Eclipse Che Dashboard is not showing with error OPTIONS request to "/api/" failed, reason: "500 ".

[Ryder005]

Describe the bug

Ffter successfully deploying Eclipse Che, when I open the dashboard URL and after logging in, An error shows up saying OPTIONS request to "/api/" failed, reason: "500 ".

Che version

7.44@latest

Steps to reproduce

1.chectl server:deploy --domain=osama.oc-perf.eu --platform=k8s --che-operator-cr-patch-yaml=checluster.yml --skip-oidc-provider-check --che-operator-image=quay.io/eclipse/che-operator:7.45.0 -n che

2. Creating a keycloak client and user

3. logging in

Expected behavior

I see the dashboard and starts crating workspaces

Runtime

Kubernetes (vanilla)

Screenshots

Installation method

chectl/latest

Environment

Windows

Eclipse Che Logs

PS C:\Users\Oussema Mhiri\Downloads> chectl server:deploy --domain=osama.oc-perf.eu --platform=k8s  --che-operator-cr-patch-yaml=checluster.yml  --skip-oidc-provider-check --che-operator-image=quay.io/eclipse/che-operator:7.45.0 -n che
› Installer type is set to: 'operator'
› Current Kubernetes context: 'kubernetes-admin@perf'
  √ Verify Kubernetes API...OK
  √ 👀  Looking for an already existing Eclipse Che instance
    √ Verify if Eclipse Che is deployed into namespace "che"...it is not
  √ 🧪  DevWorkspace engine
    √ Verify cert-manager installation
      √ Check Cert Manager deployment...already deployed
      √ Wait for Cert Manager...ready
  √ ✈️  Kubernetes preflight checklist
    √ Verify if kubectl is installed
    √ Verify remote kubernetes status...done.
    √ Check Kubernetes version: Found v1.22.2.
    √ Verify domain is set...set to osama.oc-perf.eu.
    ↓ Check if cluster accessible [skipped]
  √ Following Eclipse Che logs
    √ Start following Operator logs...done
    √ Start following Eclipse Che Server logs...done
    √ Start following PostgreSQL logs...done
    √ Start following Keycloak logs...done
    √ Start following Plug-in Registry logs...done
    √ Start following Devfile Registry logs...done
    √ Start following Eclipse Che Dashboard logs...done
    √ Start following namespace events...done
  √ Create Namespace che...[Exists]
  √ Create Namespace che...[Exists]
  √ 🏃‍  Running the Eclipse Che operator
    √ Create ServiceAccount che-operator in namespace che...done.
    √ Read Roles and Bindings...done.
    √ Creating Roles and Bindings...done.
    √ Create CRD checlusters.org.eclipse.che...It already exists.
    √ Waiting 5 seconds for the new Kubernetes resources to get flushed...done.
    √ Create deployment che-operator in namespace che...done.
    √ Operator pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Prepare Eclipse Che cluster CR...Done.
    √ Create the Custom Resource of type checlusters.org.eclipse.che in the namespace che...done.
  > ✅  Post installation checklist
  > ✅  Post installation checklist
  √ ✅  Post installation checklist
    √ PostgreSQL pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Devfile Registry pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Plug-in Registry pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Eclipse Che Dashboard pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Eclipse Che Server pod bootstrap
      √ Scheduling...done
      √ Downloading images...done
      √ Starting...done
    √ Eclipse Che status check...done
  √ Retrieving Che self-signed CA certificate...OK
  √ Prepare post installation output...done
  √ Show important messages
    √ Eclipse Che '7.45.0' has been successfully deployed.
    √ Documentation             : https://www.eclipse.org/che/docs/
    √ -------------------------------------------------------------------------------
    √ Users Dashboard           : https://che.oc-perf.eu/dashboard/
    √ -------------------------------------------------------------------------------
    √ Plug-in Registry          : https://che.oc-perf.eu/plugin-registry/v3/
    √ Devfile Registry          : https://che.oc-perf.eu/devfile-registry/
    √ -------------------------------------------------------------------------------

Additional context

checluster.yml file used in deployment

apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: eclipse-che
spec:
  auth:
    externalIdentityProvider: true
    identityProviderClientId: kubernetes
    identityProviderRealm: git-dev
    identityProviderURL:  http://51.210.211.139:443/auth/realms/git-dev  
    openShiftoAuth: false
    updateAdminPassword: false


  server:
    #cheHost: http://che.oc-perf.eu/
    cheServerIngress:
      # labels: {}
      annotations:
        kubernetes.io/tls-acme: "true"
    customCheProperties:
      CHE_OIDC_USERNAME__CLAIM: "email"

  k8s:
    ingressClass: traefik
    ingressDomain: che.oc-perf.eu
    tlsSecretName: tls-che
 

keycloak.yml file

---
  apiVersion: "apps/v1"
  kind: "Deployment"
  metadata: 
    name: "keycloak-development"
    #namespace: "che"
  spec: 
    selector: 
      matchLabels: 
        app: "keycloak-development"
    replicas: 1
    strategy: 
      type: "RollingUpdate"
      rollingUpdate: 
        maxSurge: 1
        maxUnavailable: 1
    minReadySeconds: 5
    template: 
      metadata: 
        labels: 
          app: "keycloak-development"
      spec: 
        containers: 
          - 
            name: "keycloak-development"
            image: "quay.io/keycloak/keycloak:10.0.0"
            #args: ["start-dev"]
            #args: ["standalone.sh  --start-mode=admin-only "]
            imagePullPolicy: "Always"
            env: 
              - 
                name: "KEYCLOAK_USER"
                value: "admin"
              -  
                name: "KEYCLOAK_PASSWORD"
                value: "admin"
              -
                name: "PROXY_ADDRESS_FORWARDING"
                value: "true"
              -
                name: "DB_ADDR"
                value: "postgres"     
              -
                name: "DB_VENDOR"
                value: "POSTGRES"
                
              -
                name: DB_USER
                value: "postgres" 
              - 
                name: DB_PASSWORD
                value: "postgres"

              - 
                name: DB_DATABASE
                value: keycloak
              - 
                name : KEYCLOAK_HTTP_PORT
                value : "80"
              -
                name: KEYCLOAK_HTTPS_PORT
                value: "443"
              - 
                name: VIRTUAL_PORT
                value: "8080"
              - 
                name: JDBC_PARAMS
                value: useSSL=false

                
            ports: 
              
              - name: "http"
                containerPort: 8080
                
              - name: "https"
                containerPort: 8443
            readinessProbe:
                httpGet:
                  path: "/auth/realms/master"
                  port: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: keycloak-development
      
  #namespace: "che"

  labels:
    app: keycloak-development
spec:
  ports:
  - name: http
    port: 443
    targetPort: 8080
  
  selector:
    app: keycloak-development
  type: LoadBalancer

[dkwon17]

Hello @Ryder005 , I haven't tried deploying Keyloak with Che and DevWorkspace engine myself, but maybe these comments can be useful:

• Devworkspace native auth on Kubernetes - Unauthorized! Configured service account doesn't have access #21049 (comment)
• Devworkspace native auth on Kubernetes - Unauthorized! Configured service account doesn't have access #21049 (comment)

cc @sparkoo

[Ryder05]

Deploying che on kubernetes is so buggy for me
Another errors has showed up !

[Martj89]

I have the exact same problem the actual version 7.45 and external Keycloak.

If i go to a new inkognito tab in my browser then the first login works.
It seems there is a problem with the redirect after the JWT-Token expires.

[olexii4]

Close with Simplify authentication and authorization with a more flexible and lightweight approach and Remove an old authorization flow with Keycloak
@Ryder005 Feel free to reopen this PR if you find it actual