| <!DOCTYPE html> |
| <html lang="en"> |
| <head> |
| <meta charset="utf-8"> |
| <meta name="viewport" content="width=device-width,initial-scale=1"> |
| <title>Configuring workspace exposure strategies :: Eclipse Che Documentation</title> |
| <link rel="canonical" href="https://www.eclipse.org/che/docs/che-7/installation-guide/configuring-workspace-exposure-strategies/"> |
| <meta name="keywords" content="installation-guide, configuring-workspace-exposure-strategies"> |
| <meta name="generator" content="Antora 2.3.4"> |
| <link rel="stylesheet" href="../../../_/css/site.css"> |
| <link rel="stylesheet" href="../../../_/css/extra.css"> |
| <link rel="stylesheet" href="../../../_/font-awesome-4.7.0/css/font-awesome.min.css"> |
| <link rel="icon" href="../../../favicon.ico" type="image/x-icon"> |
| <script async src="https://www.googletagmanager.com/gtag/js?id=UA-37306001-2"></script> |
| <script>function gtag(){dataLayer.push(arguments)};window.dataLayer=window.dataLayer||[];gtag('js',new Date());gtag('config','UA-37306001-2')</script> |
| <script>var uiRootPath = '../../../_'</script> |
| </head> |
| <body class="article"> |
| <header class="header" role="banner"> |
| <nav class="navbar"> |
| <div class="navbar-brand"> |
| <div class="navbar-item"> |
| <button class="navbar-burger" data-target="topbar-nav"> |
| <span></span> |
| <span></span> |
| <span></span> |
| </button> |
| <img src="../../../_/img/icon-eclipse-che.svg" class="navbar-logo" alt="Eclipse Che logo"> |
| <a href="https://www.eclipse.org/che/docs">Eclipse Che Documentation</a> |
| </div> |
| </div> |
| <div id="topbar-nav" class="navbar-menu"> |
| <div class="navbar-end"> |
| <div class="navbar-item hide-for-print"> |
| <script async src="https://cse.google.com/cse.js?cx=002898025167115630151:gnr5edrg2eo"></script> |
| <div class="gcse-searchbox" enableAutoComplete="true"></div> |
| </div> |
| <a class="navbar-item" href="https://www.eclipse.org/che/docs">Home</a> |
| <a class="navbar-item" href="https://che.eclipse.org/">Blog</a> |
| <a class="navbar-item" href="https://github.com/eclipse/che">Source Code</a> |
| </div> |
| </div> |
| </nav> |
| <div class="gcse-searchresults"></div> |
| </header><div class="body"> |
| <div class="nav-container" data-component="che-7" data-version="master"> |
| <aside class="nav"> |
| <div class="panels"> |
| <div class="nav-panel-menu is-active" data-panel="menu"> |
| <nav class="nav-menu"> |
| <h3 class="title"><a href="../../overview/introduction-to-eclipse-che/">Documentation</a></h3> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../overview/introduction-to-eclipse-che/">Introduction to Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../overview/che-architecture/">Che architecture</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../hosted-che/hosted-che/">Eclipse Che hosted by Red Hat</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">End-user Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/navigating-che/">Navigating Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/navigating-che-using-the-dashboard/">Navigating Che: dashboard</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/importing-certificates-to-browsers/">Importing certificates to browsers</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/accessing-che-from-openshift-developer-perspective/">Navigating Che from OpenShift Developer Perspective</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/che-theia-ide-basics/">Che-Theia IDE basics</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/defining-custom-commands-for-che-theia/">Defining custom commands for Che-Theia</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/version-control/">Version Control</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/che-theia-troubleshooting/">Che-Theia Troubleshooting</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/differences-in-how-che-theia-webview-works-on-a-single-host-mode-comparing-to-a-multi-host-mode/">Differences in how Che-Theia Webview works on a single-host mode comparing to a multi-host mode</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/workspaces-overview/">Using developer workspaces</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-code-sample/">Creating a workspace from code sample</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-remote-devfile/">Creating a workspace from a remote devfile using the dashboard</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-from-local-devfile-using-chectl/">Creating a workspace from local devfile using chectl</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/creating-a-workspace-by-importing-the-source-code-of-a-project/">Creating a workspace by importing the source code of a project</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/configuring-a-workspace-with-dashboard/">Configuring a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/running-a-workspace-with-dashboard/">Running a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/importing-kubernetes-applications-into-a-workspace/">Importing Kubernetes applications into a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/remotely-accessing-workspaces/">Remotely accessing workspaces</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/mounting-a-secret-as-a-file-or-an-environment-variable-into-a-workspace-container/">Mounting a secret as a file or an environment variable into a workspace container</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authenticating-on-scm-server-with-a-personal-access-token/">Authenticating on SCM Server with a personal access token</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles/">Authoring devfiles</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles-version-1/">Authoring devfiles version 1</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/authoring-devfiles-version-2/">Authoring devfiles version 2</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/customizing-developer-environments/">Customizing developer environments</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/what-is-a-che-theia-plug-in/">What is a Che-Theia plug-in</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-a-vs-code-extension-to-a-workspace/">Adding a VS Code extension to a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-a-vs-code-extension-to-the-che-plugin-registry/">Adding a VS Code extension to the Che plug-ins registry</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/publishing-metadata-for-a-vs-code-extension/">Publishing a VS Code extension</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/testing-a-visual-studio-code-extension-in-che/">Testing a VS Code extension in Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/using-alternative-ides-in-che/">Using alternative IDEs in Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/support-for-jetbrains-ides/">JetBrains IDEs</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-intellij-idea-community-edition/">Using IntelliJ Idea Community Edition</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-intellij-idea-ultimate-edition/">Using IntelliJ Idea Ultimate Edition</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/configuring-an-existing-workspace-to-use-intellij-idea/">Configuring an existing workspace to use IntelliJ IDEA</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/using-jetbrains-webstorm/">Using WebStorm</a> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <a class="nav-link" href="../../end-user-guide/provisioning-jetbrains-activation-code-for-offline-use/">Provisioning activation code for offline use</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../../end-user-guide/support-for-theia-based-ides/">Theia-based IDEs</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/adding-tools-to-che-after-creating-a-workspace/">Adding tools to Che after creating a workspace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-private-container-registries/">Using private container registries</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/using-artifact-repositories-in-a-restricted-environment/">Using artifact repositories in a restricted environment</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-maven-artifact-repositories/">Using Maven artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-gradle-artifact-repositories/">Using Gradle artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-python-artifact-repositories/">Using Python artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-go-artifact-repositories/">Using Go artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-nuget-artifact-repositories/">Using NuGet artifact repositories</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/using-npm-artifact-repositories/">Using npm artifact repositories</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-che/">Troubleshooting Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/viewing-che-workspaces-logs/">Viewing Che workspaces logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/investigating-failures-at-a-workspace-start-using-the-verbose-mode/">Troubleshooting workspace start failures</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-slow-workspaces/">Troubleshooting slow workspaces</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../end-user-guide/troubleshooting-network-problems/">Troubleshooting network problems</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Installation Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../supported-platforms/">Supported platforms</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../configuring-the-che-installation/">Configuring the Che installation</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che/">Installing Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che-in-cloud/">Installing Che in cloud</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-4-using-operatorhub/">Installing Che on OpenShift 4 using OperatorHub</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-4-using-cli/">Installing Che on OpenShift 4 using CLI</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-openshift-3-using-the-operator/">Installing Che on OpenShift 3</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-kubespray/">Installing Che on Kubespray</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-aws/">Installing Che on AWS</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-google-cloud-platform/">Installing Che on Google Cloud</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-microsoft-azure/">Installing Che on Microsoft Azure</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../installing-che-locally/">Installing Che locally</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-codeready-containers/">Installing Che on CodeReady Containers</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-docker-desktop/">Installing Che on Docker Desktop</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-minikube/">Installing Che on Minikube</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-minishift/">Installing Che on Minishift</a> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <a class="nav-link" href="../installing-che-on-kind/">Installing Che on Kind</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../using-the-chectl-management-tool/">Using the chectl management tool</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../installing-che-in-a-restricted-environment/">Installing Che in restricted environment</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../advanced-configuration/">Advanced configuration</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../advanced-configuration-options-for-the-che-server-component/">Advanced configuration options for Che server</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-namespace-strategies/">Configuring workspace target namespace</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-storage-strategies/">Configuring storage strategies</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-storage-types/">Configuring storage types</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-the-number-of-workspaces-that-a-user-can-run/">Configuring the number of workspaces that a user can run</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-the-number-of-workspaces-that-a-user-can-create/">Configuring the number of workspaces that a user can create</a> |
| </li> |
| <li class="nav-item is-current-page" data-depth="2"> |
| <a class="nav-link" href="./">Configuring workspace exposure strategies</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-workspaces-nodeselector/">Configuring workspaces nodeSelector</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-che-hostname/">Configuring Che hostname</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-ingresses/">Configuring Kubernetes Ingress</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../configuring-routes/">Configuring OpenShift Route</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../deploying-che-with-support-for-git-repositories-with-self-signed-certificates/">Deploying Che with support for Git repositories with self-signed certificates</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../installing-che-using-storage-classes/">Installing Che using storage classes</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../importing-untrusted-tls-certificates/">Importing untrusted TLS certificates to Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../switching-between-external-and-internal-communication/">Switching between external and internal ways in inter-component communication</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../setting-up-the-keycloak-che-username-readonly-theme-for-the-eclipse-che-login-page/">Setting up the Keycloak che-username-readonly theme for the Eclipse Che login page</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../mounting-a-secret-as-a-file-or-an-environment-variable-into-a-container/">Mounting a secret as a file or an environment variable into a Eclipse Che container</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../enabling-dev-workspace-engine/">Enabling Dev Workspace engine</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../upgrading-che/">Upgrading Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-operatorhub/">Upgrading Che using OperatorHub</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-the-cli-management-tool/">Upgrading Che using the CLI management tool</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-using-the-cli-management-tool-in-restricted-environment/">Upgrading Che in restricted environment</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../upgrading-che-namespace-strategies-other-than-per-user/">Updating Che namespace strategies other than 'per user'</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../uninstalling-che/">Uninstalling Che</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-operatorhub-installation-using-openshift-web-console/">Using the OpenShift web console</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-operatorhub-installation-using-openshift-cli/">Using OpenShift CLI</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../uninstalling-che-after-chectl-installation/">Using chectl</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Administration Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/che-architecture-overview/">Che architecture</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/che-workspace-controller/">Che workspace controller</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/che-workspaces-architecture/">Che workspaces architecture</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/calculating-che-resource-requirements/">Calculating Che resource requirements</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/customizing-the-registries/">Customizing the registries</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/building-custom-registry-images/">Building custom registry images</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/running-custom-registries/">Running custom registries</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/retrieving-che-logs/">Retrieving Che logs</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-server-logging/">Configuring server logging</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-kubernetes-events/">Accessing Kubernetes events on OpenShift</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-operator-events/">Viewing the Operator events on OpenShift</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-che-server-logs/">Viewing Che server logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-external-service-logs/">Viewing external service logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/viewing-plug-in-broker-logs/">Viewing Plug-in broker logs</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/collecting-logs-using-chectl/">Collecting logs using chectl</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/monitoring-che/">Monitoring Che</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../administration-guide/tracing-che/">Tracing Che</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/backup-and-disaster-recovery/">Backup and disaster recovery</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/external-database-setup/">External database setup</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/persistent-volumes-backups/">Persistent Volumes backups</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/caching-images-for-faster-workspace-start/">Caching images for faster workspace start</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/defining-the-list-of-images-to-pull/">Defining the list of images</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/defining-the-memory-parameters-for-the-image-puller/">Defining the memory settings</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-using-che-operator/">Installing using the Che Operator</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-kubernetes-using-the-image-puller-operator/">Installing using the Kubernetes Image Puller Operator</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-openshift-using-operatorhub/">Installing on OpenShift 4</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-openshift-using-openshift-templates/">Installing on OpenShift 3</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/installing-image-puller-on-kubernetes-using-helm/">Installing using Helm</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../administration-guide/managing-identities-and-authorizations/">Managing identities and authorizations</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/authenticating-users/">Authenticating users</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/authorizing-users/">Authorizing users</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-authorization/">Configuring authorization</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/configuring-openshift-oauth/">Configuring OpenShift OAuth</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../administration-guide/removing-user-data/">Removing user data</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Contributor Guide</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/branding-che-theia/">Branding Che-Theia</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/developing-che-theia-plug-ins/">Developing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/testing-che-theia-plug-ins/">Testing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/publishing-che-theia-plug-ins/">Publishing Che-Theia plug-ins</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/adding-support-for-a-new-language/">Adding support for a new language</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../contributor-guide/adding-support-for-a-new-debugger/">Adding support for a new debugger</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../contributor-guide/che-extensibility-reference/">Che extensibility reference</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/che-extension-points/">Che extension points</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/che-theia-plug-in-api/">Che-Theia plug-in API</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/debug-adapter-protocol/">Debug Adapter Protocol</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../contributor-guide/language-server-protocol/">Language Server Protocol</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <button class="nav-item-toggle"></button> |
| <span class="nav-text">Extensions</span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../extensions/eclipse-che4z/">Eclipse Che4z</a> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../extensions/openshift-connector-overview/">OpenShift Connector</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/features-of-openshift-connector/">Features of OpenShift Connector</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/installing-openshift-connector-in-che/">Installing OpenShift Connector in Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/authenticating-with-openshift-connector-from-che/">Authenticating with OpenShift Connector from Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/creating-components-with-openshift-connector-in-che/">Creating Components with OpenShift Connector in Eclipse Che</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/connecting-source-code-from-github-to-a-openshift-component-using-openshift-connector/">Connecting source code from GitHub to a OpenShift Component</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <button class="nav-item-toggle"></button> |
| <a class="nav-link" href="../../extensions/telemetry/">Telemetry</a> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/creating-a-telemetry-plugin/">Creating A Telemetry Plugin</a> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <a class="nav-link" href="../../extensions/the-woopra-telemetry-plugin/">The Woopra Telemetry Plugin</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../extensions/java-lombok/">Java Lombok</a> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <a class="nav-link" href="../../glossary/che-glossary/">Che glossary</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </nav> |
| </div> |
