Devfile endpoints does not work when exposed on single-host

[sparkoo]

Describe the bug

spec:
  server:
    customCheProperties:
      CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE: single-host
    serverExposureStrategy: single-host

che-workspace endpoints does not work with CheCluster patch ^. Sometimes user can't get into the workspace.

Analysis

In single-host, by default we expose devfile endpoints on subdomain by adding requireSubdomain attribute to the endpoint: https://github.com/eclipse-che/che-server/blob/main/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/devfile/DockerimageComponentToWorkspaceApplier.java#L145 -> https://github.com/eclipse-che/che-server/blob/47ebe7c372ea0d405a4bdb707a7166808c8d6240/wsmaster/che-core-api-workspace/src/main/java/org/eclipse/che/api/workspace/server/model/impl/ServerConfigImpl.java#L199

This behavior can be changed with CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE, but the issue is we don't check it here. So we set this to every devfile endpoint everytime. This will cause issue later, when we're constructing the endpoint URL https://github.com/eclipse-che/che-server/blob/main/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/server/resolver/ConfigMapServerResolver.java#L76. See that we don't append the endpoint origin to the url if endpoint has requiresSubdomain parameter. That's the reason, why opening endpoint from theia does open just che-host, without any subpath to the endpoint.

For the cases when workspace is not accessible, the issue pops up in this filter in workspace loader https://github.com/eclipse-che/che-server/blob/main/assembly/assembly-root-war/src/main/webapp/_app/loader.js#L140. We're finding here the url to use for authentication (which suppose to be jwt-proxy endpoint), but we're doing it only by checking the prefix (redirectUrl.startsWith(_server.url)). Now our wrong endpoint url has just host-url, without any subdomain or subpath, so in cases when this endpoint is in the list before the jwt-endpoint, it is matched and we try to do the keycloak machinetoken auth with this endpoint, which of course does not work.

Che version

next (development version)

Steps to reproduce

1. deploy with chectl server:deploy --platform openshift --che-operator-cr-patch-yaml=patch.yml where patch.yml is:

spec:
  server:
    customCheProperties:
      CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE: single-host
    serverExposureStrategy: single-host

2. Start any workspace that has endpoint defined in the devfile component
3. Workspace should start fine, but maybe you won't get there
4. If you get there, try to run the application that uses the endpoint and try to open the endpoint. It has wrong url.

Expected behavior

Workspace must be accessible and endpoint urls correct

Runtime

OpenShift

Screenshots

No response

Installation method

chectl/next

Environment

other (please specify in additional context)

Eclipse Che Logs

No response

Additional context

No response

[sparkoo]

fixed by eclipse-che/che-server#157