[Hosted Che] Unauthorized! Configured service account doesn't have access.

[TheZoker]

I tried to run theia within che following these instructions:
https://docs.google.com/document/d/1hFXTwzIU3MnqcciXH9E7xyUtEJRUeUuJ-e0JlEhTKjo/mobilebasic

After doing everything exactly what the docs say, the "Loading" dialog takes forever. After waiting a long time, I tried to start the workspace again. But I get the following issue:

Here copy'n'paste:

Failure executing: GET at: https://f8osoproxy-test-dsaas-production.09b5.dsaas.openshiftapps.com/api/v1/namespaces/zoker2-che/persistentvolumeclaims. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked.. The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password.

I also tried to install the theia stack with the same result.

Does anyone know what went wrong here? I did not change any parameter or anything else...

[mohschmid]

Same issue for me!

[slemeur]

Thanks @mohschmid and @TheZoker for reporting the issue.

@ibuziuk @benoitf @l0rd : Could you give a look?

[hellanemrri]

Same issue for me..???????

[bryantson]

Same issue as well. Any update?

[sleshchenko]

@bryantson Could you provide information about how did you deploy your Che? Chectl, operator, helm....? What were the arguments?

[bryantson]

@sleshchenko The issue was encountered when I used https://che.openshift.io. I also did encountered the issue when I ran minishift previously.

[amisevsk]

This is a che.openshift.io specific issue and seems to be related to how user accounts are provisioned there.

I've created issue redhat-developer/rh-che#1569 to track this, as it's not a Che-specific issue.

[davidwindell]

I also have this issue on Rancher so I don't think it's platform specific

[puneethpk]

Even i have the same issue..any fixes for this? or is it still open?

[l0rd]

@puneethpk I beleive the original issue on che.openshift.io has been fixed. I am not able to reproduce it neither locally nor on an hosted instance of Che. Can you please provide some details that would help us reproduce it?

[amisevsk]

@davidwindell @puneethpk Could you share details about your Che installations? The referenced error message is pretty specific to our production deployment.

As a test, the output of kubectl describe serviceaccount che or similar would be helpfu (in addition to the usual version/deploy method/cluster info).

[davidwindell]

I'm no longer able to reproduce it, can't recall when it was fixed but it might be when I started applying cheWorkspacesNamespace to my helm values.

[puneethpk]

I have deployed it using yaml files in kubernetes cluster deployed in aws. This is the error log i get when i try to create a workspace.Che service account has all the access.
The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password

[hari1992-web]

I have deployed it using yaml files in kubernetes cluster deployed in aws. This is the error log i get when i try to create a workspace.Che service account has all the access.
The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password

i am also facing same issue by using through yaml files , any solution please

[hari1992-web]

Error: Failed to start the workspace: "Failure executing: POST at: https://10.96.0.1/api/v1/namespaces. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. namespaces is forbidden: User "system:serviceaccount:default:che" cannot create resource "namespaces" in API group "" at the cluster scope. The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password."

[skabashnyuk]

related to #15946
CC @ibuziuk

[hari1992-web]

related to #15946
CC @ibuziuk

Its not helpful please specify another answer

[skabashnyuk]

@hari1992-web this issue is might be related to #15946 It's worth to check it again when #15946 would be closed.

[hari1992-web]

Press F5 or click here to try again.

Error: Failed to start the workspace: "Failure executing: GET at: https://10.96.0.1/api/v1/namespaces/che-che. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized. The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password."

[hari1992-web]

Press F5 or click here to try again.

Error: Failed to start the workspace: "Failure executing: GET at: https://10.96.0.1/api/v1/namespaces/che-che. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized. The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password."

[ibuziuk]

the original issue is che.openshift.io specific if you can still reproduce it on there, please provide details. Otherwise, please open a separate issue with details.

[sleshchenko]

@hari1992-web We don't support installing through yaml files, we only support helm or operator.
For sure you can run helm with --dry-run and --debug options and extract yamls files you'll be able to apply manually, but it may be error-prone and I don't recommend doing it until you deeply understand Che Deployment. What the problem with chectl?
Please again, create a separate issue!

[ibuziuk]

Looks like we had an issue with expired token on 1a and 1b. @skryzhny rotated the tokens and the issue should be fixed.
@hari1992-web could you please confirm that #12366 (comment) is no longer reproducible fo r you?

[hari1992-web]

@hari1992-web We don't support installing through yaml files, we only support helm or operator.
For sure you can run helm with --dry-run and --debug options and extract yamls files you'll be able to apply manually, but it may be error-prone and I don't recommend doing it until you deeply understand Che Deployment. What the problem with chectl?
Please again, create a separate issue!

ok I will use now with chectl and error will be posted please wait
Thanks
Advance

[hari1992-web]

Readiness probe failed: HTTP probe failed with statuscode: 500
Back-off restarting failed container

facing this issue Iam using installating through chectl tool
please any body know this issue
Thanks Advance

[nickboldt]

1 month later, slip to backlog.

[ibuziuk]

The original issue has been fixed. Closing