Chapter 3. Installing Dev Spaces This section contains instructions to install Red Hat OpenShift Dev Spaces. You can deploy only one instance of OpenShift Dev Spaces per cluster. Section 3.1.2, "Installing Dev Spaces on OpenShift using CLI" Section 3.1.3, "Installing Dev Spaces on OpenShift using the web console" Section 3.1.4, "Installing Dev Spaces in a restricted environment" 3.1. Installing Dev Spaces in the cloud Deploy and run Red Hat OpenShift Dev Spaces in the cloud. Prerequisites A OpenShift cluster to deploy OpenShift Dev Spaces on. dsc : The command line tool for Red Hat OpenShift Dev Spaces. See: Section 2.2, "Installing the dsc management tool" . 3.1.1. Deploying OpenShift Dev Spaces in the cloud Follow the instructions below to start the OpenShift Dev Spaces Server in the cloud by using the dsc tool. Section 3.1.2, "Installing Dev Spaces on OpenShift using CLI" Section 3.1.3, "Installing Dev Spaces on OpenShift using the web console" Section 3.1.4, "Installing Dev Spaces in a restricted environment" https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.19/html-single/user_guide/index#installing-che-on-microsoft-azure Section 3.1.5, "Installing Dev Spaces on Amazon Elastic Kubernetes Service" 3.1.2. Installing Dev Spaces on OpenShift using CLI You can install OpenShift Dev Spaces on OpenShift. Prerequisites OpenShift Container Platform An active oc session with administrative permissions to the OpenShift cluster. See Getting started with the OpenShift CLI . dsc . See: Section 2.2, "Installing the dsc management tool" . Procedure Optional: If you previously deployed OpenShift Dev Spaces on this OpenShift cluster, ensure that the OpenShift Dev Spaces instance is removed: Create the OpenShift Dev Spaces instance: Verification steps Verify the OpenShift Dev Spaces instance status: Navigate to the OpenShift Dev Spaces cluster instance: Additional resources Section 3.3.1, "Permissions to install Dev Spaces on OpenShift using CLI" 3.1.3. Installing Dev Spaces on OpenShift using the web console If you have trouble installing OpenShift Dev Spaces on the command line , you can install it through the OpenShift web console. Prerequisites An OpenShift web console session by a cluster administrator. See Accessing the web console . An active oc session with administrative permissions to the OpenShift cluster. See Getting started with the OpenShift CLI . For a repeat installation on the same OpenShift cluster: you uninstalled the OpenShift Dev Spaces instance according to Chapter 9, Uninstalling Dev Spaces . Procedure In the Administrator view of the OpenShift web console, go to Operators OperatorHub and search for Red Hat OpenShift Dev Spaces . Install the Red Hat OpenShift Dev Spaces Operator. Tip See Installing from OperatorHub using the web console . Caution The Red Hat OpenShift Dev Spaces Operator depends on the Dev Workspace Operator. If you install the Red Hat OpenShift Dev Spaces Operator manually to a non-default namespace, ensure that the Dev Workspace Operator is also installed in the same namespace. This is required as the Operator Lifecycle Manager will attempt to install the Dev Workspace Operator as a dependency within the Red Hat OpenShift Dev Spaces Operator namespace, potentially resulting in two conflicting installations of the Dev Workspace Operator if the latter is installed in a different namespace. Caution If you want to onboard Web Terminal Operator on the cluster make sure to use the same installation namespace as Red Hat OpenShift Dev Spaces Operator since both depend on Dev Workspace Operator. Web Terminal Operator, Red Hat OpenShift Dev Spaces Operator, and Dev Workspace Operator must be installed in the same namespace. Create the openshift-devspaces project in OpenShift as follows: Go to Operators Installed Operators Red Hat OpenShift Dev Spaces instance Specification Create CheCluster YAML view . In the YAML view , replace namespace: openshift-operators with namespace: openshift-devspaces . Select Create . Tip See Creating applications from installed Operators . Verification In Red Hat OpenShift Dev Spaces instance Specification , go to devspaces , landing on the Details tab. Under Message , check that there is None , which means no errors. Under Red Hat OpenShift Dev Spaces URL , wait until the URL of the OpenShift Dev Spaces instance appears, and then open the URL to check the OpenShift Dev Spaces dashboard. In the Resources tab, view the resources for the OpenShift Dev Spaces deployment and their status. Additional resources Section 3.3.2, "Permissions to install Dev Spaces on OpenShift using web console" 3.1.4. Installing Dev Spaces in a restricted environment On an OpenShift cluster operating in a restricted network, public resources are not available. However, deploying OpenShift Dev Spaces and running workspaces requires the following public resources: Operator catalog Container images Sample projects To make these resources available, you can replace them with their copy in a registry accessible by the OpenShift cluster. Prerequisites The OpenShift cluster has at least 64 GB of disk space. The OpenShift cluster is ready to operate on a restricted network. See About disconnected installation mirroring and Using Operator Lifecycle Manager on restricted networks . An active oc session with administrative permissions to the OpenShift cluster. See Getting started with the OpenShift CLI . An active oc registry session to the registry.redhat.io Red Hat Ecosystem Catalog. See: Red Hat Container Registry authentication . opm . See Installing the opm CLI . jq . See Downloading jq . podman . See Podman Installation Instructions . skopeo version 1.6 or higher. See Installing Skopeo . An active skopeo session with administrative access to the private Docker registry. Authenticating to a registry , and Mirroring images for a disconnected installation . dsc for OpenShift Dev Spaces version 3.19. See Section 2.2, "Installing the dsc management tool" . Procedure Download and execute the mirroring script to install a custom Operator catalog and mirror the related images: prepare-restricted-environment.sh . 1 The private Docker registry where the images will be mirrored Install OpenShift Dev Spaces with the configuration set in the che-operator-cr-patch.yaml during the step: Allow incoming traffic from the OpenShift Dev Spaces namespace to all Pods in the user projects. See: Section 4.8.1, "Configuring network policies" . Additional resources Red Hat-provided Operator catalogs Managing custom catalogs 3.1.4.1. Setting up an Ansible sample Follow these steps to use an Ansible sample in restricted environments. Prerequisites Microsoft Visual Studio Code - Open Source IDE A 64-bit x86 system. Procedure Mirror the following images: Configure the cluster proxy to allow access to the following domains: Note Support for the following IDE and CPU architectures is planned for a future release: IDE JetBrains IntelliJ IDEA Community Edition IDE ( Technology Preview ) CPU architectures IBM Power (ppc64le) IBM Z (s390x) 3.1.5. Installing Dev Spaces on Amazon Elastic Kubernetes Service {eks} (Amazon EKS) is a managed Kubernetes service to run Kubernetes in the AWS cloud and on-premises data centers. Follow the instructions below to install and enable OpenShift Dev Spaces on {eks-short}. Prerequisites helm : The package manager for Kubernetes. See: Installing Helm . dsc . See: Section 2.2, "Installing the dsc management tool" . aws : The AWS Command Line Interface. See: AWS CLI install and update instructions eksctl : The Command Line Interface for creating and managing Kubernetes clusters on {eks-short}. See: Installing eksctl 3.1.5.1. Configuring environment variables for {eks-short} Follow these instructions to define environment variables and update your kubeconfig to connect to {eks-short}. Prerequisites Amazon EKS cluster with storage addon. See: Create an Amazon EKS cluster Procedure Find the AWS account ID: Define the cluster name: Define the region: Update kubeconfig : Make sure that you have the default storage class set: The output should display a storage class with default to its name: Additional resources {eks} Store Kubernetes volumes with Amazon EBS Create a managed node group for {eks-short} Change the default storage class on Kubernetes cluster 3.1.5.2. Installing Ingress-Nginx Controller on {eks-short} Follow these instructions to install the Ingress-Nginx Controller on {eks-short}. Procedure Install the Ingress-Nginx Controller using Helm : Verify that you can access the load balancer externally. It may take a few minutes for the load balancer to be created: You should receive the output similar to: <html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx</center> </body> </html> Additional resources Ingress-Nginx Controller Installation Guide 3.1.5.3. Configuring DNS on {eks-short} Follow these instructions to configure DNS on {eks-short}. Prerequisites A registered domain. See: Registering a new domain on {eks-short} . Procedure Define the registered domain name: Define domain name for Keycloak OIDC provider: Find out the hosted zone ID for the domain: Find out the Canonical Hosted Zone ID for the load balancer: Find out the DNS name for the load balancer: Create a DNS record set: Verify that you can access OpenShift Dev Spaces domain externally: Create a DNS record set: Verify that you can access the Keycloak domain externally: 3.1.5.4. Installing cert-manager on {eks-short} Follow these instructions to install the cert-manager on {eks-short}. Procedure Install cert-manager using Helm : Additional resources cert-manager Installation Guide 3.1.5.5. Creating Let's Encrypt certificate for OpenShift Dev Spaces on {eks-short} Follow these instructions to create a Let's Encrypt certificate for OpenShift Dev Spaces on {eks-short}. Procedure Create an IAM OIDC provider: Create a service principal: Create an IAM role and associate it with a Kubernetes Service Account: Grant permission for cert-manager to create Service Account tokens: Create the Issuer: 1 Replace <email_address> with your email address. Create the openshift-devspaces namespace: Create the Certificate: Wait for the che-tls secret to be created: Additional resources cert-manager Installation Guide 3.1.5.6. Installing Keycloak on {eks} Follow these instructions to install Keycloak as the OpenID Connect (OIDC) provider. Procedure Install Keycloak: Important Wait until the Keycloak pod is ready: Wait for the keycloak.tls secret to be created: Configure Keycloak to create the realm, client, and user: Additional resources Configuring Keycloak for production 3.1.5.7. Associate keycloak as OIDC identity provider on {eks-short} Follow these instructions to associate Keycloak an OIDC identity provider on {eks-short}. Procedure Associate Keycloak an identity provider using eksctl : eksctl associate identityprovider \ --wait \ --config-file - << EOF --- apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: USDCHE_EKS_CLUSTER_NAME region: USDCHE_EKS_CLUSTER_REGION identityProviders: - name: keycloak-oidc type: oidc issuerUrl: https://USDKEYCLOAK_DOMAIN_NAME/realms/che clientId: k8s-client usernameClaim: email EOF Additional resources Grant users access to Kubernetes with an external OIDC provider 3.1.5.8. Installing OpenShift Dev Spaces on {eks-short} Follow these instructions to install OpenShift Dev Spaces on {eks-short}. Procedure Prepare a CheCluster patch YAML file: cat > che-cluster-patch.yaml << EOF spec: networking: auth: oAuthClientName: k8s-client oAuthSecret: eclipse-che identityProviderURL: "https://USDKEYCLOAK_DOMAIN_NAME/realms/che" gateway: oAuthProxy: cookieExpireSeconds: 300 deployment: containers: - env: - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL value: "http://USDKEYCLOAK_DOMAIN_NAME/realms/che/protocol/openid-connect/logout?id_token_hint={id_token}" name: oauth-proxy components: cheServer: extraProperties: CHE_OIDC_USERNAME__CLAIM: email EOF Deploy OpenShift Dev Spaces: Navigate to the OpenShift Dev Spaces cluster instance: 3.2. Finding the fully qualified domain name (FQDN) You can get the fully qualified domain name (FQDN) of your organization's instance of OpenShift Dev Spaces on the command line or in the OpenShift web console. Tip You can find the FQDN for your organization's OpenShift Dev Spaces instance in the Administrator view of the OpenShift web console as follows. Go to Operators Installed Operators Red Hat OpenShift Dev Spaces instance Specification devspaces Red Hat OpenShift Dev Spaces URL . Prerequisites An active oc session with administrative permissions to the OpenShift cluster. See Getting started with the OpenShift CLI . Procedure Run the following command: oc get checluster devspaces -n openshift-devspaces -o jsonpath='{.status.cheURL}' 3.3. Permissions to install Dev Spaces Learn about the permissions required to install Red Hat OpenShift Dev Spaces on different Kubernetes clusters. Section 3.3.1, "Permissions to install Dev Spaces on OpenShift using CLI" Section 3.3.2, "Permissions to install Dev Spaces on OpenShift using web console" 3.3.1. Permissions to install Dev Spaces on OpenShift using CLI Below is the minimal set of permissions required to install OpenShift Dev Spaces on an OpenShift cluster using dsc: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: devspaces-install-dsc rules: - apiGroups: ["org.eclipse.che"] resources: ["checlusters"] verbs: ["*"] - apiGroups: ["project.openshift.io"] resources: ["projects"] verbs: ["get", "list"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "list", "create"] - apiGroups: [""] resources: ["pods", "configmaps"] verbs: ["get", "list"] - apiGroups: ["route.openshift.io"] resources: ["routes"] verbs: ["get", "list"] # OLM resources permissions - apiGroups: ["operators.coreos.com"] resources: ["catalogsources", "subscriptions"] verbs: ["create", "get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["operatorgroups", "clusterserviceversions"] verbs: ["get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["installplans"] verbs: ["patch", "get", "list", "watch"] - apiGroups: ["packages.operators.coreos.com"] resources: ["packagemanifests"] verbs: ["get", "list"] Additional resources oc apply command oc adm policy command 3.3.2. Permissions to install Dev Spaces on OpenShift using web console Below is the minimal set of permissions required to install OpenShift Dev Spaces on an OpenShift cluster using the web console: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: devspaces-install-web-console rules: - apiGroups: ["org.eclipse.che"] resources: ["checlusters"] verbs: ["*"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "list", "create"] - apiGroups: ["project.openshift.io"] resources: ["projects"] verbs: ["get", "list", "create"] # OLM resources permissions - apiGroups: ["operators.coreos.com"] resources: ["subscriptions"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: ["operators.coreos.com"] resources: ["operatorgroups"] verbs: ["get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["clusterserviceversions", "catalogsources", "installplans"] verbs: ["get", "list", "watch", "delete"] - apiGroups: ["packages.operators.coreos.com"] resources: ["packagemanifests", "packagemanifests/icon"] verbs: ["get", "list", "watch"] # Workaround related to viewing operators in OperatorHub - apiGroups: ["operator.openshift.io"] resources: ["cloudcredentials"] verbs: ["get", "list", "watch"] - apiGroups: ["config.openshift.io"] resources: ["infrastructures", "authentications"] verbs: ["get", "list", "watch"] Additional resources oc apply command oc adm policy command

Commands:
dsc server:delete
dsc server:deploy --platform openshift
dsc server:status
