Che 7.17.0 - empty theia with TLS enable and proxy set #17600
Labels
area/install
Issues related to installation, including offline/air gap and initial setup
kind/bug
Outline of a bug - must adhere to the bug report template.
severity/P1
Has a major impact to usage or development of the system.
Milestone
Comments
disaster37
added
the
kind/bug
che-bot
added
the
status/need-triage
benoitf
changed the title
|
@disaster37 |
|
Yes of course. Without it, che pod not started. |
|
I've tried helm + minikube + squid proxy (configured on aws) Workspace was started and project cloned. |
|
Have you enable TLS with self signed certificate ? |
|
yes, sure, |
|
Hum, can you try without certmanager, and use self signed certificate. Maybee issue is because of some resource can be accessed because ca.crt not know ? I will try to start withtout proxy, but I need to disable plugins when I deploy workspace... |
|
I have removed proxy setting, and redeploye che. When I run again the workspace, I get the same matter. I confirm that proxy is removed (echo $http_proxy, echo $https_proxy is empty on theia pod) |
|
I don't know I theia pod try to access on che with public URL to grab some context ... |
|
@disaster37 |
If you do not use Cert Manager with Helm installer, please make sure that |
|
@mmorhun, yes it set. Without create this secret and key, kubernetes doesn't lauch pods because of it stay that is created. |
|
@tolusha, the curl command work fine, no certs issue. |
|
If I put chrome on dev mod (aka f12), i look this error when access on theia workspace: |
|
@disaster37 have you added your CA cert into the browser? |
|
@mmorhun, Yes chrome say that a certificate is valid... |
|
No, proxy server not open https flow. |
|
Note: CodeReady Workspaces users have reported a similar issue.
|
|
I created tls and self-signed-certificate secrets manually. |
|
To be sure, all compoents use cluster IP or ingress (https) to communicate? Because of there are firewall between my workstation and the kube cluster. Only http / https is allowed ... |
|
Eclipse Che requires websocket (wss://) to be allowed. Stacktrace is probably a consequence of inability to reach Che server from within a workspace. |
|
Yes of course, but wss is not encapsuled over https ? |
|
/cc @azatsarynnyy |
|
Our security team confirm that there are not kind of access denied on firewall between my workstation en K8S cluster. |
amisevsk
added
area/editor/theia
|
Hi, I have lauch che on cloud cluster without proxy and use cert-manager. It work fine and I have compared the error messages on chrome devtools. The main difference error are (I hope is help you): |
|
And on theia pod: |
|
@disaster37
|
|
from anywhere or on particular pod ? |
|
From you local machine. |
|
It's Ok, ca.crt and server.crt is the same contend. |
|
And my certificate is valide for and the che url URL is che.rancher-hpd.company.com |
|
Hello @disaster37, |
|
Could you clarify pls |
|
Both command is the same because both file are the the same ;) |
bash-5.0$ cat /home/theia/node_modules/@eclipse-che/workspace-client/package.json | grep version
"version": "0.0.1-1597050739", |
Thanks @disaster37 I thought maybe you have the previous version of |
|
That's unusual case. |
|
Hum I have generated certs with your script and now all work fine. But in my case we have enterprise PKI that sign our certificat request. So my cert call che.crt is signed by our pki. In secret che-tls I put my che.crt and che.key. So I have testted the 2 commande below: server.crt contain my certificate signed by PKI. |
|
The scenario you've described with PKI is correct. |
|
I finally invert the concatenation of my ca.crt and it work fine ;) Very thx for your help... |
|
I am glad to hear that! |
tolusha
added
area/install
|
Based on close date and sprint details, I've set milestone to 7.18. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
After deploy fresh CHE 7.17.0 on K8S with helm, and after deploy the first workspace
go, theia is empty (no repo, no plugin, no terminal, etc ...).We deploy CHE with following topology:
We found only errors on theia pod:
Che version
Steps to reproduce
go.Expected behavior
access to theiga, with sample project, go cli terminal and go plugins to support go language dev.
Runtime
kubectl version)oc version)minikube versionandkubectl version)minishift versionandoc version)docker versionandkubectl version)Screenshots
Installation method
chectl versioncommandEnvironment
Eclipse Che Logs
Additional context
The text was updated successfully, but these errors were encountered: