eclipse-che/che-operator

che-operator's Issues

Che workspaces fail on a brand new install

I installed Eclipse Che on a brand new Kubernetes 1.16.3_1520 cluster on IBM Cloud by following the installation instructions on https://operatorhub.io/operator/eclipse-che.

Everything seemed to install correctly... I see all the expected pods running, etc...

When I create a workspace, everything appears OK at first. For example, you see the loading screen with appropriate messages:

However, once the workspace containers are running, and you expect to see an editor, I just see a "Welcome to nginx!" message:

I don't see any error messages in any of the pods (operator or workspace), and I'm not quite sure how to debug this further. I assume that something about the Eclipse Che ingress isn't working as expected, but I'm not sure what to check next. Any help would be greatly appreciated.

Note: before installing via operatorhub instructions, I had to install the IBM Cloud block storage helm chart per https://cloud.ibm.com/docs/containers?topic=containers-block_storage, however that is not the issue b/c I can see storage volumes being created correctly.

Keycloak user federation

I managed to deploy Che Operator to our v1.15.3 Kubernetes cluster using the files in the deploy directory, but I didn't find any way to configure user federation like LDAP besides configuring it in Keycloak itself. I would like to configure the settings with some files - is it possible somehow or should I just deploy Keycloak to the cluster separately?

Kubernetes v1.15.3
Che Operator using tag 7.30.2

[Security] Workflow minikube-operator-singlehost.yaml is using vulnerable action actions/checkout

The workflow minikube-operator-singlehost.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

feature request: Support custom Postgres PVC size

che-operator/pkg/deploy/postgres/postgres.go

Line 78 in b4930b5

done, err := deploy.SyncPVCToCluster(p.deployContext, deploy.DefaultPostgresVolumeClaimName, "1Gi", deploy.PostgresName)

Now we hard-coded the PVC requests to 1Gi. It is better to support the custom size.

When the disableContainerBuildCapabilities parameter is set to true, RoleBindings for Service Accounts are not created

Hello everyone,

I've been exploring running workspaces with custom container SecurityContexts and OpenShift SCCs. Here's what I've observed: when the disableContainerBuildCapabilities parameter is set to false, I noticed that in the user namespace, the operator creates RoleBindings to enable the use of the provided SCC.

However, when disableContainerBuildCapabilities is set to true, presumably due to the use of container SecurityContexts (which is why I need both SCC and SecurityContexts), I encountered a situation where the RoleBindings were not created.

Below is the YAML configuration for Eclipse Che:

apiVersion: org.eclipse.che/v2
kind: CheCluster
metadata:
  annotations:
    che.eclipse.org/checluster-defaults-cleanup: '{"containers.resources":"true","spec.components.dashboard.headerMessage":"true","spec.components.pluginRegistry.openVSXURL":"true","spec.devEnvironments.defaultComponents":"true","spec.devEnvironments.defaultEditor":"true","spec.devEnvironments.disableContainerBuildCapabilities":"true"}'
  finalizers:
  - checluster.che.eclipse.org
  - cluster-resources.finalizers.che.eclipse.org
  - cheGateway.clusterpermissions.finalizers.che.eclipse.org
  - oauthclients.finalizers.che.eclipse.org
  - dashboard.clusterpermissions.finalizers.che.eclipse.org
  - consolelink.finalizers.che.eclipse.org
  - container-build.finalizers.che.eclipse.org
  name: eclipse-che
  namespace: openshift-operators
spec:
  components:
    cheServer:
      debug: false
      logLevel: INFO
    dashboard:
      logLevel: ERROR
    devWorkspace: {}
    devfileRegistry: {}
    imagePuller:
      enable: false
      spec: {}
    metrics:
      enable: true
    pluginRegistry: {}
  containerRegistry: {}
  devEnvironments:
    containerBuildConfiguration:
      openShiftSecurityContextConstraint: che-rootless-podman
    defaultNamespace:
      autoProvision: true
      template: <username>-che
    disableContainerBuildCapabilities: true
    maxNumberOfWorkspacesPerUser: 2
    secondsOfInactivityBeforeIdling: 1800
    secondsOfRunBeforeIdling: -1
    security:
      containerSecurityContext:
        allowPrivilegeEscalation: true
        capabilities:
          add:
          - SETGID
          - SETUID
          drop:
          - ALL
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        seLinuxOptions:
          type: spc_t
    startTimeoutSeconds: 1000
    storage:
      pvcStrategy: per-user
  gitServices: {}
  networking:
    auth:
      gateway:
        configLabels:
          app: che
          component: che-gateway-config

