How do Service and Operator interact?

[wyhdil]

From this architecture diagram, it seems that service and operator do not interact directly, but use various CR as a medium.

But I still don’t know what the process of creating an IDE pod is like.

For example, what are the functions of workspace CR, session CR, and app definition CR? And what is the connection between them? Also, how does the operator monitor these CRs?

Thanks!!!

[sgraband]

Hey @wyhdil,

to get a deeper understanding of the architecture diagram (and Theia Cloud itself), you could check out our talk at EclipseCon about the topic.

Especially interesting for your question should be the Section from 7:52. It first describes the operator pattern in general and then walks through the architecture above.

To already answer part of your question:
The CRs themself to not contain any functions, they are just resources that contain information. The operator just watches these resources. For an entrypoint in the code you can take a look here.
The operator knows which CRs to watch and what information it can expect from the CustomResourceDefinitions (CRDs) that are blueprints for the CRs. This is described in detail in the talk :)

Hope this helps.

[wyhdil]

@sgraband Thank you very much for your previous reply. I already understand the architecture of theiacloud, but when I look at the code, I still have some questions：

How does service interact with authenticate in the fifth step? How is it implemented at the code level?

The fifth step seems to be that the service is interacting with authenticate to verify the user's identity information, right? But I don't understand how to deal with it at the code level.
Can you answer it again? Thanks!

[sgraband]

Our service uses Quarkus, which has great OIDC integration (https://quarkus.io/guides/security-oidc-configuration-properties-reference).

Our settings are located here.
However those will be partially overwritten via the helm config (to make sure it points to the correct keycloak url and so on).

Hope this helps

[wyhdil]

Thank you for your answer！
I actually want to replace keycloak with another authorization server, but now I don't have a clue. I would like to ask what modifications are needed if I replace it.
Can you provide some ideas? Thanks!

[sgraband]

Unfortunately, we do not have any examples with other OIDC providers and it is a bit out of scope for the time we spent managing this forum. But i would assume that searching for Quarkus + <your auth provider> should yield helpful resources to get you started.

If any questions related to Theia Cloud arise feel free to post them here :)

[wyhdil]

OK, thank you very much for your answer!

[wyhdil]

@sgraband Hello，now I have some questions about OIDC, can you help me?
https://github.com/eclipsesource/theia-cloud/blob/main/java/service/org.eclipse.theia.cloud.service/src/main/java/org/eclipse/theia/cloud/service/RootResource.java

This should be the service and authorization server for authentication.

But I can’t find what exactly the authentication here does.

I would like to know what the authentication is done here. For example, is the id_token returned by keycloak used for verification or email or the like for verification?

[sgraband]

I'm afraid i am not really familiar with the specifics of these annotations. They were implemented by @lucas-koehler. Maybe he can help. Note, that he is out of office this week. I will ask him to take a look.

[wyhdil]

Thank you very much for your patient answer！Really appreciate!