| <div class="nav-panel-explore" data-panel="explore"> |
| <div class="context"> |
| <span class="title">Documentation</span> |
| <span class="version">master</span> |
| </div> |
| <ul class="components"> |
| <li class="component is-current"> |
| <a class="title" href="../../overview/introduction-to-eclipse-che/">Documentation</a> |
| <ul class="versions"> |
| <li class="version is-current is-latest"> |
| <a href="../../overview/introduction-to-eclipse-che/">master</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </div> |
| </div> |
| </aside> |
| </div> |
| <main class="article"> |
| <div class="toolbar" role="navigation"> |
| <button class="nav-toggle"></button> |
| <a href="../../overview/introduction-to-eclipse-che/" class="home-link"></a> |
| <nav class="breadcrumbs" aria-label="breadcrumbs"> |
| <ul> |
| <li><a href="../../overview/introduction-to-eclipse-che/">Documentation</a></li> |
| <li>Installation Guide</li> |
| <li><a href="../advanced-configuration/">Advanced configuration</a></li> |
| <li><a href="./">Configuring workspace exposure strategies</a></li> |
| </ul> |
| </nav> |
| <div class="edit-this-page"><a href="https://github.com/eclipse/che-docs/edit/master/modules/installation-guide/pages/configuring-workspace-exposure-strategies.adoc">Edit this Page</a></div> |
| </div> |
| <div class="content"> |
| <aside class="toc sidebar" data-title="Contents" data-levels="2"> |
| <div class="toc-menu"></div> |
| </aside> |
| <article class="doc"> |
| <h1 class="page">Configuring workspace exposure strategies</h1> |
| <div id="preamble"> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>The following section describes how to configure workspace exposure strategies of a Che server and ensure that applications running inside are not vulnerable to outside attacks.</p> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="configuring-workspace-exposure-strategies-using-an-operator_che"><a class="anchor" href="#configuring-workspace-exposure-strategies-using-an-operator_che"></a>Configuring workspace exposure strategies using an Operator</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p><a href="https://docs.openshift.com/container-platform/latest/operators/understanding/olm-what-operators-are.html">Operators</a> are software extensions to Kubernetes or OpenShift that use <a href="https://docs.openshift.com/container-platform/latest/operators/understanding/crds/crd-managing-resources-from-crds.html">Custom Resources</a> to manage applications and their components.</p> |
| </div> |
| <div class="ulist"> |
| <div class="title">Prerequisites</div> |
| <ul> |
| <li> |
| <p>The <code>kubectl</code> tool is available.</p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <div class="title">Procedure</div> |
| <p>When deploying Che using the Operator, configure the intended strategy by modifying the <code>spec.server.serverExposureStrategy</code> property of the CheCluster Custom Resource object YAML file.</p> |
| </div> |
| <div class="paragraph"> |
| <p>The supported values for <code>spec.server.serverExposureStrategy</code> are:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><a href="#multi-host-workspace-exposure-strategy_che"><code>multi-host</code></a></p> |
| </li> |
| <li> |
| <p><a href="#single-host-workspace-exposure-strategy_che"><code>single-host</code></a></p> |
| </li> |
| <li> |
| <p><a href="#default-host-workspace-exposure-strategy_che"><code>default-host</code></a></p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <p>See <a href="#workspace-exposure-strategies_che">Workspace exposure strategies</a> for more detail about individual strategies.</p> |
| </div> |
| <div class="paragraph"> |
| <p>To activate changes done to CheCluster YAML file, do one of the following:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Create a new cluster by executing the <code>chectl</code> command with applying a patch. For example:</p> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ chectl server:deploy --installer=operator --platform=<em><platform></em> \ |
| --che-operator-cr-patch-yaml=patch.yaml</pre> |
| </div> |
| </div> |
| <div class="admonitionblock note"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-note" title="Note"></i> |
| </td> |
| <td class="content"> |
| <div class="paragraph"> |
| <p>For a list of available Kubernetes or OpenShift deployment platforms, use <code>chectl server:deploy --platform --help</code>.</p> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Use the following <code>patch.yaml</code> file:</p> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">apiVersion: org.eclipse.che/v1 |
| kind: CheCluster |
| metadata: |
| name: eclipse-che |
| spec: |
| server: |
| serverExposureStrategy: '<em><exposure-strategy></em>' <i class="conum" data-value="1"></i><b>(1)</b></code></pre> |
| </div> |
| </div> |
| <div class="colist arabic"> |
| <table> |
| <tr> |
| <td><i class="conum" data-value="1"></i><b>1</b></td> |
| <td>- used workspace exposure strategy</td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| </ul> |
| </div> |
| </li> |
| <li> |
| <p>Update the YAML file properties of an already running cluster by executing the <code>kubectl patch</code> command. For example:</p> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ kubectl patch checluster/eclipse-che --type=json \ |
| -p '[{"op": "replace", |
| "path": "/spec/server/serverExposureStrategy", |
| "value": "<em><exposure-strategy></em>"}]' \ <i class="conum" data-value="1"></i><b>(1)</b> |
| -n eclipse-che</pre> |
| </div> |
| </div> |
| <div class="colist arabic"> |
| <table> |
| <tr> |
| <td><i class="conum" data-value="1"></i><b>1</b></td> |
| <td>- used workspace exposure strategy</td> |
| </tr> |
| </table> |
| </div> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <div class="title">Gateway single-host on Kubernetes</div> |
| <p>Single-host on Kubernetes has two implementations, <code>native</code>(default) and <code>gateway</code>. To deploy with <code>gateway</code> set the <code>k8s.singleHostExposureType</code> of CheCluster Custom Resource to <code>gateway</code>, or use this patch:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">apiVersion: org.eclipse.che/v1 |
| kind: CheCluster |
| metadata: |
| name: eclipse-che |
| spec: |
| server: |
| serverExposureStrategy: 'single-host' |
| k8s: |
| singleHostExposureType: 'gateway'</code></pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="configuring-workspace-exposure-strategies-using-a-helm-chart_che"><a class="anchor" href="#configuring-workspace-exposure-strategies-using-a-helm-chart_che"></a>Configuring workspace exposure strategies using a Helm chart</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>A <a href="https://helm.sh/">Helm Chart</a> is a Kubernetes extension for defining, installing, and upgrading Kubernetes applications.</p> |
| </div> |
| <div class="paragraph"> |
| <div class="title">Procedure</div> |
| <p>When deploying Che using the Helm chart, configure the workspace exposure strategy using the <code>global.serverStrategy</code>. For single-host, optional <code>global.singleHostExposure</code> and <code>cheSinglehostGateway.deploy</code> properties may be configured as well. To do so, add the following option to the <code>helm install</code> or <code>helm upgrade</code> command:</p> |
| </div> |
| <div class="paragraph"> |
| <p>Example for <code>native</code> single-host strategy type and <code>multi-host</code> or <code>default-host</code> strategies:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ helm install --set global.serverStrategy=<em><exposure-strategy></em></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>or:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ helm upgrade --set global.serverStrategy=<em><exposure-strategy></em></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>The supported values for <code>global.serverStrategy</code> are:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><a href="#multi-host-workspace-exposure-strategy_che"><code>multi-host</code></a></p> |
| </li> |
| <li> |
| <p><a href="#single-host-workspace-exposure-strategy_che"><code>single-host</code></a></p> |
| </li> |
| <li> |
| <p><a href="#default-host-workspace-exposure-strategy_che"><code>default-host</code></a></p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <div class="title">Gateway single-host on Kubernetes</div> |
| <p>Single-host on Kubernetes has 2 implementations, <code>native</code>(default) and <code>gateway</code>. To deploy with <code>gateway</code> use:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ helm install --namespace eclipse-che \ |
| --set global.serverStrategy=single-host \ |
| --set global.singleHostExposure=gateway \ |
| --set cheSinglehostGateway.deploy=true</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>or:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ helm upgrade --install che --namespace eclipse-che \ |
| --set global.serverStrategy=single-host \ |
| --set global.singleHostExposure=gateway \ |
| --set cheSinglehostGateway.deploy=true</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Alternatively, predefined values file can be used as follows:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>$ helm upgrade --install che --namespace eclipse-che \ |
| -f "${SOURCE_HOME_DIR}"/deploy/kubernetes/helm/che/values/single-host-gateway.yaml</pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="workspace-exposure-strategies_che"><a class="anchor" href="#workspace-exposure-strategies_che"></a>Workspace exposure strategies</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>Specific components of workspaces need to be made accessible outside of the Kubernetes or OpenShift cluster. This is typically the user interface of the workspace’s IDE, but it can also be the web UI of the application being developed. This enables developers to interact with the application during the development process.</p> |
| </div> |
| <div class="paragraph"> |
| <p>The supported way of making workspace components available to the users is referred to as a <em>strategy</em>. This strategy defines whether new subdomains are created for the workspace components and what hosts these components are available on.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Che supports:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><code>multi-host</code> strategy</p> |
| </li> |
| <li> |
| <p><code>single-host</code> strategy</p> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>with the <code>gateway</code> subtype</p> |
| </li> |
| <li> |
| <p>with the <code>native</code> subtype</p> |
| </li> |
| </ul> |
| </div> |
| </li> |
| <li> |
| <p><code>default-host</code> strategy</p> |
| </li> |
| </ul> |
| </div> |
| <div class="sect2"> |
| <h3 id="multi-host-workspace-exposure-strategy_che"><a class="anchor" href="#multi-host-workspace-exposure-strategy_che"></a>Multi-host strategy</h3> |
| <div class="paragraph"> |
| <p>With multi-host strategy, each workspace component is assigned a new subdomain of the main domain configured for the Che server. This is the default strategy.</p> |
| </div> |
| <div class="paragraph"> |
