Deploy che server Pod failed on openshfit OKD 3.11 with mulit user deployment #12033
Comments
Caplost
changed the title
sleshchenko
added
the
kind/bug
|
@Caplost are you behind a proxy? Che server cannot reach this url. Namely, it cannot resolve it |
ghost
added
kind/question
|
@eivantsov Thank you for your reply ！ I have not use proxy ，keycloak access just use OKD router . another thing I found is when it creating Che server container , access it use okd terminal run command curl http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/.well-known/openid-configuration. it shows cannot resolve the url. But useing Debug in Terminal of okd pod curl command works ok. is that means when creating che server container it cannot access internet ? run curl http://www.google.com also shows cannot resolve the url I checked the dns /etc/resolv.conf it's the same as other pod which can access keycloak; another things I miss ？ |
|
anyone deploy Eclipse Che on OKD 3.11 ? |
|
@eivantsov single-user eclipse/che-server image deploy success on OKD 3.11 |
|
Yes, Che is ok with OKD 3.11 I'd try just deploy some image like nginx, expose a service and curl its route from within the pod. There's a networking issue that you need to solve. |
|
@Caplost are you using minishift? OS of the host? |
|
@skabashnyuk it's a public instance with a real DNS http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/.well-known/openid-configuration @Caplost i highly recommend running the test I have suggested. Let's take Che out of equation for a moment. Just deploy nginx, expose service and try to curl its route from within the pod. |
|
@eivantsov I have run the test your suggested which just deploy nginx, and curl its route from within pod is ok with using okd default nginx image and any other url also can accessed by curl； By the way , the OKD 3.11 which just newly inserted with its default setting by ansible, other images which deployed ok，route also can accessed from within it 。 is my test catch the point ？ |
|
@Caplost all deployments and pods that are created during installation, do not differ from any other pods that you create. I don;t know why it works for nginx and does not work for Keycloak. Can you post screenshots of a working curl route? |
|
@eivantsov / $ ip addr |
|
@Caplost i ask just for a confirmation that you can run other deployments and routes are accessible from within the pod |
|
@eivantsov che-server cannot access any public url , |
|
It's just a mere k8s deployment. You need to find out what the issue is. By the way, having a url with a service name won't work, since this url should be accessible to clients, ie browsers that users will open to access Che. |
|
@eivantsov Thank you for your patience. |
|
@Caplost service name won't work, when you try to log in, unless your browser is in cluster network. Here's deployment yaml for Che server: https://github.com/eclipse/che/blob/master/deploy/openshift/templates/che-server-template.yaml Che has even not come into play at this point. |
|
@eivantsov Should it use the url with a service name just at che-server get auth from keycloak server ? |
|
Yes, I was thinking about it too. But you have got connectivity issues in your cluster anyway, it does not solve the initial problem |
|
I don't know why it works for other pods which can curl public network , just che-server not 😩 |
|
@eivantsov I try eclipse/che-server with tag nightly-centos it works ok ,but eclipse/che-server:nightly still not work. |
Hi, Caplost |
|
@fishingwind you can change eclipse/che-server:nightly which is default docker image to eclipse/che-server:nightly-centos ,it may the docker image problem. |
|
I expierence the same problem on our test cluster which is version 17.3 and has been setup using kubeadm. fetching the said URL with curl works fine from containers deployed on the same node. |
useing ./deploy_che.sh --multiuser command to auto deploy success
but eclipse/che-server:nightly image deploy fail.
it shows
Full Che Server Logs
The content of http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/.well-known/openid-configuration
Keycloak Openid Configuration
{"issuer":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che","authorization_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/auth","token_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/token","token_introspection_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/token/introspect","userinfo_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/userinfo","end_session_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/logout","jwks_uri":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/certs","check_session_iframe":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/protocol/openid-connect/login-status-iframe.html","grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials"],"response_types_supported":["code","none","id_token","token","id_token token","code id_token","code token","code id_token token"],"subject_types_supported":["public","pairwise"],"id_token_signing_alg_values_supported":["RS256"],"userinfo_signing_alg_values_supported":["RS256"],"request_object_signing_alg_values_supported":["none","RS256"],"response_modes_supported":["query","fragment","form_post"],"registration_endpoint":"http://keycloak-eclipse-che.openshift.qycloud.com.cn/auth/realms/che/clients-registrations/openid-connect","token_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post"],"token_endpoint_auth_signing_alg_values_supported":["RS256"],"claims_supported":["sub","iss","auth_time","name","given_name","family_name","preferred_username","email"],"claim_types_supported":["normal"],"claims_parameter_supported":false,"scopes_supported":["openid","offline_access"],"request_parameter_supported":true,"request_uri_parameter_supported":true}OS and version:
openshift okd : 3.11
docker version : 1.13
The text was updated successfully, but these errors were encountered: