feat: Traefik plugin #938

sparkoo · 2021-07-16T15:49:30Z

What does this PR do?

updates deployment of nativeUserMode with using traefik plugin to rewrite authorization header

Screenshot/screencast of this PR

What issues does this PR fix or reference?

eclipse-che/che#20070

How to test this PR?

deploy che with devworkspaces enabled, che-operator templates from this PR (need new env value RELATED_IMAGE_single_host_gateway_native_user_mode) and CheCluster patch:

spec:
  auth:
    nativeUserMode: true

check that gateway has no header-rewrite-proxy container, it should have 4 containers
check configmap che-gateway-config-header-rewrite-plugin that should contain headerRewrite.go with plugin code
every route configmap should containe additional middleware configuring this plugin
test starting the devworkspace or whatever. Without the plugin working, you should get 403 on loading the dashboard and kubernetes proxy of che-server won't work as it relies on correct Authorization header

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Signed-off-by: Michal Vala <mvala@redhat.com>

openshift-ci · 2021-07-16T15:49:31Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

# Conflicts: # Dockerfile

Signed-off-by: Michal Vala <mvala@redhat.com>

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml

sparkoo · 2021-07-19T20:09:35Z

/retest

config/manager/manager.yaml

Signed-off-by: Michal Vala <mvala@redhat.com>

# Conflicts: # Dockerfile

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml # config/manager/manager.yaml

Signed-off-by: Michal Vala <mvala@redhat.com>

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml # config/manager/manager.yaml

sparkoo · 2021-07-20T14:17:39Z

/retest

tolusha · 2021-07-20T14:20:02Z

OpenShift tests are not working right now.. until #947 is merged

api/v1/checluster_types.go

…atibility Signed-off-by: Michal Vala <mvala@redhat.com>

Signed-off-by: Michal Vala <mvala@redhat.com>

tolusha · 2021-07-21T08:21:26Z

/retest

tolusha · 2021-07-21T08:17:32Z

Dockerfile

@@ -23,7 +24,8 @@ RUN mkdir -p $GOPATH/restic && \
    curl -sSLo- https://api.github.com/repos/restic/restic/tarball/${RESTIC_TAG} | tar --strip-components=1 -xz -C $GOPATH/restic && \
    cd $GOPATH/restic && go mod vendor && \
    curl -sSLo /tmp/asset-devworkspace-operator.zip https://api.github.com/repos/devfile/devworkspace-operator/zipball/${DEV_WORKSPACE_CONTROLLER_VERSION} && \
-    curl -sSLo /tmp/asset-devworkspace-che-operator.zip https://api.github.com/repos/che-incubator/devworkspace-che-operator/zipball/${DEV_WORKSPACE_CHE_OPERATOR_VERSION}
+    curl -sSLo /tmp/asset-devworkspace-che-operator.zip https://api.github.com/repos/che-incubator/devworkspace-che-operator/zipball/${DEV_WORKSPACE_CHE_OPERATOR_VERSION} && \
+    curl -sSLo /tmp/asset-header-rewrite-traefik-plugin.zip https://api.github.com/repos/che-incubator/header-rewrite-traefik-plugin/zipball/${DEV_HEADER_REWRITE_TRAEFIK_PLUGIN}


This requires changed in downstream
https://github.com/redhat-developer/codeready-workspaces-images/blob/crw-2-rhel-8/codeready-workspaces-operator/get-sources.sh#L78-L92
/cc @nickboldt

thanks, I've opened a PR redhat-developer/devspaces-images#63
However, I have no idea about the process and how to test that

looks good to me, I'll merge it. But still blocked in https://issues.redhat.com/browse/CRW-1956 (all the huge changes in che-operator 7.34/main have not yet been implemented in downstream sync scripts) so can't test this yet.

Also I'm assuming that in downstream CSV I'll just remove RELATED_IMAGE_single_host_gateway_native_user_mode because we're not including 2 versions of traefik in the product when one of those is unreleased RC.

I hope the plan is to eventually use traefik 2.5 in both related images?

Also I'm assuming that in downstream CSV I'll just remove RELATED_IMAGE_single_host_gateway_native_user_mode because we're not including 2 versions of traefik in the product when one of those is unreleased RC.

Imho it won't work, che-operator code will complain that it does not know the env variable. I believe you can keep it empty. But why don't keep it there? Yes, it's RC version, but whole nativeUserMode is experimental. Alternatively I think you can set it empty, then nativeUserMode: true won't work.

I hope the plan is to eventually use traefik 2.5 in both related images?

yes, plan is to have only one stable Traefik in Che, once Traefik 2.5 is released.

tolusha · 2021-07-21T09:34:28Z

/retest

openshift-ci · 2021-07-21T11:29:12Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: skabashnyuk, sparkoo, tolusha

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sparkoo added 2 commits July 16, 2021 11:20

load traefik plugin into gateway

b9b1b6e

Signed-off-by: Michal Vala <mvala@redhat.com>

traefik config up

0655eb7

Signed-off-by: Michal Vala <mvala@redhat.com>

sparkoo requested review from metlos, skabashnyuk and tolusha July 16, 2021 15:49

openshift-ci bot added the needs-rebase label Jul 18, 2021

Merge branch 'main' into traefikPlugin

49ecd6f

# Conflicts: # Dockerfile

openshift-ci bot removed the needs-rebase label Jul 19, 2021

use latest traefik for nativeUserMode

3af14f5

Signed-off-by: Michal Vala <mvala@redhat.com>

openshift-ci bot added needs-rebase labels Jul 19, 2021

cleanup format

eb976be

Signed-off-by: Michal Vala <mvala@redhat.com>

openshift-ci bot added the do-not-merge/work-in-progress label Jul 19, 2021

sparkoo changed the title ~~Traefik plugin~~ feat: Traefik plugin Jul 19, 2021

sparkoo marked this pull request as ready for review July 19, 2021 15:52

sparkoo requested review from AndrienkoAleksandr, flacatus, mmorhun and nickboldt as code owners July 19, 2021 15:52

openshift-ci bot removed the do-not-merge/work-in-progress label Jul 19, 2021

Merge branch 'main' into traefikPlugin

1d0eb7d

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml

openshift-ci bot removed the needs-rebase label Jul 19, 2021

tolusha reviewed Jul 20, 2021

View reviewed changes

config/manager/manager.yaml Show resolved Hide resolved

update gitignore

3b316c1

Signed-off-by: Michal Vala <mvala@redhat.com>

openshift-ci bot added needs-rebase labels Jul 20, 2021

Merge branch 'main' into traefikPlugin

04d6159

# Conflicts: # Dockerfile

openshift-ci bot removed the needs-rebase label Jul 20, 2021

sparkoo added 7 commits July 20, 2021 09:46

Merge branch 'main' into traefikPlugin

1313b27

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml # config/manager/manager.yaml

update to new repo header-rewrite-traefik-plugin

130dd4c

Signed-off-by: Michal Vala <mvala@redhat.com>

fix tests, build, remove unnecessary variable

379605e

Signed-off-by: Michal Vala <mvala@redhat.com>

rename header rewrite plugin in configmaps

ffb494e

Signed-off-by: Michal Vala <mvala@redhat.com>

gitignore revert

a5b77a9

Signed-off-by: Michal Vala <mvala@redhat.com>

Merge branch 'main' into traefikPlugin

ab0fce5

Merge branch 'main' into traefikPlugin

49753e3

# Conflicts: # bundle/nightly/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml # bundle/nightly/eclipse-che-preview-openshift/manifests/che-operator.clusterserviceversion.yaml # config/manager/manager.yaml

tolusha reviewed Jul 20, 2021

View reviewed changes

api/v1/checluster_types.go Show resolved Hide resolved

sparkoo added 3 commits July 20, 2021 16:30

take back GatewayHeaderRewriteSidecarImage to not break backward comp…

149deb9

…atibility Signed-off-by: Michal Vala <mvala@redhat.com>

Merge branch 'main' into traefikPlugin

4078209

update resources

2a50ca6

Signed-off-by: Michal Vala <mvala@redhat.com>

tolusha reviewed Jul 21, 2021

View reviewed changes

sparkoo mentioned this pull request Jul 21, 2021

build: update crw operator with header rewrite traefik plugin redhat-developer/devspaces-images#63

Merged

tolusha approved these changes Jul 21, 2021

View reviewed changes

openshift-ci bot assigned tolusha Jul 21, 2021

openshift-ci bot added the lgtm label Jul 21, 2021

skabashnyuk approved these changes Jul 21, 2021

View reviewed changes

openshift-ci bot assigned skabashnyuk Jul 21, 2021

sparkoo merged commit 6bf5c65 into eclipse-che:main Jul 21, 2021

sparkoo deleted the traefikPlugin branch July 21, 2021 11:43

che-bot added this to the 7.34 milestone Jul 21, 2021

This was referenced Jul 21, 2021

[che-auth] - use traefik plugin to set authorization header eclipse-che/che#20070

Closed

update Traefik to 2.5 eclipse-che/che#20142

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Traefik plugin #938

feat: Traefik plugin #938

sparkoo commented Jul 16, 2021 •

edited

Loading

openshift-ci bot commented Jul 16, 2021

sparkoo commented Jul 19, 2021

sparkoo commented Jul 20, 2021

tolusha commented Jul 20, 2021

tolusha commented Jul 21, 2021

tolusha Jul 21, 2021

sparkoo Jul 21, 2021

nickboldt Jul 21, 2021

nickboldt Jul 21, 2021

sparkoo Jul 21, 2021

tolusha commented Jul 21, 2021

openshift-ci bot commented Jul 21, 2021

feat: Traefik plugin #938

feat: Traefik plugin #938

Conversation

sparkoo commented Jul 16, 2021 • edited Loading

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

PR Checklist

Reviewers

openshift-ci bot commented Jul 16, 2021

sparkoo commented Jul 19, 2021

sparkoo commented Jul 20, 2021

tolusha commented Jul 20, 2021

tolusha commented Jul 21, 2021

tolusha Jul 21, 2021

Choose a reason for hiding this comment

sparkoo Jul 21, 2021

Choose a reason for hiding this comment

nickboldt Jul 21, 2021

Choose a reason for hiding this comment

nickboldt Jul 21, 2021

Choose a reason for hiding this comment

sparkoo Jul 21, 2021

Choose a reason for hiding this comment

tolusha commented Jul 21, 2021

openshift-ci bot commented Jul 21, 2021

sparkoo commented Jul 16, 2021 •

edited

Loading