Configure OpenShift oAuth client for the OpenShift oAuth provider by operator

[vinokurig]

Is your enhancement related to a problem? Please describe.

The OpenShift oAuth provider which was introduced by #15963 must be manually configured to corresponding OpenShift oAuth client: https://www.eclipse.org/che/docs/che-7/configuring-openshift-oauth/. We can get rid of manual configuring by applying a new option for workspace:start command in the che-operator (similar to --os-oauth in the chectl) which will create a new oAuth client for OpenShift and then propagate related values to the OpenShift oAuth provider.

Describe the solution you'd like

Describe alternatives you've considered

Additional context

depends on #15963

[ibuziuk]

@tolusha adding team/deploy label

[ibuziuk]

setting P1 but I'm not sure about priority for this particular issue

[l0rd]

applying a new option for workspace:start command

@vinokurig workspaces:start is a chectl command, you want to automate the creation of the client at the operator level right?

[davidfestal]

In the case when openshiftOAuth mode is already enabled in the Che operator, we could probably explore the ability to reuse the existing OAuth client already created by the operator, instead of creating a second one ?

[vinokurig]

@l0rd

workspaces:start is a chectl command, you want to automate the creation of the client at the operator level right?

It supposed to be automated at the operator level, but chectl should have an ability to control this option.

@davidfestal
I don't like the idea of reusing existing openshiftOAuth mode because user might want to use the OpenShift provider separately from the openshiftOAuth mode.

[vinokurig]

Currently I am stuck on getting the openshift endpoint url by k8s api. I need it to pass the env variables to che server. @benoitf @davidfestal any ideas?

[vinokurig]

Depends on #16488. It will bring the ability to use openshift oauth provider as a keycloack identity provider, similar to --os-oauth chectl option

[vinokurig]

Since we have switched to keycloak authentication (#16488) the openshift oauth API uses existing OAuth client which is already created by the operator.