Gateway and request routing

The Che gateway routes requests, authenticates users with OpenID Connect (OIDC), and enforces Kubernetes RBAC policies. It controls access to the dashboard, server, plug-in registry, and every user workspace.

The che-gateway Deployment contains four containers:

  • gateway (Traefik) routes requests to the correct backend service.

  • oauth-proxy (OAuth2 Proxy) authenticates users with OpenID Connect (OIDC).

  • kube-rbac-proxy applies Kubernetes Role Based Access Control (RBAC) policies to control access to any Che resource.

  • configbump watches for configuration changes and reloads Traefik routing rules without restarting the Pod.

Each container performs a distinct security and routing function. The security guide in Additional resources covers how to configure the access control policies that these containers enforce, and the Traefik, OAuth2 Proxy, and kube-rbac-proxy project repositories provide upstream documentation for each container.

Gateway interactions
Figure 1. Che gateway interactions with other components
Additional resources