When disableContainerBuildCapabilities is set to false, the RoleBindings are created correctly:

$ oc get rolebinding | grep che-
che-user-container-build                                     ClusterRole/che-user-container-build                                     18m
devworkspace-use-che-rootless-podman                         Role/devworkspace-use-che-rootless-podman                                17m

oc describe rolebinding/devworkspace-use-che-rootless-podman
Name:         devworkspace-use-che-rootless-podman
Labels:       app.kubernetes.io/name=devworkspace-workspaces
              app.kubernetes.io/part-of=devworkspace-operator
              controller.devfile.io/workspace-rbac=true
Annotations:  <none>
Role:
  Kind:  Role
  Name:  devworkspace-use-che-rootless-podman
Subjects:
  Kind            Name                          Namespace
  ----            ----                          ---------
  ServiceAccount  workspacec31b1c0c0e40428d-sa  rode-che-3p0eaa

When disableContainerBuildCapabilities is set to true, the RoleBindings are not created:

$ oc get rolebinding | grep che-
$ echo $?
1

Eclipse Che Version: 7.84.0
Cluster version: 4.15.0-0.okd-2024-03-10-010116

I attempted to delve into the code for any clues but didn't find anything useful.

Could someone please help me understand if this is the expected behavior, or if there are additional configurations I need to provide? Any insights would be greatly appreciated.

[Security] Workflow minikube-stable-olm-update.yaml is using vulnerable action actions/checkout

The workflow minikube-stable-olm-update.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig

Installation tested in kubernetes 1.25 and 1.23:

helm repo add eclipse-che https://eclipse-che.github.io/che-operator/charts
helm repo update eclipse-che
helm upgrade --install eclipse-che \
       	eclipse-che/eclipse-che \
	--create-namespace --namespace eclipse-che

cheCluster.yaml

apiVersion: org.eclipse.che/v2
kind: CheCluster
metadata:
  name: eclipse-che
  namespace: eclipse-che
spec:
  components: {}
  containerRegistry: {}
  devEnvironments: {}
  gitServices: {}
  networking:
    domain: che.in.someplace.com
    auth:
      identityProviderURL: https://keycloak.in.someplace.com/realms/master
      oAuthClientName: che
      oAuthSecret: wasdfasdfghgtyfggdfd5t6XDmt
  components:
    cheServer:
      extraProperties:
        CHE_OIDC_USERNAME__CLAIM: email

logs:

time="2023-04-06T09:08:06Z" level=info msg="Creating a new object: v1.ConfigMap, name: ca-certs-merged"
time="2023-04-06T09:08:07Z" level=info msg="Creating a new object: v1.Secret, name: self-signed-certificate"
time="2023-04-06T09:08:07Z" level=info msg="Custom resource status eclipse-che updated with status: Reason: InstallOrUpdateFailed"
time="2023-04-06T09:08:07Z" level=info msg="Custom resource status eclipse-che updated with status: Message: Reconciler failed devworkspaceconfig.DevWorkspaceConfigReconciler, cause: no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""
2023-04-06T09:08:07.580Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:08.470Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
I0406 09:08:09.587597       1 request.go:668] Waited for 1.038776921s due to client-side throttling, not priority and fairness, request: GET:https://10.152.183.1:443/apis/storage.k8s.io/v1beta1?timeout=32s
2023-04-06T09:08:10.509Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:12.565Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:14.609Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:16.659Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
2023-04-06T09:08:18.710Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214
I0406 09:08:19.880434       1 request.go:668] Waited for 1.084542457s due to client-side throttling, not priority and fairness, request: GET:https://10.152.183.1:443/apis/node.k8s.io/v1?timeout=32s
2023-04-06T09:08:20.761Z	ERROR	controller-runtime.manager.controller.checluster	Reconciler error	{"reconciler group": "org.eclipse.che", "reconciler kind": "CheCluster", "name": "eclipse-che", "namespace": "eclipse-che", "error": "no kind is registered for the type v1alpha1.DevWorkspaceOperatorConfig in scheme \"/che-operator/main.go:90\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/che-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:214

Am I doing something wrong?

