Che ingress isn't working as expected, but I'm not sure what to check next. Any help would be greatly appreciated.
Note: before installing via operatorhub instructions, I had to install the IBM Cloud block storage helm chart per https://cloud.ibm.com/docs/containers?topic=containers-block_storage, however that is not the issue b/c I can see storage volumes being created correctly.
I managed to deploy Che Operator to our v1.15.3 Kubernetes cluster using the files in the deploy directory, but I didn't find any way to configure user federation like LDAP besides configuring it in Keycloak itself. I would like to configure the settings with some files - is it possible somehow or should I just deploy Keycloak to the cluster separately?
Kubernetes v1.15.3
Che Operator using tag 7.30.2
The workflow minikube-operator-singlehost.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
Now we hard-coded the PVC requests to 1Gi. It is better to support the custom size.
Hello everyone,
I've been exploring running workspaces with custom container SecurityContexts and OpenShift SCCs. Here's what I've observed: when the disableContainerBuildCapabilities
parameter is set to false, I noticed that in the user namespace, the operator creates RoleBindings to enable the use of the provided SCC.
However, when disableContainerBuildCapabilities
is set to true, presumably due to the use of container SecurityContexts (which is why I need both SCC and SecurityContexts), I encountered a situation where the RoleBindings were not created.
Below is the YAML configuration for Eclipse Che:
apiVersion: org.eclipse.che/v2
kind: CheCluster
metadata:
annotations:
che.eclipse.org/checluster-defaults-cleanup: '{"containers.resources":"true","spec.components.dashboard.headerMessage":"true","spec.components.pluginRegistry.openVSXURL":"true","spec.devEnvironments.defaultComponents":"true","spec.devEnvironments.defaultEditor":"true","spec.devEnvironments.disableContainerBuildCapabilities":"true"}'
finalizers:
- checluster.che.eclipse.org
- cluster-resources.finalizers.che.eclipse.org
- cheGateway.clusterpermissions.finalizers.che.eclipse.org
- oauthclients.finalizers.che.eclipse.org
- dashboard.clusterpermissions.finalizers.che.eclipse.org
- consolelink.finalizers.che.eclipse.org
- container-build.finalizers.che.eclipse.org
name: eclipse-che
namespace: openshift-operators
spec:
components:
cheServer:
debug: false
logLevel: INFO
dashboard:
logLevel: ERROR
devWorkspace: {}
devfileRegistry: {}
imagePuller:
enable: false
spec: {}
metrics:
enable: true
pluginRegistry: {}
containerRegistry: {}
devEnvironments:
containerBuildConfiguration:
openShiftSecurityContextConstraint: che-rootless-podman
defaultNamespace:
autoProvision: true
template: <username>-che
disableContainerBuildCapabilities: true
maxNumberOfWorkspacesPerUser: 2
secondsOfInactivityBeforeIdling: 1800
secondsOfRunBeforeIdling: -1
security:
containerSecurityContext:
allowPrivilegeEscalation: true
capabilities:
add:
- SETGID
- SETUID
drop:
- ALL
readOnlyRootFilesystem: false
runAsNonRoot: true
seLinuxOptions:
type: spc_t
startTimeoutSeconds: 1000
storage:
pvcStrategy: per-user
gitServices: {}
networking:
auth:
gateway:
configLabels:
app: che
component: che-gateway-config
When disableContainerBuildCapabilities is set to false, the RoleBindings are created correctly:
$ oc get rolebinding | grep che-
che-user-container-build ClusterRole/che-user-container-build 18m
devworkspace-use-che-rootless-podman Role/devworkspace-use-che-rootless-podman 17m
oc describe rolebinding/devworkspace-use-che-rootless-podman
Name: devworkspace-use-che-rootless-podman
Labels: app.kubernetes.io/name=devworkspace-workspaces
app.kubernetes.io/part-of=devworkspace-operator
controller.devfile.io/workspace-rbac=true
Annotations: <none>
Role:
Kind: Role
Name: devworkspace-use-che-rootless-podman
Subjects:
Kind Name Namespace
---- ---- ---------
ServiceAccount workspacec31b1c0c0e40428d-sa rode-che-3p0eaa
When disableContainerBuildCapabilities is set to true, the RoleBindings are not created:
$ oc get rolebinding | grep che-
$ echo $?
1
Eclipse Che Version: 7.84.0
Cluster version: 4.15.0-0.okd-2024-03-10-010116
I attempted to delve into the code for any clues but didn't find anything useful.
Could someone please help me understand if this is the expected behavior, or if there are additional configurations I need to provide? Any insights would be greatly appreciated.
