Openshift connector and Che: openshift user should be logged automatically with the Openshift user.

[sunix]

Is your enhancement related to a problem? Please describe.

Having

• a workspace that use the openshift connector plugin
• a Che server running on Openshift v4.2 and OpenShift oAuth activated

When a user is opening the openshift connector panel, he is connected as his openshift user. and see (without any project)

Describe the solution you'd like

When a user is opening the openshift connector panel, he should be connected as his openshift user. and not have to login with his credential or token

[tsmaeder]

Not sure I understand this one correctly: What I understand is this:

1. When opening the connector panel, the cluster that Che is running on is displayed per default
2. Your expectation is that the user is already logged into that cluster as the same user he uses to log into Che?

[tsmaeder]

@sunix this seems upstream behaviour, right?

[sunix]

Not sure I understand this one correctly: What I understand is this:

1. When opening the connector panel, the cluster that Che is running on is displayed per default
2. Your expectation is that the user is already logged into that cluster as the same user he uses to log into Che?

yes

@sunix this seems upstream behaviour, right?

not an upstream issue.

[azatsarynnyy]

OpenShift Connector plugin is connected to a cluster as Che service account. ATM I don't see how we can connect plugin automatically as OpenShift user.

Improving a kubeconfig injection with chectl could make the UX is a bit better. See #14877

[l0rd]

@azatsarynnyy a couple of comments:

1. When we inject the context using chectl the OpenShift Connector plugin will use that context (and not the workspace serviceaccount) to connect to the cluster right?
2. When Che is deployed on OpenShift in multi-user mode and OpenShift OAuth enabled we should inject the OpenShift context of the current Che user at workspace startup (no need to use chectl)

[l0rd]

Hence for me #14877 and this one are distinct issues:

• Automate OpenShift context injection when OpenShift OAuth is enabled ==> this issue
• Improve Kubernetes context injection when using chectl ==> Improve kubeconfig injection with chectl #14877

And this issue is probably the most critical one. But if for technical reasons solving #14877 helps solve this one let's start with #14877. Does that make sense?

[azatsarynnyy]

@azatsarynnyy a couple of comments:

When we inject the context using chectl the OpenShift Connector plugin will use that context (and not the workspace serviceaccount) to connect to the cluster right?

right

When Che is deployed on OpenShift in multi-user mode and OpenShift OAuth enabled we should inject the OpenShift context of the current Che user at workspace startup (no need to use chectl)

@l0rd where we can get the OpenShift context of the current Che user in that case? Is that information stored somewhere?

[vinokurig]

Depends on #15670

[sunix]

@ericwill @vinokurig any update on this one ? what is the status ?

[vinokurig]

It is almost done, waiting for che-incubator/che-theia-openshift-auth#1 and eclipse-che/che-plugin-registry#419 to be reviewed

[dmytro-ndp]

The issue is quite important for downstream project CRW, and it would be nice to have it fixed in CRW 2.2.