How to run Che on Openshift 3.11 in a local network #16417
Comments
ultrafab
added
the
kind/bug
che-bot
added
the
status/need-triage
Could you share more? It's only error but the whole stack trace could also contain a cause of it, like missing SAN in cert,... |
ibuziuk
added
team/controller
status/analyzing
|
Hello @sleshchenko The only exception in the log file is: And it's repeated about 40 times, once for every try to read from keycloack. |
sleshchenko
added
area/install
|
@ultrafab You already provided needed log entry, it's:
For some reason, keycloak-che.192.168.69.245.nip.io is not available from Che container... I don't see how it's related to TLS and self-signed cert, for me it seems that you have some DNS configuration issues on your OpenShift 3.11 |
|
Thank you! The URL is working locally, trying to use WGET i got a response, but i've to use the "--no-check-certificate", so i tought was something related. I'll try to better check for a DNS issue. Anyway, could you provide me any hint, i'm quite new with Openshift. |
|
@ultrafab |
|
@tolusha |
|
Hello! Yes, i can confirm i've followed the provided doc. Here #16417 (comment) there are the scripts i've made to launch the commands chain. The only difference is that i've used |
|
@ultrafab could you please clarify which infrastructure exactly you are using? I mean is it running on real Openshift 3.11 cluster or inside Minishift or other environment. |
|
Hello, It's an Openshift 3.11 single node, installed on a Ubuntu 18.04 server, inside a private network. I've installed Openshift, following this guide: https://www.techrepublic.com/article/how-to-install-openshift-origin-on-ubuntu-18-04/ The needing is to have a Eclipse Che multiuser installation to test on a private network. Here you can find chectl and oc versions: #16417 (comment) |
tolusha
removed
status/analyzing
|
@ultrafab Could you share |
|
Hello, I can ping and browse internet without problem from this host. But there's an update. To complete the infrastructure i've create a Right now i'm able to reach the |
|
@ultrafab But Che Server is still not as lucky as you and can't access keycloak? |
|
@ultrafab could you try to reach keycloak url from within Che server container ? To simplify the task, you may use plugin registry container (as they are in the same pod):
|
|
@ultrafab also please check whether |
|
Hi @mmorhun , thanks for the insight. Here you can find the curl/ping against the keycloack service, and against phisical ID of the KVM machine and the phisical host (just to test the container network): It seems i cannot resolve the host name. Also there is the cert file in: |
|
UPDATE: but CHE server is raising the same exception, not resolving keycloak endpoint. Deploying a blank Alpine image inside the same machine, and logging i can ping and resolve the |
|
@ultrafab I've faced the same situation: I can ping both, but cannot resolve the hostname inside Che pod. The curious fact is that when I start a container in the VM (which is NOT part of the Openshiift 3.11 cluster) I can resolve the domain name and query keycloak via curl and get response. works from within a container in the VM and doesn't work from within a container (pod) which belongs to Openshift cluster. Presence of the self-signed certificate in the Che server container confirms that Che processed TLS part in the correct expected way. Error might happen only if certificate is wrong (usually has other (wrong) CN and/or SAN (most likely) ). |
|
Also, after modifying docker configuration by adding your DNS, have you tried to curl keycloak by domain name from Che pod? What's inside |
|
Hello @mmorhun , logging inside the doing a cat of |
|
@mmorhun update it works now referring to docs in: https://docs.openshift.com/container-platform/3.11/install/prerequisites.html i've found that Openshift 3.11 just inject DNS servers found in I've create a static Now Eclipse CHE starts and it's reachable via Now i'm testing if it's fully functional |
|
I got it working in a bit different way. In my case, I didn't change VM's |
|
Just for case, posting my steps (which worked for me in my home network) here:
sudo systemctl restart docker
oc cluster up --public-hostname=che.local.net --routing-suffix=che.local.net
CA_CN=eclipse-che-signer
DOMAIN=*.che.local.net
OPENSSL_CNF=/etc/ssl/openssl.cnf
# Generate CA key
openssl genrsa -out ca.key 4096
# Generate root CA certificate
openssl req -x509 -new -nodes -key ca.key -sha256 -days 1024 -out ca.crt -subj /CN=${CA_CN} -reqexts SAN -extensions SAN -config <(cat $OPENSSL_CNF <(printf '[SAN]\nbasicConstraints=critical, CA:TRUE\nkeyUsage=keyCertSign, cRLSign, digitalSignature'))
# Generate server key
openssl genrsa -out domain.key 2048
# Create certificate request for the domain
openssl req -new -sha256 -key domain.key -subj "/O=Local Eclipse Che/CN=${DOMAIN}" -reqexts SAN -config <(cat $OPENSSL_CNF <(printf "\n[SAN]\nsubjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=digitalSignature, keyEncipherment, keyAgreement, dataEncipherment\nextendedKeyUsage=serverAuth")) -out domain.csr
# Create certificate for the domain
openssl x509 -req -extfile <(printf "subjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=digitalSignature, keyEncipherment, keyAgreement, dataEncipherment\nextendedKeyUsage=serverAuth") -days 365 -in domain.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out domain.crtNote, that for Fedora
oc login -u system:admin --insecure-skip-tls-verify=true
oc project default
oc delete secret router-certs
cat domain.crt domain.key > minishift.crt
oc create secret tls router-certs --key=domain.key --cert=minishift.crt
oc rollout latest router
oc create namespace che
oc create secret generic self-signed-certificate --from-file=ca.crt -n=che
chectl server:start --platform=openshift --installer=operator --multiuser --self-signed-cert -n che
P.S. oc delete namespace chestop the cluster with oc cluster downedit config and run the cluster again, so go to step Also it is possible to configure DNS in a different way as @ultrafab suggested. |
|
@ultrafab thank you for this issue and for being active in the resolution process! I am changing the title as the problem doesn't related to TLS. |
mmorhun
changed the title
mmorhun
added
area/doc
It's all correct! Just a last insight, we (usually) don't need to modify DNS provided by the office DHCP server for two reasons: only the developers are using the Che/k8s domain and also we usually connect with a VPN client to the server, so we let the opevnp script to push the custom DNS. So we prefer to hack the single developers machines. Otherwise let the DHCP server provide also the custom DNS seems to be the best way. |
After reading:
#16280
i still was unable to start eclipse, using:
chectl server:start -n=che --platform=openshift --installer=operator --tls --self-signed-cert --che-operator-cr-patch-yaml=./patch.yamlInside
patch.yamlFrom log the error is:
Exception while retrieving OpenId configuration from endpoint: https://keycloak-che.192.168.69.245.nip.io/auth/realms/che/.well-known/openid-configurationUsing wget the URL is working (apart an unsigned certificate exception).
I've created certs and installed with:
Openshift is running on a Ubuntu 18.04 server pristine VM.
The text was updated successfully, but these errors were encountered: