Re: [che-dev] How invisible to make the single host gateway?

[Lukas Krejci <lkrejci@xxxxxxxxxx>]

On Tuesday, June 23, 2020 1:35:01 PM CEST Mario Loriedo wrote:
> On Mon, Jun 22, 2020 at 9:53 PM Lukas Krejci <lkrejci@xxxxxxxxxx> wrote:

... snip ...

> > Now to the bullet point 3) - can this all be solved by just running the
> > user
> > applications on separate subdomains even in single-host mode?
> > 
> > IMHO, the answer is no because of the usability concerns. If the whole
> > point
> > of single-host mode is to reduce the number of routes and, more
> > importantly,
> > not require wildcard certificate for Che, we should not come up with a
> > solution that still requires a potentially unbound number of both. We
> > could
> > try to for example expand on the already existing limit of the
> > concurrently
> > running workspaces and also introduce limits for the max number of routes
> > per
> > user (with the admin somehow supplying che with a set of certificates to
> > be
> > used with each such route), but IMHO that is a bit cumbersome solution.
> 
> It looks like bypassing the reverse proxy for user applications makes UX
> much much simpler.
> 
> And I feel like developers can live with http routes for their applications
> (no need
> for wildcard certificates). And that admins can live with one route per
> user
> application (this is an important improvement of current 5 workspaces
> routes plus
> applications routes).
> 
> I think we should default to no proxy per user applications.
> 

1 route per user doesn't make any difference IMHO if we allow more than 1 
workspace running concurrently. If we have 1 route per user for user 
applications and more than 1 of them should be running then all the mentioned 
problems of single host still apply because we'd need to slot them under 
different subpaths. In that case we may very well just have a single route for 
the whole server and things will work the same.

The only possible solution IMHO would be to have route per application and 
limit the number of such routes that can be assigned to the user. This can be 
set to 1 but that would mean that the user can only have a single workspace 
with a single exposed application running at any one time.