Kube token sync v2

[batleforc]

What does this PR do?

Add an item to the WS dropdown that allow re-injecting the user's kube token inside the WS

Screenshot/screencast of this PR

What issues does this PR fix or reference?

eclipse-che/che#23545

Is it tested? How?

1. Create a Workspace
2. Delete ~/.kube/config
3. Trigger the new button
4. list file in ~/.kube/

Release Notes

Docs PR

Do i need to do a docs PR ?

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: batleforc

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[che-bot]

Click here to review and test in web IDE:

[openshift-ci]

Hi @batleforc. Thanks for your PR.

I'm waiting for a eclipse-che member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

❌ Patch coverage is 83.67347% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.25%. Comparing base (97d6304) to head (799045e).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
...rontend/src/contexts/WorkspaceActions/Provider.tsx	0.00%	5 Missing ⚠️
...tions/actionCreators/refreshKubeconfigWorkspace.ts	91.17%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1492      +/-   ##
==========================================
- Coverage   93.26%   92.25%   -1.02%     
==========================================
  Files         564      563       -1     
  Lines       54795    55049     +254     
  Branches     4159     4109      -50     
==========================================
- Hits        51107    50785     -322     
- Misses       3642     4217     +575     
- Partials       46       47       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ibuziuk]

@batleforc hello, thank you for the contribution. Could you please clarify the UX e.g. when exactly user needs to do this procedure manually? I guess it is related to the short-lived tokens, but afaik for OpenShift it is 24h by default

[batleforc]

Hi @ibuziuk In my case, the token should at most live 6H (set in the different OIDC providers) and sometimes the end of the token's life comes in the middle of a debug process or a long-lived process so restarting the full app ends up being a headache more than anything. And extending the token's life is not possible.

[ibuziuk]

@batleforc thank you for clarification, but I'm a bit concerned about exposing this capability on the UI since it is pretty niche. Could you clarify how you are currently updating the kubeconfig? is it dashboard/api/swagger ?

[batleforc]

@ibuziuk in the PR yes i call this function https://github.com/batleforc/che-dashboard/blob/main/packages/dashboard-frontend/src/services/backend-client/devWorkspaceApi.ts#L126 that is directly exposed in the fronted. At the moment my user or i are annoyed by it and redo the kube oidc login full process or wait for some more time to restart the container.
The other possibility i had in mind was to reinject it each time the user go through the waiting page, ATM the inject is only triggered the first time it's "ready" but i didn't have time yet to debug the whole process main...batleforc:che-dashboard:kube-token-sync-v1

[olexii4]

@batleforc Hello, thank you for the contribution.

I see that the defer promise never resolves(defer.resolve() is never called). The getDefer() pattern is unnecessary here.

Example of replacing with a plain async/await:

export const refreshKubeconfigWorkspace =
  (workspace: devfileApi.DevWorkspace): AppThunk =>
  async () => {
    if (workspace.status?.phase !== DevWorkspaceStatus.RUNNING) {
      return;
    }
    const devworkspaceId = workspace.status?.devworkspaceId;
    const namespace = workspace.metadata.namespace;
    if (!devworkspaceId || !namespace) {
      throw new Error(
        `Failed to refresh kubeconfig for "${workspace.metadata.name}": missing devworkspaceId or namespace.`,
      );
    }
    await injectKubeConfig(namespace, devworkspaceId);
    await podmanLogin(namespace, devworkspaceId);
  };

[batleforc]

Thank's. I've directly applied your example.

[olexii4]

Codecov Report

❌ Patch coverage is 55.31915% with 21 lines in your changes missing coverage. Please review. ✅ Project coverage is 92.18%. Comparing base (97d6304) to head (3278d25). ⚠️ Report is 7 commits behind head on main.

@batleforc Hello, need to increase test coverage for your changes from 55% to 92% (add some tests).

[ibuziuk]

@batleforc thank you for the details and follow-up. I believe we need some option to re-inject the token without the direct user interaction and exposing internals on UI.
Could potentially be exposed / enabled as a feature toggle available on CheCluster CR (not sure if underdashboard property though)
@dkwon17 @tolusha could you please review? any design ideas / suggestions?

[batleforc]

Shoud i finish adding more test or not ? @ibuziuk

[tolusha]

@ibuziuk @olexii4
To reinject the kubeconfig, a user token is required, which cannot be obtained without the dashboard, so the proposed solution makes sense; additionally, a Che Code action could be added to trigger kubeconfig reinjection by sending a request to the dashboard.

[ibuziuk]

Che Code action could be added to trigger kubeconfig reinjection by sending a request to the dashboard.

@tolusha @olexii4 @batleforc tbh, I would only add this action to VS Code, without adding new menu item to the user dashboard

@TheChosenMok please, review, wdyt ^

[batleforc]

@ibuziuk one of the reasons has to why I chose to put it in the dashboard was to not have to trigger a plugin for the different kinds of IDE (VsCode, VsCode Desktop, JetBrains, WebShell, and existing and future ones)

[ibuziuk]

@batleforc, that is a fair take. For me, the UX is questionable, though, when the user is expected to go to the dashboard from the workspace and manually trigger the injection.

[batleforc]

@ibuziuk in any case he has to, to re-login to the dashboard

[TheChosenMok]

It's a neat idea, but it's a bit too niche to add it to the main dashboard as it might cause some clutter. That being said what what are yall's thoughts on adding it to the workspace details tab (either within another tab or in the overview). In the future we may have more advanced configs like this so it may not be the only one and having a place to put them would be good.

I think a new a tab called "Advanced" or something like that would be approriate.