Skip to content

Extract external OpenShift IDP configuration from authentication.config/cluster #23831

Description

@tolusha

Is your task related to a problem? Please describe

Eclipse Che doesn't work out of box on OpenShift cluster with exteranl IDP configured.

https://eclipse.dev/che/docs/next/administration-guide/installing-che-on-openshift-with-keycloak-as-oidc/
https://che.eclipseprojects.io/2026/04/20/@tolusha-openshift-external-idp.html

Describe the solution you'd like

authentication.config/cluster contains all the required configuration data for Eclipse Che.

spec:
  oidcProviders:
  - claimMappings:
      groups:
        claim: groups
        prefix: ''
      username:
        claim: preferred_username 
        prefixPolicy: Prefix
        prefix:
          prefixString: 'external-auth:'
    issuer:
      audiences: 
        - openshift-console
        - openshift-cli
      issuerCertificateAuthority:
        name: external-auth-ca
      issuerURL: $RHBK_HOST/realms/openshift 
    name: 'rhbk-external-auth'
    oidcClients:
      - clientID: openshift-cli
        componentName: cli
        componentNamespace: openshift-console
      - clientID: openshift-console
        clientSecret:
          name: external-auth-console-secret
        componentName: console
        componentNamespace: openshift-console
  type: OIDC
  webhookTokenAuthenticator: null

Describe alternatives you've considered

No response

Additional context

No response

Metadata

Metadata

Assignees

Labels

area/che-operatorIssues and PRs related to Eclipse Che Kubernetes Operatorkind/taskInternal things, technical debt, and to-do tasks to be performed.team/BThis team is responsible for the Web Terminal, the DevWorkspace Operator.

Type

No type

Projects

Status
✅ Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions