feat: native auth on Kubernetes

[sparkoo]

Signed-off-by: Michal Vala mvala@redhat.com

What does this PR do?

• removed che.infra.kubernetes.enable_unsupported_k8s + any checks to it
• Implemented OIDCTokenInitializationFilter that checks token from Authorization header, decodes it and creates Che user from token claims.
• Moved multiple Keycloak* classes into new OIDC module and keep generic OIDC stuff there. Where needed, Keycloak implementation extends these OIDC ones.
• Moved namespace configuration into NamespaceConfigurators. This makes KubernetesNamespaceFactory and OpenShiftProjectFactory simpler.
• Move calling of NamespaceConfigurator from NamespaceProvisioner into KubernetesNamespaceFactory/OpenShiftProjectFactory. This makes factories slightly more complex, but still better than doing all configuration/provisioning directly by Factory.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

eclipse-che/che#20633

How to test this PR?

che-server image: quay.io/mvala/che-server:gh20633-nativeAuthKube
che-operator image: quay.io/mvala/che-operator:gh20635-nativeAuthKube

1. start minikube
2. create CheCluster patch.yaml, replace {{MINIKUBE_IP}} with your minikube IP:

spec:
  auth:
    nativeUserMode: true
    identityProviderURL: http://dex.dex:5556
    gatewayAuthenticationSidecarImage: quay.io/oauth2-proxy/oauth2-proxy:v7.2.0
    gatewayAuthorizationSidecarImage: quay.io/brancz/kube-rbac-proxy:v0.11.0
  server:
    cheHost: 'che-eclipse-che.{{MINIKUBE_IP}}.nip.io'
    customCheProperties:
      CHE_KEYCLOAK_AUTH__INTERNAL__SERVER__URL: 'http://dex.dex:5556'

3. deploy with devworkspaces engine and images (you'll have to accept the risk that chectl prompts) ^^
   chectl server:deploy --platform=minikube --installer=operator --cheimage=quay.io/mvala/che-server:gh20633-nativeAuthKube --che-operator-image=quay.io/mvala/che-operator:gh20635-nativeAuthKube --workspace-engine=dev-workspace --che-operator-cr-patch-yaml=patch.yaml
4. wait until che is fully deployed (there should be no keycloak), then you can open che url as usual and import the CA cert
5. You get into Dex login page. There are couple of predefined users. che@eclipse.org:admin or userN@che:password where N is 1-5. After you login, you should get to dashboard as you know.

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[sparkoo]

@skabashnyuk is there a script to generate https://github.com/eclipse-che/che-server/blob/main/assembly/assembly-wsmaster-war/.deps/prod.md ?

[skabashnyuk]

mvn clean install
cd assembly/ws-maser/war
docker run --rm -t -v ~/.m2:/root/.m2   -v ${PWD}/:/workspace/project  quay.io/che-incubator/dash-licenses:next --generate 

[metlos]

Nicely done. Just 1 more nitpick about a todo in tests but don't consider being blocked by it...