Expose internal Servers with localhost on Kubernetes/OpenShift infrastructures

[sleshchenko]

Description

The current way of exposing internal server may have the following security issue: in a case when Che is configured to use the same namespace for workspaces of different users, there is an ability for a user to request another user internal servers.

Initially, internal servers were implemented for Language Server that doesn't have any authentication. So, it would be more secure to not to create any services for exposing internal servers and return localhost as host of internal server. Since Language server and workspace agent (or theia server side) should be in the same pod because of using the same projects volume, LS can be requested by using URL similar to tcp://localhost:4393

So, it is needed expose internal Servers with localhost on Kubernetes/OpenShift infrastructures.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.