Rh-che: I get message from che.openshift.io: Message: Unauthorized! Configured service account doesn't have access

[bryantson]

Issue problem:

When I try to create a new project, I get the following message from https://che.openshift.io

""Press F5 or click here to try again.
Error: Failed to run the workspace: "Failure executing: POST at: https://f8osoproxy-test-dsaas-production.09b5.dsaas.openshiftapps.com/api/v1/namespaces/rhn-gps-brson-che/services. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked.. The error may be caused by an expired token or changed password. Update Che server deployment with a new token or password."

I tried to follow the step here:

https://github.com/redhat-developer/rh-che/blob/master/FAQ.adoc#how-do-i-figure-out-where-my-workspace-is-running

curl -sgSL "https://api.openshift.io/api/users?filter[username]=rhn-gps-brson"

and it gives: https://api.starter-us-east-1a.openshift.com/

Red Hat Che version:

version: (help/about menu)

• [ ] I can reproduce it on latest official image

Reproduction Steps:

1. Visit https://che.openshift.io and login
2. Create new project
3. See the error

Runtime:

runtime used:

• [ ] minishift (include output of minishift version)
• [ ] OpenShift.io
• [ ] Openshift Container Platform (include output of oc version)
• [x] https://che.openshift.io

[amisevsk]

From looking at the logs on production, strangely this seems to be only impacting your namespace (at least, over the last 7 days).

I would suggest resetting your environment via https://github.com/redhat-developer/rh-che/blob/master/dev-guide.adoc#update-tenant, but that's not a user-friendly flow at the moment and may interfere with figuring out the underlying cause.

[amisevsk]

Looking at it a little more, for some reason your namespace rhn-gps-brson-che does not contain the secret used by Che, so a reset may be necessary after all.

[bryantson]

@amisevsk Hello. Where do I obtain the Bearer token?

[amisevsk]

@bryantson The easiest way I know of is to grab it from a browser request when loading the dashboard:

1. Open developer tools on your browser to network tab
2. Load che.openshift.io
3. Look for authorization header on requests to che.openshift.io once login process is complete.

As I said, not at all a user-friendly flow, but the previous path to doing this was deprecated and not replaced.

[bryantson]

Thanks! It worked. I will try to make the pull request to make clear on how to get the token.

[amisevsk]

Created https://github.com/redhat-developer/rh-che/issues/1569 to track this as it seems others have had the problem.

[ibuziuk]

Closing in favour of https://github.com/redhat-developer/rh-che/issues/1569