Don't allow installing Che with Openshift Oauth when no OAuth user exist

[davidfestal]

Describe the bug

On a brand new Openshift 4 cluster, you have only the kubeadmin user (which is not part of the OS 4 OAuth system). If you try to connect to Che Dashboard through the Openshift login as kubeadmin, you will get a bad Keycloak error message with no error at all, and nothing in Che logs.

So we have to find a way to prevent the Che operator to start a Che workspace if the operator detects that there is no OAuth login method / users available (if there is only kubeadmin)
We have to be sure that we tackle the use-case when a tester would try to start a Che server on a brand new cluster (without having setup real users first)

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

On a new Openshift 4 cluster:

0. Install a Che server through the Che operator
1. Try to access the Che Dashboard
2. On the login page, Click the openshift-v4 link
3. Login to Openshift with the kube:admin method under the kubeadmin user
4. You will get a Keycloak authentication failure error

Expected behavior

The installation of the Che server should fail with a decent error message (in the CheCluster resource status) if the Openshift cluster OAuth hasn't been setup and no Openshift user is available apart from the temporary / special kubeadmin user.

Runtime

• kubernetes (include output of kubectl version)
• Openshift 4
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Screenshots

Installation method

• chectl
• che-operator
• minishift-addon
• I don't know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

[slemeur]

linking to: #13975

[tolusha]

@davidfestal Can we close the issue since eclipse-che/che-operator#74 is merged?

[smarterclayton]

I don’t understand what “ On a brand new Openshift 4 cluster, you have only the kubeadmin user (which is not part of the OS 4 OAuth system)” means. The kubeadmin user is certainly supported for oauth flows as part of its design (console and prometheus both can do oauth).

Can you describe exactly what is broken with kubeadmin so we can fix it and CRW can work ootb on an openshift cluster?

[dmytro-ndp]

The issue must have been fixed in keycloak 8.0.0, but CRW depends on RH SSO.
Anyway, we can probably switch che-keycloak to 8.0.0 and check fixup in Eclipse Che.
@tolusha, @skabashnyuk, @l0rd, @davidfestal: WDYT?

[l0rd]

Discussed with @davidfestal and @tolusha this morning. I have described our plan to overcome this limitation here.