Chapter 8. Creating a Red Hat OpenShift Service on AWS cluster that uses direct authentication with an external OIDC identity provider

• Configured virtual private cloud (VPC)
• Created Account-wide roles
• Created an OIDC configuration
• Created Operator roles

Procedure

• If you used the OIDC_ID, SUBNET_IDS, and OPERATOR_ROLES_PREFIX variables to prepare your environment, you can continue to use those variables when creating your cluster. For example, run the following command:

  $ rosa create cluster --hosted-cp --subnet-ids=$SUBNET_IDS \
     --oidc-config-id=$OIDC_ID --cluster-name=<cluster_name> \
     --operator-roles-prefix=$OPERATOR_ROLES_PREFIX \
     --external-auth-providers-enabled

  Copy to Clipboard Toggle word wrap

• If you did not set environmental variables, run the following command:

  $ rosa create cluster --cluster-name=<cluster_name> --sts --mode=auto \
      --hosted-cp --operator-roles-prefix <operator-role-prefix> \
      --oidc-config-id <ID-of-OIDC-configuration> \
      --external-auth-providers-enabled \
      --subnet-ids=<public-subnet-id>,<private-subnet-id>

  Copy to Clipboard Toggle word wrap

Verification

• Verify that your external authentication is enabled in the cluster details by running the following command:

  $ rosa describe cluster --cluster=<cluster_name>

  Copy to Clipboard Toggle word wrap

  In the following example output, the External Authentication field shows that the external authentication is enabled:

  Name:                       rosa-ext-test
  Display Name:               rosa-ext-test
  ID:                         <cluster_id>
  External ID:                <cluster_ext_id>
  Control Plane:              ROSA Service Hosted
  OpenShift Version:          4.21.0
  Channel Group:              stable
  DNS:                        <dns>
  AWS Account:                <AWS_id>
  AWS Billing Account:        <AWS_id>
  API URL:                    <ocm_api>
  Console URL:
  Region:                     us-east-1
  Availability:
   - Control Plane:           MultiAZ
   - Data Plane:              SingleAZ
  
  Nodes:
   - Compute (desired):       2
   - Compute (current):       0
  Network:
   - Type:                    OVNKubernetes
   - Service CIDR:            <service_cidr>
   - Machine CIDR:            <machine_cidr>
   - Pod CIDR:                <pod_cidr>
   - Host Prefix:             /23
   - Subnets:                 <subnet_ids>
  EC2 Metadata Http Tokens:   optional
  Role (STS) ARN:             arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Installer-Role
  Support Role ARN:           arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Support-Role
  Instance IAM Roles:
   - Worker:                  arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Worker-Role
  Operator IAM Roles:
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cloud-network-config-controller-clo
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-capa-controller-manager
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-control-plane-operator
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-kms-provider
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-kube-controller-manager
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-image-registry-installer-cloud-cred
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-ingress-operator-cloud-credentials
   - arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cluster-csi-drivers-ebs-cloud-crede
  Managed Policies:           Yes
  State:                      ready
  Private:                    No
  Created:                    Mar 29 2024 14:25:52 UTC
  User Workload Monitoring:   Enabled
  Details Page:               https://<url>
  OIDC Endpoint URL:          https://<endpoint> (Managed)
  Audit Log Forwarding:       Disabled
  External Authentication:    Enabled

  Copy to Clipboard Toggle word wrap

Procedure

• Do one of the following:

  • To create your external authentication provider using interactive mode, run the following command:

    $ rosa create external-auth-provider -c <cluster_name>

    Copy to Clipboard Toggle word wrap

  • To create your external authentication provider by entering each argument, run the following command:

    $ rosa create external-auth-provider --cluster=<cluster_name> \
        --name=<provider_name> \
        --issuer-url=<issuing_url> \
        --issuer-audiences=<audience_id> \
        --issuer-ca-file=<ca_file_path> \
        --claim-mapping-username-claim=<claim_username> \
        --claim-mapping-groups-claim=<method> \
        --console-client-id=<client_id_for_app_registration> \
        --console-client-secret=<client_secret> \
        --claim-validation-rule=<claim_validation_rule>

    Copy to Clipboard Toggle word wrap

    where:

    <cluster_id>

    The name or the ID of your cluster.

    <provider_name>

    The name of your external authentication provider. This name should be a lower-case with numbers and dashes.

    <issuing_url>

    The URL of the token issuer.

    <audience_id>

    The audience IDs that this authentication provider issues tokens for. This is a comma-separated list of token audiences.

    <ca_file_path>

    Optional. The certificate file to use when making requests.

    <claim_username>

    The name of the claim that is used to construct the user names for cluster identity, such as using email.

    <method>

    The method with which to transform the ID token into a cluster identity, such as using groups.

    <client_id_for_app_registration>

    Optional. The application or client ID that your app registration uses for the console.

    <client_secret>

    The client secret that is used to associate your account with the application. If you do not include the client secret, this command uses a public OIDC OAuthClient.

    <claim_validation_rule>

    Optional. The rules that help validate token claims which authenticate your users. This field should be formatted as :<required_value>.

    Example output

    I: Successfully created an external authentication provider for cluster 'ext-auth-test'

    Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a Red Hat OpenShift Service on AWS cluster with external authentication enabled. For more information, see Creating a Red Hat OpenShift Service on AWS with HCP cluster that uses external authentication providers.
• You have created an external authentication provider. For more information, see Creating an external authentication provider.
• You have an account with cluster admin permissions.

Prerequisites

• You have access to a Red Hat OpenShift Service on AWS cluster with external authentication enabled. For more information, see Creating a Red Hat OpenShift Service on AWS cluster that uses direct authentication with an external OIDC identity provider.
• You have installed the oc and the kubectl CLIs.
• You have configured the new kubeconfig. For more information, see Creating a break glass credential for a Red Hat OpenShift Service on AWS cluster.

Prerequisites

• You have created a break glass credential.
• You are the cluster owner.

Procedure

• Revoke the break glass credentials for a Red Hat OpenShift Service on AWS cluster by running the following command.

  Important

  Running this command will revoke access for all break glass credentials related to the cluster.

  $ rosa revoke break-glass-credentials -c <cluster_name>

  Copy to Clipboard Toggle word wrap

  Example output

  ? Are you sure you want to revoke all the break glass credentials on cluster 'my-cluster'?: Yes
  I: Successfully requested revocation for all break glass credentials from cluster 'my-cluster'

  Copy to Clipboard Toggle word wrap

Verification

• The revocation process can take several minutes. You can verify that the break glass credentials for your clusters have been revoked by running one of the following commands:

  • List all break glass credentials and check the status of each:

    $ rosa list break-glass-credential -c <cluster_name>

    Copy to Clipboard Toggle word wrap

    Example output

    ID                                USERNAME    STATUS
    2330dbs0n8m3chkkr25gkkcd8pnj3lk2  test-user   awaiting_revocation

    Copy to Clipboard Toggle word wrap

  • You can also verify the status by checking the individual credential:

    $ rosa describe break-glass-credential <break_glass_credential_id> -c <cluster_name>

    Copy to Clipboard Toggle word wrap

    Example output

    ID:                                    2330dbs0n8m3chkkr25gkkcd8pnj3lk2
    Username:                              test-user
    Expire at:                             Dec 28 2026 10:23:05 EDT
    Status:                                issued
    Revoked at:                            Dec 27 2026 15:30:33 EDT

    Copy to Clipboard Toggle word wrap