feat: native user authentication

[sparkoo]

Signed-off-by: Michal Vala [email protected]

What does this PR do?

This is adding support for new authentication without Keycloak. Currently it's only for OpenShift using OpenShift OAuth. It's using oauth-proxy (https://github.com/openshift/oauth-proxy) in the gateway.

Technically, it's adding auth.nativeUserMode field in the CR. When enabled, che-operator does not deploy keycloak AND deploys the gateway with authentication and authorization capabilities.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

eclipse-che/che#19705

How to test this PR?

I keep latest image of this PR here quay.io/mvala/che-operator:gh19705-newAuth

Deploy with this patch:

apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: eclipse-che
spec:
  auth:
    nativeUserMode: true

and deploy templates from https://github.com/sparkoo/che-operator/tree/gh19705-newAuth/deploy

with chectl server:deploy --platform=openshift --installer=operator --workspace-engine=dev-workspace --che-operator-image=quay.io/mvala/che-operator:gh19705-newAuth --che-operator-cr-patch-yaml=/tmp/che_cr.yaml --templates=/tmp/cheop-templates

Chectl will fail waiting for a keycloak, which is not deployed in nativeUserMode. However, che-operator will deploy che successfully underneath. Get the route oc get route -n eclipse-che and open it in browser as usual. You should be redirected to OpenShift login page, so login as any OpenShift user. After login, you should get immediately to the dashboard and you can start any devworkspace.

To logout, you need to delete site cookies, this is not done yet.

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• Custom resource definition file is up to date
• Nightly OLM bundle is up to date
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[tolusha]

Files under generated folder as well as olm/bundle_tmp.... must not be committed.

[tolusha]

In general sounds good

[sparkoo]

/retest

[sparkoo]

/retest

[sparkoo]

/retest

[flacatus]

/retest

[sparkoo]

@tolusha any other comments? I'd like to merge it on Friday.

[metlos]

Would it make sense to add the *Image config options to checluster v2 and modify the v1<->v2 conversion, too?

[sparkoo]

I don't know how to do that. Is v2 in che-operator already?

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: flacatus, mmorhun, sparkoo, tolusha

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sparkoo]

/retest

[sparkoo]

/retest

[sparkoo]

/retest

[flacatus]

/retest

[openshift-ci]

@sparkoo: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/v8-single-host-nightly-deployment	71d7c08	link	/test v8-single-host-nightly-deployment
ci/prow/v8-multi-host-nightly-deployment	71d7c08	link	/test v8-multi-host-nightly-deployment
ci/prow/v7-multi-host-nightly-deployment	71d7c08	link	/test v7-multi-host-nightly-deployment
ci/prow/v7-single-host-nightly-deployment	71d7c08	link	/test v7-single-host-nightly-deployment

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[sparkoo]

/retest