Gateway and request routing

The OpenShift Dev Spaces gateway routes requests, authenticates users with OpenID Connect (OIDC), and enforces OpenShift RBAC policies. It controls access to the dashboard, server, plug-in registry, and every user workspace.

The che-gateway Deployment contains four containers:

• gateway (Traefik) routes requests to the correct backend service.
• oauth-proxy (OAuth2 Proxy) authenticates users with OpenID Connect (OIDC).
• kube-rbac-proxy applies OpenShift Role Based Access Control (RBAC) policies to control access to any OpenShift Dev Spaces resource.
• configbump watches for configuration changes and reloads Traefik routing rules without restarting the Pod.

Each container performs a distinct security and routing function. The security guide in Additional resources covers how to configure the access control policies that these containers enforce, and the Traefik, OAuth2 Proxy, and kube-rbac-proxy project repositories provide upstream documentation for each container.