POC: OpenShift k8s API proxy as HTTP gateway for DevWorkspace operator

[skabashnyuk]

Is your task related to a problem? Please describe.

We want to expose K8s api to the dashboard. #17307 (comment)
So clients can directly communicate with DevWorkspace operator by creating/updating/reading CR
or other workspace related k8s resources

Describe the solution you'd like

• Study how Openshift console is communicating with k8s.
  https://github.com/openshift/console/blob/2e5051fd5c7e6b0ca170c9fd8ab711cb49dc67c4/pkg/server/server.go#L242

Describe alternatives you've considered

n/a

Additional context

#17307

[metlos]

I'm looking for a ready-made solution that we could use without needing to maintain code ourselves.

Here are the requirements I have on the solution:

• ability to work with different oauth2 providers (the ability to use openshift oauth is mandatory here)
• ability to work on plain k8s as well as openshift

So far I have identified 2 candidate solutions:

• https://github.com/openshift/console
• https://github.com/oauth2-proxy/oauth2-proxy

OpenShift Console

I have tried to directly use the openshift console (with a replaced "frontend"). This should work well with openshift but is lacking good support for other identity providers or even OpenID Connect due to for example hardcoded oauth scopes or token name. Also, the backend code of OpenShift console is taking care of much more stuff (monitoring, etc.) that we don't require from this solution.

OAuth2 Proxy

This is a generic, highly configurable authenticating reverse proxy that can be made to work with variety of identity providers including keycloak, github, gitlab, azure, etc.

It seems to be capable of everything oauth-related but is lacking in the routing. It can handle multiple "upstreams" and distinguish between them based on the request URL path, but it needs to have another path rewriting proxy before or after it to support proper more advanced routing (like prefix stripping etc). Not sure if we need the routing capabilities though, nor if solving it with another reverse proxy in the chain would be acceptable.

I have not yet tried it with OpenShift OAuth directly without a middleman like keycloak.

[metlos]

There's a project with my testing deployments: https://github.com/metlos/k8s-api-proxy-poc

[metlos]

This is postponed until after we implement #18326.