8.5. 使用中断镜凭证访问 Red Hat OpenShift Service on AWS 集群

流程

1. 访问集群的详情：

   $ rosa describe break-glass-credential <break_glass_credential_id> -c <cluster_name>  --kubeconfig > $KUBECONFIG

   Copy to Clipboard Toggle word wrap

2. 列出集群中的节点：

   $ oc get nodes

   Copy to Clipboard Toggle word wrap

   输出示例

   NAME                        STATUS   ROLES   AGE   VERSION
   ip-10-0-0-27.ec2.internal   Ready    worker  8m    v1.28.7+f1b5f6c
   ip-10-0-0-67.ec2.internal   Ready    worker  9m    v1.28.7+f1b5f6c

   Copy to Clipboard Toggle word wrap

3. 验证您是否具有正确的凭证：

   $ kubectl auth whoami

   Copy to Clipboard Toggle word wrap

   输出示例

   ATTRIBUTE    VALUE
   Username     system:customer-break-glass:test-user
   Groups       [system:masters system:authenticated]

   Copy to Clipboard Toggle word wrap

4. 为外部 OIDC 供应商中定义的组应用 ClusterRoleBinding。ClusterRoleBinding 将在 Microsoft Entra ID 中创建的 rosa-hcp-admins 组映射到 Red Hat OpenShift Service on AWS 集群中的组。

   $ oc apply -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: rosa-hcp-admins
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: cluster-admin
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: Group
     name: f715c264-ab90-45d5-8a29-2e91a609a895
   EOF

   Copy to Clipboard Toggle word wrap

   输出示例

   clusterrolebinding.rbac.authorization.k8s.io/rosa-hcp-admins created

   Copy to Clipboard Toggle word wrap

   注意

   应用 ClusterRoleBinding 后，配置了 Red Hat OpenShift Service on AWS 集群，并且 rosa CLI 和 Red Hat Hybrid Cloud 控制台 通过外部 OpenID Connect (OIDC)供应商进行身份验证。现在，您可以开始分配角色并在集群中部署应用程序。