Unable to create devworkspace: Unauthorized

[Ryder05]

Describe the bug

When i try to create a new devworkspace an error shows up saying " Failed to create a workspace. Failed to create a new workspace from the devfile, reason: Failed to create a new workspace. Unable to create devworkspace: Unauthorized "

Che version

7.44@latest

Steps to reproduce

1. chectl server:deploy --domain=che.xxx.eu --platform=k8s --che-operator-cr-yaml=checluster.yml --skip-oidc-provider-check -n che

Expected behavior

A devworkspace starts up =.

Runtime

Kubernetes (vanilla)

Screenshots

Installation method

chectl/latest

Environment

Windows

Eclipse Che Logs

No response

Additional context

Checluster file used in deployment.

apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: eclipse-che
spec:
  auth:
    externalIdentityProvider: true
    #identityProviderIngress: traefik
    identityProviderClientId: 'eclispe-che'
    identityProviderRealm: opencell
    identityProviderURL:  https://kc.osama-che.me/auth/realms/opencell/
    openShiftoAuth: false
    updateAdminPassword: false
    identityProviderPassword: 'admin' 

  server:
    serverExposureStrategy: 'multi-host'
    workspaceNamespaceDefault: che-ws-<username>
    #cheServerIngress: "traefik"
    customCheProperties:
      CHE_OIDC_USERNAME__CLAIM: "email"
      CHE_INFRA_KUBERNETES_TLS__SECRET: ''
      CHE_KEYCLOAK_CLIENT__ID: 'eclipse-che'
      CHE_KEYCLOAK_REALM: 'opencell'

      CHE_INFRA_KUBERNETES_INGRESS_ANNOTATIONS__JSON: 
        '{
          "kubernetes.io/ingress.class": "nginx", 
          "nginx.ingress.kubernetes.io/affinity": "true", 
          "nginx.ingress.kubernetes.io/rewrite-target": "/",
          "ingress.kubernetes.io/ssl-redirect": "true",
          "ingress.kubernetes.io/force-ssl-redirect": "true" 
        }'
  database:
    externalDb: false

  k8s:
    tlsSecretName: 'che-tls'
    ingressClass: 'nginx'
    ingressDomain: 'che.xxx.eu'  
    ingressStrategy: 'multi-host'
    securityContextRunAsUser: '0'
    securityContextFsGroup: '0'

[benoitf]

Hello, we can see a certificate error
Do you have validated the self-signed certificate ?

[Ryder05]

Hello, we can see a certificate error Do you have validated the self-signed certificate ?

i downloaded the self signed certificate and imported it in Trusted Root Certificate Authorities, but it is still not valid "windows does not have enough information to verify this certificate"

[Ryder05]

It seems roles, bindings and serviceaccounts are not created. Should this be done by eclipse che ?

[l0rd]

@Ryder05 have you setup an OIDC provider for authentication on your cluster? On what Kubernetes are you testing this (minikube, eks, gke...) ?

[Ryder005]

@Ryder05 have you setup an OIDC provider for authentication on your cluster? On what Kubernetes are you testing this (minikube, eks, gke...) ?

Hello, I am using an externeal keycloak as an OIDC and i am using a full managed kubernetes provided by OVH cloud.

[homains-ou]

Having the same issue with version 7.46.0

[Ryder05]

Having the same issue with version 7.46.0

I finally resolved the problem by configuring Keycloak as an OIDC provider for my Kubernetes cluster.
#21049 (comment)

[tolusha]

Can we close this issue?