| <p>This strategy is the easiest to understand from the perspective of component deployment because any paths present in the URL to the component are received as they are by the component.</p> |
| </div> |
| <div class="paragraph"> |
| <p>On a Che server secured using the Transport Layer Security (TLS) protocol, creating new subdomains for each component of each workspace requires a wildcard certificate to be available for all such subdomains for the Che deployment to be practical.</p> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="single-host-workspace-exposure-strategy_che"><a class="anchor" href="#single-host-workspace-exposure-strategy_che"></a>Single-host strategy</h3> |
| <div class="paragraph"> |
| <p>With single-host strategy, all workspaces are deployed to sub-paths of the main Che server domain.</p> |
| </div> |
| <div class="paragraph"> |
| <p>This is convenient for TLS-secured Che servers because it is sufficient to have a single certificate for the Che server, which will cover all the workspace component deployments as well.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Single-host strategy have two subtypes with different implementation methods. First subtype is named <code>native</code>. This strategy is available and default on Kubernetes, but not on OpenShift, since it uses Ingresses for servers exposing. The second subtype named <code>gateway</code>, works both on Kubernetes or OpenShift, and uses a special Pod with reverse-proxy running inside to route requests.</p> |
| </div> |
| <div class="admonitionblock warning"> |
| <table> |
| <tr> |
| <td class="icon"> |
| <i class="fa icon-warning" title="Warning"></i> |
| </td> |
| <td class="content"> |
| <div class="paragraph"> |
| <p>With <code>gateway</code> single-host strategy, cluster network policies has to be configured so that workspace’s services are reachable from reverse-proxy Pod (typically in Che namespace). These typically lives in different namespace.</p> |
| </div> |
| </td> |
| </tr> |
| </table> |
| </div> |
| <div class="paragraph"> |
| <p>To define how to expose the endpoints specified in the devfile, define the <code>CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE</code> environment variable in the Che instance. This environment variable is only effective with the single-host server strategy and is applicable to all workspaces of all users.</p> |
| </div> |
| <div class="sect3"> |
| <h4 id="_devfile_endpoints_single_host"><a class="anchor" href="#_devfile_endpoints_single_host"></a>devfile endpoints: <code>single-host</code></h4> |
| <div class="paragraph"> |
| <p><code>CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE: 'single-host'</code></p> |
| </div> |
| <div class="paragraph"> |
| <p>This single-host configuration exposes the endpoints on subpaths, for example: <code>https://<che-host>/serverihzmuqqc/go-cli-server-8080</code>. This limits the exposed components and user applications. Any absolute URL generated on the server side that points back to the server does not work. This is because the server is hidden behind a path-rewriting reverse proxy that hides the unique URL path prefix from the component or user application.</p> |
| </div> |
| <div class="paragraph"> |
| <p>For example, when the user accesses the hypothetical <code>https://che-host:che-port/component-prefix-djh3d/app/index.php</code> URL, the application sees the request coming to <code>https://internal-host/app/index.php</code>. If the application used the host in the URL that it generates in its UI, it would not work because the internal host is different from the externally visible host. However, if the application used an absolute path as the URL (for the example above, this would be <code>/app/index.php</code>), such URL would still not work. This is because on the outside, such URL does not point to the application, because it is missing the component-specific prefix.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Therefore, only applications that use relative URLs in their UI work with the single-host workspace exposure strategy.</p> |
| </div> |
| </div> |
| <div class="sect3"> |
| <h4 id="_devfile_endpoints_multi_host"><a class="anchor" href="#_devfile_endpoints_multi_host"></a>devfile endpoints: <code>multi-host</code></h4> |
| <div class="paragraph"> |
| <p><code>CHE_INFRA_KUBERNETES_SINGLEHOST_WORKSPACE_DEVFILE__ENDPOINT__EXPOSURE: 'multi-host'</code></p> |
| </div> |
| <div class="paragraph"> |
| <p>This single-host configuration exposes the endpoints on subdomains, for example: <code>http://serverihzmuqqc-go-cli-server-8080.<che-host></code>. These endpoints are exposed on an unsecured HTTP port. A dedicated Ingress or Route is used for such endpoints, even with <code>gateway</code> single-host setup.</p> |
| </div> |
| <div class="paragraph"> |
| <p>This configuration limits the usability of previews shown directly in the editor page when Che is configured with TLS. Since <code>https</code> pages allow communication only with secured endpoints, users must open their application previews in another browser tab.</p> |
| </div> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="default-host-workspace-exposure-strategy_che"><a class="anchor" href="#default-host-workspace-exposure-strategy_che"></a>Default-host strategy</h3> |
| <div class="paragraph"> |
| <p>This strategy exposes the components to the outside world on the sub-paths of the default host of the cluster. It is similar to the single-host strategy. All the limitations and advantages of the single-host strategy applying to this strategy as well.</p> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="security-considerations_che"><a class="anchor" href="#security-considerations_che"></a>Security considerations</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>This section explains the security impact of using different Che workspace exposure strategies.</p> |