The workflow minikube-stable-olm-update.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
Installation tested in kubernetes 1.25 and 1.23:
helm repo add eclipse-che https://eclipse-che.github.io/che-operator/charts
helm repo update eclipse-che
helm upgrade --install eclipse-che \
eclipse-che/eclipse-che \
--create-namespace --namespace eclipse-che
cheCluster.yaml
apiVersion: org.eclipse.che/v2
kind: CheCluster
metadata:
name: eclipse-che
namespace: eclipse-che
spec:
components: {}
containerRegistry: {}
devEnvironments: {}
gitServices: {}
networking:
domain: che.in.someplace.com
auth:
identityProviderURL: https://keycloak.in.someplace.com/realms/master
oAuthClientName: che
oAuthSecret: wasdfasdfghgtyfggdfd5t6XDmt
components:
cheServer:
extraProperties:
CHE_OIDC_USERNAME__CLAIM: email
logs:
time="2023-04-06T09:08:06Z" level=info msg="Creating a new object: v1.ConfigMap, name: ca-certs-merged"
time="2023-04-06T09:08:07Z" level=info msg="Creating a new object: v1.Secret, name: self-signed-certificate"
time="2023-04-06T09:08:07Z" level=info msg="Custom resource status eclipse-che updated with status: Reason: InstallOrUpdateFailed"
time="2023-04-06T09:08:07Z" level=info msg="Custom resource status eclipse-che updated with status: Message: Reconciler failed devworkspaceconfig.DevWorkspaceConfigReconciler, cause: no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""
2023-04-06T09:08:07.580Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:08.470Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
I0406 09:08:09.587597 1 request.go:668] Waited for 1.038776921s due to client-side throttling, not priority and fairness, request: GET:https://10.152.183.1:443/apis/storage.k8s.io/v1beta1?timeout=32s
2023-04-06T09:08:10.509Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:12.565Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:14.609Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:16.659Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:18.710Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
I0406 09:08:19.880434 1 request.go:668] Waited for 1.084542457s due to client-side throttling, not priority and fairness, request: GET:https://10.152.183.1:443/apis/node.k8s.io/v1?timeout=32s
2023-04-06T09:08:20.761Z ERROR controller-runtime.manager.controller.checluster Reconciler error {"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
Am I doing something wrong?
@eivantsov investigating on some OOM Killed errors the integreatly team finds out that CHE_WORKSPACE_JAVA_OPTIONS
is missing an underscore (should be CHE_WORKSPACE_JAVA__OPTIONS
).
It looks like an easy fix to apply here. Can you confirm?
cc @jessesarn
The workflow minikube-operator-singlehost.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
Hi All,
I am installing eclipse che on my k3d k8s cluster using helm chart next version.
Install is Successful and able to hit the dashboard URL, but once the oidc authentication is verified and the callback is also successful but I am getting below error
Failed to fetch available workspaces, reason: Failed to fetch the list of devWorkspaces. Unable to list devworkspaces: unauthorized
here is my CheCluster manifest
I am using NFS as my storage class.
apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
name: eclipse-che
namespace: eclipse-che
spec:
auth:
externalIdentityProvider: true
openShiftoAuth: false
identityProviderURL: "https://test.eu.auth0.com/" ## changed for security reasons
oAuthClientName: "abc" ## changed for security reasons
oAuthSecret: "xyz" ## changed for security reasons
database:
chePostgresDb: ""
chePostgresHostName: ""
chePostgresPort: ""
chePostgresSecret: ""
externalDb: false
devWorkspace:
enable: true
k8s:
ingressClass: kong ## changed for security reasons
ingressDomain: "eclipse-che.test-sample.com" ## changed for security reasons
tlsSecretName: che-tls
metrics:
enable: true
server:
customCheProperties:
CHE_OIDC_USERNAME__CLAIM: "email"
cheClusterRoles: ""
tlsSupport: true
# cheLogLevel: "DEBUG"
cheWorkspaceClusterRole: ""
gitSelfSignedCert: false
nonProxyHosts: ""
proxyPort: ""
proxySecret: ""
proxyURL: ""
workspaceNamespaceDefault: <username>-che
storage:
postgresPVCStorageClassName: "nfs"
preCreateSubPaths: true
pvcClaimSize: 10Gi
pvcStrategy: common
workspacePVCStorageClassName: "nfs"
here is the browser logs screenshot
Also I have updated self-signed-certificate into my browser.
Can anyone help me out here.
Thank you.
The workflow pr-check.yml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
I tried deploying Che via the Che operator on OKD 3.10 and was met with the following error
johns-mbp-3:che-operator johncollier$ oc logs -f che-operator-c84f899d-zt9dl
time="2019-05-22T16:13:16Z" level=info msg="Go Version: go1.11.5"
time="2019-05-22T16:13:16Z" level=info msg="Go OS/Arch: linux/amd64"
time="2019-05-22T16:13:16Z" level=info msg="operator-sdk Version: v0.5.0"
time="2019-05-22T16:13:16Z" level=info msg="Operator is running on OpenShift"
time="2019-05-22T16:13:20Z" level=info msg="Registering Components"
time="2019-05-22T16:13:20Z" level=info msg="Starting the Cmd"
time="2019-05-22T16:13:22Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:22Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:23Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:23Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:24Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:24Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:25Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:25Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:26Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:26Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:27Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:27Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:29Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:29Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:30Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:30Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:31Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:31Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:32Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:32Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:35Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:35Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:40Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:40Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
time="2019-05-22T16:13:51Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable"
time="2019-05-22T16:13:51Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)"
Please add information for the header:
No description, website, or topics provided.
People need to see what the repo is for and where to find documentation around this repository.
Since oauthClient is a kind of object that is created at a cluster scope, k8s does not garbage collect it when a custom resource is deleted.
A finalizer needs to be used so that before a customer resource is deleted, controller cleans up oAuthClient.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.