Support multi-tenancy on OSIO

[l0rd]

Schedule

• 14 Nov #395 is closed and we can run OSIO workshop with multi-tenant Che successfully on pre-prod DONE
• 17 Nov #404 is closed and we can provision MT tenant namespaces on pre-prod DONE
• 20 Nov We deploy MT Che on prod serving a restricted list of user (Che team only)
• 27 Nov We open MT Che to a second list of tenants (e.g. all devtools eng) and tenant init runs a migration script restore users workspaces in MT Che
• 04 Dec MT Che servers all osio users and che-data PVs in tenant namespaces can be deleted

Subtasks

Run multi user-che on OSIO

• Port KC support to upstream che
• Port authorization mechanism to upstream che
• Make multi tenancy work on OpenShift (KC and postgre running in OpenShift pods)
• Support multi OS cluster (master and agents in distinct clusters) #344 #301
• rh-che update: remove KC support and use v5.19.0 #372
• Resolve open issues:
  • Stop all user workspaces when master is stopped #345
  • Bayesian token #376
  • Check if /wsmaster/api/preferences works and fill user preferences #231
  • Check that /wsmaster/api/token/github sets current user github token #231
  • Export and restore workspace metadata for all users (not /projects folder) #377
  • Port to multi-tenant branch missing commits from rh-che master branch Port to multi-tenant branch missing commits from rh-che master branch #440
  • Analyze and eventually fix errors seen in pre-prod [multi-tenant] java.io.IOException: unexpected end of stream on Connection #437 Could not retrieve OSO token from Keycloak token #436
• Update che-starter #226
  • Remove wsmaster un-idling
  • Remove che routes gathering
  • Support both single and multi-tenant (e.g. dfestal will uses multi-user, single for ther rest)
• Remove workspaces PVC in wsmaster deployment config (init-tenant will take care of it) #345
• Update Che status in openshift.io landing page #1423

CI and Deployment

• Centos-CI should build both multi and single user images (distinct branches and jobs) #378
• Update init-tenant script (with platform team) #404
• Update functional tests to work with multi-user on pre-prod/free-int (with Radim)
• New fabric8-services repo for the deployment config yaml (fabric8-che) (with fabric8-cd team)
• New fabric8 version-updater job to publish DC on mvn central (with fabric8-cd team)

Infrastructure

• Test in real conditions (HTTPS, che-starter, RHD KC, postgre) #372
• Test on pre-prod to test codebase integratation (run osio workshop) (with SD team) #395
• Define/setup Postrgre (prod and stage) and set connection details in DC (with SD team)
• Provide access to che logs on prod and pre-prod to the Che team (with SD team) #312

Overview

Currently every openshift.io user has it's own single user che-server. That don't scale. We need to have a central che-server (running on OSD) that is able to run Che workspaces on tenant namespaces (on OSO).

Old subtask are here.

[gorkem]

@ibuziuk Do we need an issue for implementing the population of workspace github preferences from Keycloak that che-starter does and add it to this epic?

[ibuziuk]

@gorkem yes, but the main thing is that now preferences are set per che-server via wsmaster API, so first need to have mechanism in place for setting preferences per user or per workspace

[gorkem]

@ibuziuk Che actually always have a user, on the current one it is a fixed user. So I suspect ws-master APIs on Che actually update preferences for the currently authenticated user and are already multi-tenant ready but @benoitf can confirm.

[benoitf]

So yes Che is having only one user and it will update preferences of the current authenticated user
https://github.com/eclipse/che/blob/master/wsmaster/che-core-api-user/src/main/java/org/eclipse/che/api/user/server/PreferencesService.java#L122

In codenvy user is set there https://github.com/codenvy/codenvy/blob/ca5ba8d98e66351bf8b89df28e7d73ac7c06bbaa/wsmaster/codenvy-hosted-sso-client/src/main/java/com/codenvy/auth/sso/client/DefaultTokenHandler.java#L60

[slemeur]

@l0rd : Can this epic be closed since you successfully deploy che-mt to all users on OSIO? ;)

[l0rd]

@slemeur yes we can close it