Cannot start hosted plugin

Describe the bug

Starting a hosted plugin by HOSTED PLUGIN: start instance command causes an error.

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

1. Clone and build any theia plugin e.g. https://github.com/eclipse/che-theia-samples/tree/master/samples/hello-world-backend-plugin
2. Go to command palette and run HOSTED PLUGIN: start instance command.

See: plugin doesn’t start, error notification appears : Failed to run hosted plugin instance: unable to verify the first certificate

Expected behavior

Hosted plugin must start.

Runtime

• kubernetes (include output of kubectl version)
• Openshift (include output of oc version)
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Screenshots

Installation method

• chectl
• che-operator
• minishift-addon
• I don’t know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

Eclipse Che Logs

Additional context

[vzhukovs]

There are some thoughts around this issue. Everything works fine with signed certificates (not self-signed!), so on che.openshift.io this issue doesn’t reproduce, which is fine.

Theia instance (che editor, lets call it Theia-Main) in che-theia image runs as http node process. Which comes to the first question, should we run Theia instance with SSL parameters?

So when user tries to call command Hosted Plugin: Start Instance, theia calls a command /usr/local/bin/node /home/theia/src-gen/backend/main.js /projects --hostname=127.0.0.1 --hostname=0.0.0.0 --port=3130 under the hood, so we’re getting a new instance of Theia (hosted instance, lets call this one Theia-Hosted). Then client on Theia-Main, through https tries to reach Theia-Hosted, which is hosts on http. And as far as we have self-signed certificate, we’re getting error unable to verify the first certificate.

One good thing, that this is reproduce only when Theia-Main uses self-signed certs. And we can ignore this error, just adding environment variable to pod deployment:

        - name: theia-ide
          image: 'quay.io/eclipse/che-theia:next'
          ports:
			...
          env:
            ...
            - name: NODE_TLS_REJECT_UNAUTHORIZED
              value: '0'
			...
          resources:
		  	...
          volumeMounts:
		    ...

this works, hosted instance starts. But, to apply this environment variable we need somehow detect, whether we run development environment or production. I mean, not to put this environment variable into production.

Found another interesting bug inside Theia. When Theia instance runs with SSL configuration. There is the similar situation, but with another error message, when Theia tries to ping hosted instance:

{
  "code": "DEPTH_ZERO_SELF_SIGNED_CERT"
}

We potentially can get the same error, when we’ll try to run Theia in che-theia image with SSL options. For this issue there is also simple fix, by adding strictSSL: false parameter into AbstractHostedInstanceManager.instanceOptions For this fix there will be PR into upstream, but not sure if this is urgent for now.

But as for first use case, the fix can be applied only on our side modifying deployment configurations.

[vzhukovs]

When cheEditor component is used, it needs to be modified by adding additional environment variable:

  - id: eclipse/che-theia/next
    type: cheEditor
    alias: che-theia
    env:
      - name: NODE_TLS_REJECT_UNAUTHORIZED
        value: "0"