dsc dashboard:open
create namespace openshift-devspaces
bash prepare-restricted-environment.sh --devworkspace_operator_index registry.redhat.io/redhat/redhat-operator-index:v4.17 --devworkspace_operator_version "v0.32.0" --prod_operator_index "registry.redhat.io/redhat/redhat-operator-index:v4.17" --prod_operator_package_name "devspaces" --prod_operator_bundle_name "devspacesoperator" --prod_operator_version "v3.19.0" --my_registry " <my_registry> " 1
dsc server:deploy --platform=openshift --olm-channel stable --catalog-source-name=devspaces-disconnected-install --catalog-source-namespace=openshift-marketplace --skip-devworkspace-operator --che-operator-cr-patch-yaml=che-operator-cr-patch.yaml
ghcr.io/ansible/ansible-devspaces@sha256:a28fa23d254ff1b3ae10b95a0812132148f141bda4516661e40d0c49c4ace200 registry.access.redhat.com/ubi8/python-39@sha256:301fec66443f80c3cc507ccaf72319052db5a1dc56deb55c8f169011d4bbaacb
.ansible.com .ansible-galaxy-ng.s3.dualstack.us-east-1.amazonaws.com
AWS_ACCOUNT_ID=USD(aws sts get-caller-identity --query "Account" --output text)
CHE_EKS_CLUSTER_NAME=che
CHE_EKS_CLUSTER_REGION=eu-central-1
aws eks update-kubeconfig --region USDCHE_EKS_CLUSTER_REGION --name USDCHE_EKS_CLUSTER_NAME
get storageclass
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE gp2 (default) kubernetes.io/aws-ebs Delete WaitForFirstConsumer false 126m
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install ingress-nginx ingress-nginx/ingress-nginx --wait --create-namespace --namespace ingress-nginx --set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-backend-protocol"=tcp --set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-cross-zone-load-balancing-enabled"="true" --set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-type"=nlb
until curl USD(oc get service -n ingress-nginx ingress-nginx-controller -o=jsonpath='{.status.loadBalancer.ingress[0].hostname}'); do sleep 5s; done
<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx</center> </body> </html>
CHE_DOMAIN_NAME=eclipse-che-eks-clould.click
KEYCLOAK_DOMAIN_NAME=keycloak.USDCHE_DOMAIN_NAME
HOSTED_ZONE_ID=USD(aws route53 list-hosted-zones-by-name --dns-name USDCHE_DOMAIN_NAME --query "HostedZones[0].Id" --output text)
CANONICAL_HOSTED_ZONE_ID=USD(aws elbv2 describe-load-balancers --query "LoadBalancers[0].CanonicalHostedZoneId" --output text)
DNS_NAME=USD(oc get service -n ingress-nginx ingress-nginx-controller -o=jsonpath='{.status.loadBalancer.ingress[0].hostname}')
aws route53 change-resource-record-sets --hosted-zone-id USDHOSTED_ZONE_ID --change-batch ' { "Comment": "Ceating a record set", "Changes": [{ "Action" : "CREATE", "ResourceRecordSet" : { "Name" : "'"USDCHE_DOMAIN_NAME"'", "Type" : "A", "AliasTarget" : { "HostedZoneId" : "'"USDCANONICAL_HOSTED_ZONE_ID"'", "DNSName" : "'"USDDNS_NAME"'", "EvaluateTargetHealth" : false } } }] } '
until curl USDCHE_DOMAIN_NAME; do sleep 5s; done
aws route53 change-resource-record-sets --hosted-zone-id USDHOSTED_ZONE_ID --change-batch ' { "Comment": "Ceating a record set", "Changes": [{ "Action" : "CREATE", "ResourceRecordSet" : { "Name" : "'"USDKEYCLOAK_DOMAIN_NAME"'", "Type" : "A", "AliasTarget" : { "HostedZoneId" : "'"USDCANONICAL_HOSTED_ZONE_ID"'", "DNSName" : "'"USDDNS_NAME"'", "EvaluateTargetHealth" : false } } }] } '
until curl USDKEYCLOAK_DOMAIN_NAME; do sleep 5s; done
helm repo add jetstack https://charts.jetstack.io helm repo update helm install cert-manager jetstack/cert-manager --wait --create-namespace --namespace cert-manager --set crds.enabled=true
eksctl utils associate-iam-oidc-provider --cluster USDCHE_EKS_CLUSTER_NAME --approve
aws iam create-policy --policy-name cert-manager-acme-dns01-route53 --description "This policy allows cert-manager to manage ACME DNS01 records in Route53 hosted zones. See https://cert-manager.io/docs/configuration/acme/dns01/route53" --policy-document file:///dev/stdin <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "route53:GetChange", "Resource": "arn:aws:route53:::change/*" }, { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/*" }, { "Effect": "Allow", "Action": "route53:ListHostedZonesByName", "Resource": "*" } ] } EOF
eksctl create iamserviceaccount --name cert-manager-acme-dns01-route53 --namespace cert-manager --cluster USDCHE_EKS_CLUSTER_NAME --role-name cert-manager-acme-dns01-route53 --attach-policy-arn arn:aws:iam::USDAWS_ACCOUNT_ID:policy/cert-manager-acme-dns01-route53 --approve
apply -f - << EOF apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: cert-manager-acme-dns01-route53-tokenrequest namespace: cert-manager rules: - apiGroups: [''] resources: ['serviceaccounts/token'] resourceNames: ['cert-manager-acme-dns01-route53'] verbs: ['create'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: cert-manager-acme-dns01-route53-tokenrequest namespace: cert-manager subjects: - kind: ServiceAccount name: cert-manager namespace: cert-manager roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: cert-manager-acme-dns01-route53-tokenrequest EOF
apply -f - << EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: devspaces-letsencrypt spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: <email_address> 1 privateKeySecretRef: name: devspaces-letsencrypt-production solvers: - dns01: route53: region: USDCHE_EKS_CLUSTER_REGION role: arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/cert-manager-acme-dns01-route53 auth: kubernetes: serviceAccountRef: name: cert-manager-acme-dns01-route53 EOF
create namespace openshift-devspaces
apply -f - << EOF apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: che-tls namespace: openshift-devspaces spec: secretName: che-tls issuerRef: name: devspaces-letsencrypt kind: ClusterIssuer commonName: 'USDCHE_DOMAIN_NAME' dnsNames: - 'USDCHE_DOMAIN_NAME' - '*.USDCHE_DOMAIN_NAME' usages: - server auth - digital signature - key encipherment - key agreement - data encipherment EOF
until oc get secret -n openshift-devspaces che-tls; do sleep 5s; done
While this guide provides a development configuration for deploying Keycloak on {kubernetes}, remember that production environments might require different settings, such as external database configuration.
apply -f - <<EOF --- apiVersion: v1 kind: Namespace metadata: name: keycloak --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: keycloak namespace: keycloak labels: app: keycloak spec: secretName: keycloak.tls issuerRef: name: che-letsencrypt kind: ClusterIssuer commonName: 'USDKEYCLOAK_DOMAIN_NAME' dnsNames: - 'USDKEYCLOAK_DOMAIN_NAME' usages: - server auth - digital signature - key encipherment - key agreement - data encipherment --- apiVersion: v1 kind: Service metadata: name: keycloak namespace: keycloak labels: app: keycloak spec: ports: - name: http port: 8080 targetPort: 8080 selector: app: keycloak type: LoadBalancer --- apiVersion: apps/v1 kind: Deployment metadata: name: keycloak namespace: keycloak labels: app: keycloak spec: replicas: 1 selector: matchLabels: app: keycloak template: metadata: labels: app: keycloak spec: containers: - name: keycloak image: quay.io/keycloak/keycloak:18.0.2 args: ["start-dev"] env: - name: KEYCLOAK_ADMIN value: "admin" - name: KEYCLOAK_ADMIN_PASSWORD value: "admin" - name: KC_PROXY value: "edge" ports: - name: http containerPort: 8080 readinessProbe: httpGet: path: /realms/master port: 8080 --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: keycloak namespace: keycloak annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: '3600' nginx.ingress.kubernetes.io/proxy-read-timeout: '3600' nginx.ingress.kubernetes.io/ssl-redirect: 'true' spec: ingressClassName: nginx tls: - hosts: - USDKEYCLOAK_DOMAIN_NAME secretName: keycloak.tls rules: - host: USDKEYCLOAK_DOMAIN_NAME http: paths: - path: / pathType: Prefix backend: service: name: keycloak port: number: 8080 EOF
wait --for=condition=ready pod -l app=keycloak -n keycloak --timeout=120s