| </div> |
| <div class="paragraph"> |
| <p>All the security-related considerations in this section are only applicable to Che in multiuser mode. The single user mode does not impose any security restrictions.</p> |
| </div> |
| <div class="sect2"> |
| <h3 id="json-web-token-jwt-proxy_che"><a class="anchor" href="#json-web-token-jwt-proxy_che"></a>JSON web token (JWT) proxy</h3> |
| <div class="paragraph"> |
| <p>All Che plug-ins, editors, and components can require authentication of the user accessing them. This authentication is performed using a JSON web token (JWT) proxy that functions as a reverse proxy of the corresponding component, based on its configuration, and performs the authentication on behalf of the component.</p> |
| </div> |
| <div class="paragraph"> |
| <p>The authentication uses a redirect to a special page on the Che server that propagates the workspace and user-specific authentication token (workspace access token) back to the originally requested page.</p> |
| </div> |
| <div class="paragraph"> |
| <p>The JWT proxy accepts the workspace access token from the following places in the incoming requests, in the following order:</p> |
| </div> |
| <div class="olist arabic"> |
| <ol class="arabic"> |
| <li> |
| <p>The token query parameter</p> |
| </li> |
| <li> |
| <p>The Authorization header in the bearer-token format</p> |
| </li> |
| <li> |
| <p>The <code>access_token</code> cookie</p> |
| </li> |
| </ol> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="_secured_plug_ins_and_editors"><a class="anchor" href="#_secured_plug_ins_and_editors"></a>Secured plug-ins and editors</h3> |
| <div class="paragraph"> |
| <p>Che users do not need to secure workspace plug-ins and workspace editors (such as Che-Theia). This is because the JWT proxy authentication is indiscernible to the user and is governed by the plug-in or editor definition in their <code>meta.yaml</code> descriptors.</p> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="_secured_container_image_components"><a class="anchor" href="#_secured_container_image_components"></a>Secured container-image components</h3> |
| <div class="paragraph"> |
| <p>Container-image components can define custom endpoints for which the devfile author can require Che-provided authentication, if needed. This authentication is configured using two optional attributes of the endpoint:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><code>secure</code> - A boolean attribute that instructs the Che server to put the JWT proxy in front of the endpoint. Such endpoints have to be provided with the workspace access token in one of the several ways explained in <a href="#json-web-token-jwt-proxy_che">JSON web token (JWT) proxy</a>. The default value of the attribute is <code>false</code>.</p> |
| </li> |
| <li> |
| <p><code>cookiesAuthEnabled</code> - A boolean attribute that instructs the Che server to automatically redirect the unauthenticated requests for current user authentication as described in <a href="#json-web-token-jwt-proxy_che">JSON web token (JWT) proxy</a>. Setting this attribute to <code>true</code> has security consequences because it makes Cross-site request forgery (CSRF) attacks possible. The default value of the attribute is <code>false</code>.</p> |
| </li> |
| </ul> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="_cross_site_request_forgery_attacks"><a class="anchor" href="#_cross_site_request_forgery_attacks"></a>Cross-site request forgery attacks</h3> |
| <div class="paragraph"> |
| <p>Cookie-based authentication can make an application secured by a JWT proxy prone to Cross-site request forgery (CSRF) attacks. See the <a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery">Cross-site request forgery</a> Wikipedia page and other resources to ensure your application is not vulnerable.</p> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="_phishing_attacks"><a class="anchor" href="#_phishing_attacks"></a>Phishing attacks</h3> |
| <div class="paragraph"> |
| <p>An attacker who is able to create an Ingress or route inside the cluster with the workspace that shares the host with some services behind a JWT proxy, the attacker may be able to create a service and a specially forged Ingress object. When such a service or Ingress is accessed by a legitimate user that was previously authenticated with a workspace, it can lead to the attacker stealing the workspace access token from the cookies sent by the legitimate user’s browser to the forged URL. |
| To eliminate this attack vector, configure OpenShift to disallow setting the host of an Ingress.</p> |
| </div> |
| </div> |
| </div> |
| </div> |
| </article> |
| </div> |
| </main> |
| </div> |
| <footer class="footer"> |
| <div><a href="https://www.eclipse.org" target="_blank">Eclipse Foundation</a> | |
| <a href="https://www.eclipse.org/legal/privacy.php" target="_blank">Privacy Policy</a> | |
| <a href="https://www.eclipse.org/legal/termsofuse.php" target="_blank">Terms of Use</a> | |
| <a href="https://www.eclipse.org/legal/epl-2.0/" target="_blank">Eclipse Public License</a> | |
| <a href="https://www.eclipse.org/legal" target="_blank">Legal Resources</a></div> |
| </footer> |
| |
| <script src="../../../_/js/site.js"></script> |
| <script async src="../../../_/js/vendor/highlight.js"></script> |
| </body> |
| </html> |