An underscore is missing in workspace env variable

@eivantsov investigating on some OOM Killed errors the integreatly team finds out that CHE_WORKSPACE_JAVA_OPTIONS is missing an underscore (should be CHE_WORKSPACE_JAVA__OPTIONS).

It looks like an easy fix to apply here. Can you confirm?

cc @jessesarn

[Security] Workflow minikube-operator-singlehost.yaml is using vulnerable action actions/checkout

The workflow minikube-operator-singlehost.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

Eclipse che Dashboard issue (devworkspacetemplates and devworkspace 401 )

Hi All,
I am installing eclipse che on my k3d k8s cluster using helm chart next version.
Install is Successful and able to hit the dashboard URL, but once the oidc authentication is verified and the callback is also successful but I am getting below error
Failed to fetch available workspaces, reason: Failed to fetch the list of devWorkspaces. Unable to list devworkspaces: unauthorized

here is my CheCluster manifest

I am using NFS as my storage class.

apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: eclipse-che
  namespace: eclipse-che
spec:
  auth:
    externalIdentityProvider: true
    openShiftoAuth: false
    identityProviderURL: "https://test.eu.auth0.com/"   ##  changed for security reasons
    oAuthClientName: "abc"   ##  changed for security reasons
    oAuthSecret: "xyz"   ##  changed for security reasons
  database:
    chePostgresDb: ""
    chePostgresHostName: ""
    chePostgresPort: ""
    chePostgresSecret: ""
    externalDb: false
  devWorkspace:
    enable: true
  k8s:
    ingressClass: kong  ## changed for security reasons
    ingressDomain: "eclipse-che.test-sample.com"    ##  changed for security reasons
    tlsSecretName: che-tls
  metrics:
    enable: true
  server:
    customCheProperties:
      CHE_OIDC_USERNAME__CLAIM: "email"
    cheClusterRoles: ""
    tlsSupport: true
    # cheLogLevel: "DEBUG"
    cheWorkspaceClusterRole: ""
    gitSelfSignedCert: false
    nonProxyHosts: ""
    proxyPort: ""
    proxySecret: ""
    proxyURL: ""
    workspaceNamespaceDefault: <username>-che
  storage:
    postgresPVCStorageClassName: "nfs"
    preCreateSubPaths: true
    pvcClaimSize: 10Gi
    pvcStrategy: common
    workspacePVCStorageClassName: "nfs"

here is the browser logs screenshot

Also I have updated self-signed-certificate into my browser.

Can anyone help me out here.
Thank you.

[Security] Workflow pr-check.yml is using vulnerable action actions/checkout

The workflow pr-check.yml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

Che deployment fails on OKD/OpenShift 3.11

I tried deploying Che via the Che operator on OKD 3.10 and was met with the following error

johns-mbp-3:che-operator johncollier$ oc logs -f che-operator-c84f899d-zt9dl
time="2019-05-22T16:13:16Z" level=info msg="Go Version: go1.11.5" 
time="2019-05-22T16:13:16Z" level=info msg="Go OS/Arch: linux/amd64" 
time="2019-05-22T16:13:16Z" level=info msg="operator-sdk Version: v0.5.0" 
time="2019-05-22T16:13:16Z" level=info msg="Operator is running on OpenShift" 
time="2019-05-22T16:13:20Z" level=info msg="Registering Components" 
time="2019-05-22T16:13:20Z" level=info msg="Starting the Cmd" 
time="2019-05-22T16:13:22Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:22Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:23Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:23Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:24Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:24Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:25Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:25Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:26Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:26Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:27Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:27Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:29Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:29Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:30Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:30Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:31Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:31Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:32Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:32Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:35Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:35Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:40Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:40Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 
time="2019-05-22T16:13:51Z" level=info msg="Updating eclipse-che CR with status: Che API: Unavailable" 
time="2019-05-22T16:13:51Z" level=warning msg="Failed to update eclipse-che CR. Fetching the latest CR version: the server could not find the requested resource (put checlusters.org.eclipse.che eclipse-che)" 

Filling out blanks in the repository

Please add information for the header:

No description, website, or topics provided.

People need to see what the repo is for and where to find documentation around this repository.

Use finalizer to delete oAuthclient

The problem

Since oauthClient is a kind of object that is created at a cluster scope, k8s does not garbage collect it when a custom resource is deleted.

The solution

A finalizer needs to be used so that before a customer resource is deleted, controller cleans up oAuthClient.