until oc get secret -n keycloak keycloak.tls; do sleep 5s; done
exec deploy/keycloak -n keycloak -- bash -c "/opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin && /opt/keycloak/bin/kcadm.sh create realms -s realm='che' -s displayName='che' -s enabled=true -s registrationAllowed=false -s resetPasswordAllowed=true && /opt/keycloak/bin/kcadm.sh create clients -r 'che' -s clientId=k8s-client -s id=k8s-client -s redirectUris='[\"*\"]' -s directAccessGrantsEnabled=true -s secret=eclipse-che && /opt/keycloak/bin/kcadm.sh create users -r 'che' -s username=test -s email=\"test@test.com\" -s enabled=true -s emailVerified=true && /opt/keycloak/bin/kcadm.sh set-password -r 'che' --username test --new-password test"
eksctl associate identityprovider --wait --config-file - << EOF --- apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: USDCHE_EKS_CLUSTER_NAME region: USDCHE_EKS_CLUSTER_REGION identityProviders: - name: keycloak-oidc type: oidc issuerUrl: https://USDKEYCLOAK_DOMAIN_NAME/realms/che clientId: k8s-client usernameClaim: email EOF
cat > che-cluster-patch.yaml << EOF spec: networking: auth: oAuthClientName: k8s-client oAuthSecret: eclipse-che identityProviderURL: "https://USDKEYCLOAK_DOMAIN_NAME/realms/che" gateway: oAuthProxy: cookieExpireSeconds: 300 deployment: containers: - env: - name: OAUTH2_PROXY_BACKEND_LOGOUT_URL value: "http://USDKEYCLOAK_DOMAIN_NAME/realms/che/protocol/openid-connect/logout?id_token_hint={id_token}" name: oauth-proxy components: cheServer: extraProperties: CHE_OIDC_USERNAME__CLAIM: email EOF
dsc server:deploy --platform k8s --domain USDCHE_DOMAIN_NAME --che-operator-cr-patch-yaml che-cluster-patch.yaml --skip-cert-manager --k8spodreadytimeout 240000 --k8spoddownloadimagetimeout 240000
dsc dashboard:open
get checluster devspaces -n openshift-devspaces -o jsonpath='{.status.cheURL}'
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: devspaces-install-dsc rules: - apiGroups: ["org.eclipse.che"] resources: ["checlusters"] verbs: ["*"] - apiGroups: ["project.openshift.io"] resources: ["projects"] verbs: ["get", "list"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "list", "create"] - apiGroups: [""] resources: ["pods", "configmaps"] verbs: ["get", "list"] - apiGroups: ["route.openshift.io"] resources: ["routes"] verbs: ["get", "list"] # OLM resources permissions - apiGroups: ["operators.coreos.com"] resources: ["catalogsources", "subscriptions"] verbs: ["create", "get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["operatorgroups", "clusterserviceversions"] verbs: ["get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["installplans"] verbs: ["patch", "get", "list", "watch"] - apiGroups: ["packages.operators.coreos.com"] resources: ["packagemanifests"] verbs: ["get", "list"]
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: devspaces-install-web-console rules: - apiGroups: ["org.eclipse.che"] resources: ["checlusters"] verbs: ["*"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "list", "create"] - apiGroups: ["project.openshift.io"] resources: ["projects"] verbs: ["get", "list", "create"] # OLM resources permissions - apiGroups: ["operators.coreos.com"] resources: ["subscriptions"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: ["operators.coreos.com"] resources: ["operatorgroups"] verbs: ["get", "list", "watch"] - apiGroups: ["operators.coreos.com"] resources: ["clusterserviceversions", "catalogsources", "installplans"] verbs: ["get", "list", "watch", "delete"] - apiGroups: ["packages.operators.coreos.com"] resources: ["packagemanifests", "packagemanifests/icon"] verbs: ["get", "list", "watch"] # Workaround related to viewing operators in OperatorHub - apiGroups: ["operator.openshift.io"] resources: ["cloudcredentials"] verbs: ["get", "list", "watch"] - apiGroups: ["config.openshift.io"] resources: ["infrastructures", "authentications"] verbs: ["get", "list", "watch"]