Uploaded image for project: 'Web Terminal for OpenShift'
  1. Web Terminal for OpenShift
  2. WTO-102

Web Terminal does not work with multitenant isolated network policy

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Major Major
    • None
    • 1.2.0
    • operator
    • None
    • False
    • False

      Web Terminal does not work with multitenant isolated network policy (more see https://docs.openshift.com/container-platform/4.7/networking/network_policy/multitenant-network-policy.html).
      Terminal needs the following in-cluster communication which is forbidden by default on clusters with multitenant isolated network policy, they are:
      1. openshift-operators -> user's namespace: DevWorkspace Controller verify that server is up
      2. openshift-console -> user's namespace: OpenShift console frontend requests terminal via proxy on backend to resolve authentication and use in cluster CA

      The first one can be workaround if admin configure project request template to include:

       apiVersion: networking.k8s.io/v1
       kind: NetworkPolicy
       metadata:
       name: allow-from-olm-namespaces
       spec:
       ingress:
       - from:
       - namespaceSelector:
       matchLabels:
         openshift.io/scc: anyuid # is only labels on openshift-operators namespace, and it should not be allowed on regular namespace
       podSelector: {}
       policyTypes:
       - Ingress
      

      but for the second there is no a possibility to fix it in any case, since openshift-console namespace does not have any label set.

            amisevsk Angel Misevski
            sleshche Sergii Leshchenko (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: