-
Task
-
Resolution: Done
-
Major
-
None
-
1.2.0
-
None
-
False
-
False
-
Web Terminal does not work with multitenant isolated network policy (more see https://docs.openshift.com/container-platform/4.7/networking/network_policy/multitenant-network-policy.html).
Terminal needs the following in-cluster communication which is forbidden by default on clusters with multitenant isolated network policy, they are:
1. openshift-operators -> user's namespace: DevWorkspace Controller verify that server is up
2. openshift-console -> user's namespace: OpenShift console frontend requests terminal via proxy on backend to resolve authentication and use in cluster CA
The first one can be workaround if admin configure project request template to include:
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-olm-namespaces spec: ingress: - from: - namespaceSelector: matchLabels: openshift.io/scc: anyuid # is only labels on openshift-operators namespace, and it should not be allowed on regular namespace podSelector: {} policyTypes: - Ingress
but for the second there is no a possibility to fix it in any case, since openshift-console namespace does not have any label set.