{"id":4805,"date":"2023-07-08T19:28:45","date_gmt":"2023-07-08T17:28:45","guid":{"rendered":"http:\/\/miro.borodziuk.eu\/?p=4805"},"modified":"2023-09-22T09:19:23","modified_gmt":"2023-09-22T07:19:23","slug":"manage-authentication-and-authorization-with-openshift","status":"publish","type":"post","link":"http:\/\/miro.borodziuk.eu\/index.php\/2023\/07\/08\/manage-authentication-and-authorization-with-openshift\/","title":{"rendered":"Authentication and Authorization on Openshift"},"content":{"rendered":"<p>There are several OpenShift resources related to authentication and authorization. The following is a list of the primary resource types and their definitions:<\/p>\n<ul>\n<li><!--more--><strong>User<\/strong> &#8211; In the OpenShift Container Platform architecture, users are entities that interact with the API server. Assign permissions by adding roles to the user directly or to the groups of which the user is a member.<\/li>\n<li><strong>Identity &#8211; <\/strong>The identity resource keeps a record of successful authentication attempts from a specific user and identity provider. Any data concerning the source of the authentication is stored on the identity. Only a single user resource is associated with an identity resource.<\/li>\n<li><strong>Service Account<\/strong> &#8211; In OpenShift, applications can communicate with the API independently when user credentials cannot be acquired. To preserve the integrity of a regular user&#8217;s credentials, credentials are<br \/>\nnot shared and service accounts are used instead. Service accounts enable you to control API access without the need to borrow a regular user&#8217;s credentials.<\/li>\n<li><strong>Group &#8211; <\/strong>Groups represent a specific set of users. Users are assigned to one or to multiple groups.\u00a0 OpenShift Container Platform also provides system groups or virtual groups that are provisioned automatically by the cluster.<\/li>\n<li><strong>Role &#8211; <\/strong>A role defines a set of permissions that enables a user to perform API operations over one or more resource types. You grant permissions to users, groups, and service accounts by assigning roles to them.<\/li>\n<\/ul>\n<p>User and identity resources are usually not created in advance. They are usually created automatically by OpenShift after a successful interactive log in using OAuth.<\/p>\n<p><span class=\"fontstyle0\">OpenShift OAuth server can be configured to use many identity providers. The following lists includes the more common ones:<\/span><\/p>\n<ul>\n<li><span class=\"fontstyle2\"><strong>HTPasswd &#8211; <\/strong><\/span><span class=\"fontstyle0\">Validates user names and passwords against a secret that stores credentials generated using the <\/span><span class=\"fontstyle3\">htpasswd <\/span><span class=\"fontstyle0\">command.<br \/>\n<\/span><\/li>\n<li><span class=\"fontstyle2\"><strong>Keystone<\/strong> &#8211; <\/span><span class=\"fontstyle0\">Enables shared authentication with an OpenStack Keystone v3 server.<br \/>\n<\/span><\/li>\n<li><span class=\"fontstyle2\"><strong>LDAP<\/strong> &#8211; <\/span><span class=\"fontstyle0\">Configures the LDAP identity provider to validate user names and passwords against an LDAPv3 server, using simple bind authentication.<br \/>\n<\/span><\/li>\n<li><span class=\"fontstyle2\"><strong>GitHub<\/strong> or <strong>GitHub Enterprise<\/strong> &#8211; <\/span><span class=\"fontstyle0\">Configures a GitHub identity provider to validate user names and passwords against GitHub or the GitHub Enterprise OAuth authentication server.<br \/>\n<\/span><\/li>\n<li><span class=\"fontstyle2\"><strong>OpenID Connect<\/strong> &#8211; <\/span><span class=\"fontstyle0\">Integrates with an OpenID Connect identity provider using an Authorization Code Flow. <\/span><\/li>\n<\/ul>\n<p><span class=\"fontstyle0\">The <code>OAuth<\/code> custom resource must be updated with your desired identity provider. You can define multiple identity providers, of the same or different kinds, on the same OAuth custom resource.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span class=\"fontstyle0\"><span style=\"color: #3366ff;\">Authenticating as a Cluster Administrator<\/span><br \/>\n<\/span><span class=\"fontstyle2\">Before you can configure an identity provider and manage users, you must access your OpenShift cluster as a cluster administrator. A newly-installed OpenShift cluster provides two ways to authenticate API requests with cluster administrator privileges:<br \/>\n\u2022 Use the <\/span><code><span class=\"fontstyle3\">kubeconfig <\/span><\/code><span class=\"fontstyle2\">file, which embeds an X.509 client certificate that never expires.<br \/>\n\u2022 Authenticate as the <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">virtual user. Successful authentication grants an OAuth access token.<\/span><\/p>\n<p><span class=\"fontstyle2\">To create additional users and grant them different access levels, you must configure an identity provider and assign roles to your users.<\/span><span class=\"fontstyle6\"><br \/>\n<\/span><\/p>\n<ul>\n<li><span class=\"fontstyle0\"><em><span style=\"color: #000000;\">Authenticating Using the X.509 Certificate<\/span><\/em><br \/>\n<\/span><span class=\"fontstyle2\">The <\/span><code><span class=\"fontstyle3\">kubeconfig <\/span><\/code><span class=\"fontstyle2\">file contains specific details and parameters used by the CLI to connect a client to the correct API server, including an X.509 certificate.<br \/>\nThe installation logs provide the location of the <\/span><code><span class=\"fontstyle3\">kubeconfig <\/span><\/code><span class=\"fontstyle2\">file:<br \/>\n<\/span><\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">INFO Run 'export KUBECONFIG=\/root\/auth\/kubeconfig' to manage the cluster with 'oc'.<\/pre>\n<p><span class=\"fontstyle2\">To use the <\/span><code><span class=\"fontstyle3\">kubeconfig <\/span><\/code><span class=\"fontstyle2\">file to authenticate <\/span><code><span class=\"fontstyle3\">oc <\/span><\/code><span class=\"fontstyle2\">commands, you must copy the file to your workstation and set the absolute or relative path to the <\/span><code><span class=\"fontstyle3\">KUBECONFIG <\/span><\/code><span class=\"fontstyle2\">environment variable. Then, you can run any <\/span><code><span class=\"fontstyle3\">oc <\/span><\/code><span class=\"fontstyle2\">that requires cluster administrator privileges without logging in to OpenShift.<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ export KUBECONFIG=\/path\/to\/kubeconfig\r\n[user@host ~]$ oc get nodes<\/pre>\n<p><span class=\"fontstyle2\">As an alternative, you can use the <\/span><code><span class=\"fontstyle3\">--kubeconfig <\/span><\/code><span class=\"fontstyle2\">option of the <\/span><span class=\"fontstyle3\">oc <\/span><span class=\"fontstyle2\">command.<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ oc --kubeconfig \/path\/to\/kubeconfig get nodes<\/pre>\n<ul>\n<li><span class=\"fontstyle0\"><em><span style=\"color: #000000;\">Authenticating Using the kubeadmin Virtual User<\/span><\/em><br \/>\n<\/span><span class=\"fontstyle2\">After installation completes, OpenShift creates the <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">virtual user. The <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">secret in the <\/span><span class=\"fontstyle3\">kube-system <\/span><span class=\"fontstyle2\">namespace contains the hashed password for the <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">user. The <\/span><span class=\"fontstyle3\">kubeadmin <\/span><span class=\"fontstyle2\">user has cluster administrator privileges. The OpenShift installer dynamically generates a unique <\/span><span class=\"fontstyle3\">kubeadmin <\/span><span class=\"fontstyle2\">password for the cluster. The installation logs provide the <\/span><span class=\"fontstyle3\">kubeadmin <\/span><span class=\"fontstyle2\">credentials used to log in to the cluster. The cluster<br \/>\ninstallation logs also provide log in, password, and the URL for console access.<br \/>\n<\/span><\/li>\n<\/ul>\n<pre class=\"lang:default decode:true\">...output omitted...\r\nINFO The cluster is ready when 'oc login -u kubeadmin -p shdU_trbi_6ucX_edbu_aqop'\r\n...output omitted...\r\nINFO Access the OpenShift web-console here:\r\nhttps:\/\/console-openshift-console.apps.ocp4.example.com\r\nINFO Login to the console with user: kubeadmin, password: shdU_trbi_6ucX_edbu_aqop<\/pre>\n<p>&nbsp;<\/p>\n<p><span class=\"fontstyle0\"><span style=\"color: #3366ff;\">Deleting the Virtual User<\/span><br \/>\n<\/span><span class=\"fontstyle2\">After you define an identity provider, create a new user, and assign that user the <\/span><span class=\"fontstyle3\">cluster-admin <\/span><span class=\"fontstyle2\">role, you can remove the <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">user credentials to improve cluster security.<\/span><\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ oc delete secret kubeadmin -n kube-system<\/pre>\n<p><span class=\"fontstyle2\">If you delete the <\/span><code><span class=\"fontstyle3\">kubeadmin <\/span><\/code><span class=\"fontstyle2\">secret before you configure another user with cluster admin privileges, then the only way you can administer your cluster is using the <\/span><code><span class=\"fontstyle3\">kubeconfig <\/span><\/code><span class=\"fontstyle2\">file. If you do not have a copy of this file in a safe location, then you cannot recover administrative access to your cluster. The only alternative is destroying and reinstalling your cluster.<br \/>\n<\/span><span class=\"fontstyle2\"><br \/>\n<\/span><\/p>\n<p><span class=\"fontstyle0\" style=\"color: #3366ff;\">Configuring the HTPasswd Identity Provider<\/span><\/p>\n<p>The<code> HTPasswd<\/code> identity provider validates users against a secret that contains user names and passwords generated with the <code>htpasswd<\/code> command from the Apache HTTP Server project. Only a cluster administrator can change the data inside the <code>HTPasswd<\/code> secret. Regular users cannot change their own passwords. Most production environments require a more<br \/>\npowerful identity provider that integrates with the organization&#8217;s identity management system.<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Configuring the OAuth Custom Resource<\/span><br \/>\nTo use the <code>HTPasswd<\/code> identity provider, the <code>OAuth<\/code> custom resource must be edited to add an entry to the<code> .spec.identityProviders<\/code> array:<\/p>\n<pre class=\"lang:default decode:true\">apiVersion: config.openshift.io\/v1\r\nkind: OAuth\r\nmetadata:\r\n  name: cluster\r\nspec:\r\n  identityProviders:\r\n  - name: my_htpasswd_provider\r\n    mappingMethod: claim\r\n    type: HTPasswd\r\n    htpasswd:\r\n      fileData:\r\n        name: htpasswd-secret<\/pre>\n<ul>\n<li><code>name: my_htpasswd_provider<\/code> &#8211; This provider name is prefixed to provider user names to form an identity name.<\/li>\n<li><code>mappingMethod: claim<\/code> &#8211; Controls how mappings are established between provider identities and user objects.<\/li>\n<li><code>name: htpasswd-secret<\/code> &#8211; An existing secret containing data generated using the <code>htpasswd<\/code> command.<\/li>\n<\/ul>\n<p>To update the OAuth custom resource, use the <code>oc get<\/code> command to export the existing OAuth cluster resource to a file in YAML format.<\/p>\n<p><code>[user@host ~]$ oc get oauth cluster -o yaml &gt; oauth.yaml<\/code><\/p>\n<p>Then, open the resulting file in a text editor and make the needed changes to the embedded identity provider settings. After completing modifications and saving the file, you must apply the new custom resource using<br \/>\nthe<code> oc replace<\/code> command.<\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc replace -f oauth.yaml<\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Managing Users with the HTPasswd Identity Provider<\/span><br \/>\nManaging user credentials with the <code>HTPasswd<\/code> Identity Provider requires creating a temporary <code>htpasswd<\/code> file, making changes to the file, and applying these changes to the secret.<\/p>\n<ul>\n<li><em>Creating an HTPasswd File<\/em><br \/>\nThe httpd-tools package provides the htpasswd utility, it must be installed and available on your system. Create the htpasswd file.<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">[user@host ~]$ htpasswd -c -B -b \/tmp\/htpasswd student redhat123<\/pre>\n<p>Use the <code>-c<\/code> option only when creating a new file. The <code>-c<\/code> option replaces all file content if the file already exists.<\/p>\n<p>Add or update credentials:<\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ htpasswd -b \/tmp\/htpasswd student redhat1234<\/pre>\n<p>Delete credentials:<\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ htpasswd -D \/tmp\/htpasswd student<\/pre>\n<ul>\n<li><em>Creating the HTPasswd Secret<\/em><br \/>\nTo use the <code>HTPasswd<\/code> provider, you must create a secret that contains the <code>htpasswd<\/code> file data. The following example uses a secret named <em>htpasswd-secret.<\/em><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc create secret generic htpasswd-secret \\\r\n&gt; --from-file htpasswd=\/tmp\/htpasswd -n openshift-config<\/pre>\n<\/li>\n<li><em>Extracting Secret Data<\/em><br \/>\nWhen adding or removing users, an administrator cannot assume the validity of a local <code>htpasswd<\/code> file. Moreover, the administrator might not be on a system that has the htpasswd file. In a real world scenario, it would behoove the administrator to use the<code> oc extract<\/code> command. By default, the<code> oc extract<\/code> command saves each key within a configuration map or secret as a<br \/>\nseparate file. Alternatively, all data can then be redirected to a file or displayed as standard output. To extract data from the<code> htpasswd-secret<\/code> secret to the <code>\/tmp\/<\/code> directory, use the following command. The <code>--confirm<\/code> option replaces the file if it already exists.<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true\">[user@host ~]$ oc extract secret\/htpasswd-secret -n openshift-config \\\r\n&gt; --to \/tmp\/ --confirm \/tmp\/htpasswd<\/pre>\n<ul>\n<li><em>Updating the HTPasswd Secret<\/em><br \/>\nThe secret must be updated after adding, changing, or deleting users. Use the oc set data secret command to update a secret.\u00a0 The following command updates the <code>htpasswd-secret<\/code> secret\u00a0 using the content of the <code>\/tmp\/htpasswd<\/code> file.<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc set data secret\/htpasswd-secret \\\r\n&gt; --from-file htpasswd=\/tmp\/htpasswd -n openshift-config<\/pre>\n<p>After updating the secret, the <code>OAuth<\/code> operator redeploys pods in the openshiftauthentication namespace. Monitor the redeployment of the new OAuth pods by running:<\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ watch oc get pods -n openshift-authentication\r\nTest additions, changes, or deletions to the secret after the new pods finish deploying.<\/pre>\n<p><span class=\"fontstyle0\">Test additions, changes, or deletions to the secret after the new pods finish deploying.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span class=\"fontstyle0\"><span style=\"color: #3366ff;\">Deleting Users and Identities<\/span><br \/>\n<\/span><span class=\"fontstyle2\">When a scenario occurs that requires you to delete a user, it is not sufficient to delete the user from the identity provider. The user and identity resources must also be deleted. You must remove the password from the htpasswd secret, remove the user from the local htpasswd file, and then update the secret. <\/span><\/p>\n<p><span class=\"fontstyle2\">To delete the user from htpasswd, run the following command:<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true\">[user@host ~]$ htpasswd -D \/tmp\/htpasswd manager<\/pre>\n<p><span class=\"fontstyle2\">Update the secret to remove all remnants of the user&#8217;s password:<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc set data secret\/htpasswd-secret \\\r\n&gt; --from-file htpasswd=\/tmp\/htpasswd -n openshift-config<\/pre>\n<p><span class=\"fontstyle2\">Remove the user resource with the following command:<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc delete user manager\r\nuser.user.openshift.io \"manager\" deleted<\/pre>\n<p><span class=\"fontstyle2\">Identity resources include the name of the identity provider. To delete the identity resource for the <\/span><span class=\"fontstyle6\">manager <\/span><span class=\"fontstyle2\">user, find the resource and then delete it.<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc get identities | grep manager\r\nmy_htpasswd_provider:manager my_htpasswd_provider manager manager ...\r\n\r\n[user@host ~]$ oc delete identity my_htpasswd_provider:manager\r\nidentity.user.openshift.io \"my_htpasswd_provider:manager\" deleted<\/pre>\n<p>&nbsp;<\/p>\n<p><span class=\"fontstyle0\"><span style=\"color: #3366ff;\">Assigning Administrative Privileges<\/span><br \/>\n<\/span><span class=\"fontstyle2\">The cluster-wide <\/span><span class=\"fontstyle6\">cluster-admin <\/span><span class=\"fontstyle2\">role grants cluster administration privileges to users and groups. This role enables the user to perform any action on any resources within the cluster. The following example assigns the <\/span><span class=\"fontstyle6\">cluster-admin <\/span><span class=\"fontstyle2\">role to the <\/span><span class=\"fontstyle6\">student <\/span><span class=\"fontstyle2\">user.<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc adm policy add-cluster-role-to-user cluster-admin student<\/pre>\n<p>&nbsp;<\/p>\n<p><strong><span style=\"color: #3366ff;\"> Excercise 1<\/span><br \/>\n<\/strong><\/p>\n<p><span class=\"fontstyle0\">In this exercise, you will configure the <code>HTPasswd<\/code> identity provider and create users for cluster administrators.<\/span><\/p>\n<p><span class=\"fontstyle0\">Add an entry for two htpasswd users, <\/span><code><span class=\"fontstyle2\">admin <\/span><\/code><span class=\"fontstyle0\">and <\/span><code><span class=\"fontstyle2\">developer<\/span><\/code><span class=\"fontstyle0\">. Assign <\/span><code><span class=\"fontstyle2\">admin <\/span><\/code><span class=\"fontstyle0\">a password of <\/span><code><span class=\"fontstyle2\">redhat <\/span><\/code><span class=\"fontstyle0\">and <\/span><code><span class=\"fontstyle2\">developer <\/span><\/code><span class=\"fontstyle0\">a password of <\/span><code><span class=\"fontstyle2\">developer<\/span><\/code><span class=\"fontstyle0\">.<\/span><\/p>\n<p><span class=\"fontstyle0\">Create an HTPasswd authentication file named <\/span><span class=\"fontstyle2\">htpasswd <\/span><span class=\"fontstyle0\">in the <\/span><code><span class=\"fontstyle2\">~\/ auth-provider\/ <\/span><\/code><span class=\"fontstyle0\">directory. Add the <\/span><code><span class=\"fontstyle2\">admin <\/span><\/code><span class=\"fontstyle0\">user with the password of <\/span><code><span class=\"fontstyle2\">redhat<\/span><\/code><span class=\"fontstyle0\">.<br \/>\n<\/span><span class=\"fontstyle0\">Use the <\/span><span class=\"fontstyle2\">htpasswd <\/span><span class=\"fontstyle0\">command to populate the HTPasswd authentication file with the user names and encrypted passwords. The <\/span><code><span class=\"fontstyle2\">-B <\/span><\/code><span class=\"fontstyle0\">option uses bcrypt encryption. By default, the <\/span><span class=\"fontstyle2\">htpasswd <\/span><span class=\"fontstyle0\">command uses the MD5 hashing algorithm when you do not specify other algorithm.<\/span><span class=\"fontstyle5\"><br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ sudo dnf -y install httpd-tools\r\n$ mkdir ~\/auth-provider\r\n$ htpasswd -c -B -b ~\/auth-provider\/htpasswd admin redhat\r\nAdding password for user admin<\/pre>\n<p><span class=\"fontstyle0\">Add the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user with a password of <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">to the <\/span><code><span class=\"fontstyle2\">~\/auth-provider\/htpasswd <\/span><\/code><span class=\"fontstyle0\"><code>file<\/code>. The password for the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user is stored using MD5, because no hashing algorithm was specified when invoking the <\/span><span class=\"fontstyle2\">htpasswd<br \/>\n<\/span><span class=\"fontstyle0\">command.<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ htpasswd -b ~\/auth-provider\/htpasswd developer developer\r\nAdding password for user developer<\/pre>\n<p><span class=\"fontstyle0\">Review the contents of the <\/span><code><span class=\"fontstyle2\">~\/auth-provider\/htpasswd <\/span><\/code><span class=\"fontstyle0\">file and verify that it includes two entries with hashed passwords: one for the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">user and<br \/>\nanother for the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user.<br \/>\n<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ cat ~\/auth-provider\/htpasswd\r\nadmin:$2y$05$KsgsueHoqHcdbXCVYCzL9exuqS.aEgzk8oR\/8R40oSLK4LlPMM2gm\r\ndeveloper:$apr1$2HDtqmJL$qQn5.LrEar4.1BMW7C3U1<\/pre>\n<p><span class=\"fontstyle0\">Log in to the cluster as the <\/span><span class=\"fontstyle2\">kubeadmin <\/span><span class=\"fontstyle0\">user<\/span> :<\/p>\n<pre class=\"lang:default decode:true\">$ export KUBECONFIG=~\/.kube\/config\r\n$  oc login -u kubeadmin\r\nLogged into \"https:\/\/172.30.9.22:8443\" as \"kubeadmin\" using existing credentials.\r\nYou don't have any projects. You can try to create a new project, by running\r\noc new-project &lt;projectname&gt;\r\n<\/pre>\n<p><span class=\"fontstyle0\">Create a secret from the <\/span><code><span class=\"fontstyle2\">~\/auth-provider\/htpasswd <\/span><\/code><span class=\"fontstyle0\">file. To<br \/>\nuse the <code>HTPasswd<\/code> identity provider, you must define a secret with a key named <\/span><code><span class=\"fontstyle2\">htpasswd <\/span><\/code><span class=\"fontstyle0\">that contains the HTPasswd user file <\/span><code><span class=\"fontstyle2\">~\/auth-provider\/<br \/>\nhtpasswd<\/span><\/code><span class=\"fontstyle0\">.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc create secret generic localusers --from-file htpasswd=~\/auth-provider\/htpasswd -n openshift-config\r\nsecret\/localusers created<\/pre>\n<p><span class=\"fontstyle0\">Assign the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">user the <\/span><span class=\"fontstyle2\">cluster-admin <\/span><span class=\"fontstyle0\">role<\/span> :<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy add-cluster-role-to-user cluster-admin admin\r\nWarning: User 'admin' not found\r\ncluster role \"cluster-admin\" added: \"admin\"<\/pre>\n<p>Export the existing<code> OAuth<\/code> resource to a file named oauth.yaml in the <code>~\/auth-provider<\/code> directory:<\/p>\n<pre class=\"lang:default decode:true\">$ oc get oauth cluster -o yaml &gt; ~\/auth-provider\/oauth.yaml<\/pre>\n<p><span class=\"fontstyle0\">Edit the <\/span><span class=\"fontstyle2\">~\/auth-provider\/oauth.yaml <\/span><span class=\"fontstyle0\">file with your preferred text editor. You can choose the names of the <\/span><span class=\"fontstyle2\">identityProviders <\/span><span class=\"fontstyle0\">and <\/span><span class=\"fontstyle2\">fileData <\/span><span class=\"fontstyle0\">structures. For this exercise, use the <\/span><code><span class=\"fontstyle2\">myusers <\/span><\/code><span class=\"fontstyle0\">and <\/span><code><span class=\"fontstyle2\">localusers <\/span><\/code><span class=\"fontstyle0\">values respectively. The completed custom resource should match the following. Note that <\/span><code><span class=\"fontstyle2\">htpasswd<\/span><\/code><span class=\"fontstyle0\">,<br \/>\n<\/span><code><span class=\"fontstyle2\">mappingMethod<\/span><\/code><span class=\"fontstyle0\">, <\/span><code><span class=\"fontstyle2\">name <\/span><\/code><span class=\"fontstyle0\">and <\/span><code><span class=\"fontstyle2\">type <\/span><\/code><span class=\"fontstyle0\">are at the same indentation level.<\/span><\/p>\n<pre class=\"lang:default decode:true \">apiVersion: config.openshift.io\/v1\r\nkind: OAuth\r\nmetadata:\r\n  name: cluster\r\nspec:\r\n  identityProviders:\r\n  - htpasswd:\r\n      fileData:\r\n        name: localusers\r\n    mappingMethod: claim\r\n    name: myusers\r\n    type: HTPasswd\r\n<\/pre>\n<p><span class=\"fontstyle0\">Apply the custom resource defined in the previous step<\/span> :<\/p>\n<pre class=\"lang:default decode:true\">$  oc replace -f ~\/auth-provider\/oauth.yaml<\/pre>\n<p><span class=\"fontstyle0\">Pods in the <\/span><span class=\"fontstyle2\">openshift-authentication <\/span><span class=\"fontstyle0\">namespace will redeploy if the <\/span><span class=\"fontstyle2\">oc<br \/>\nreplace <\/span><span class=\"fontstyle0\">command succeeds. Provided the previously created secret was created correctly, you can log in using the HTPasswd identity provider.<\/span><\/p>\n<p>Log in to the cluster as the admin user to verify the HTPasswd authentication is configured correctly. The authentication operator takes some time to load the configuration changes from the previous step.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Use the oc get nodes command to verify that the admin user has the clusteradmin role.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get nodes\r\nNAME STATUS ROLES AGE VERSION\r\nmaster01 Ready master,worker 2d v1.23.5+9ce5071\r\nmaster02 Ready master,worker 2d v1.23.5+9ce5071\r\nmaster03 Ready master,worker 2d v1.23.5+9ce5071<\/pre>\n<p><span class=\"fontstyle0\">Log in to the cluster as the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user to verify the HTPasswd authentication is configured correctly<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u developer -p developer<\/pre>\n<p>Use the oc get nodes command to verify that the developer and admin users<br \/>\ndo not share the same level of access.<\/p>\n<pre class=\"lang:default decode:true\">$ oc get nodes\r\nNo resources found.\r\nError from server (Forbidden): nodes is forbidden: User \"developer\" cannot list nodes at the cluster scope: no RBAC policy matched<\/pre>\n<p>Log in as the admin user.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p redhat\r\nLogin successful.\r\n<\/pre>\n<p><span class=\"fontstyle0\">List the current users<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ oc get identity\r\nNAME IDP NAME IDP USER NAME USER NAME USER UID\r\nmyusers:admin myusers admin admin 31f6ccd2-6c58-47...\r\nmyusers:developer myusers developer developer d4e77b0d-9740-4f...<\/pre>\n<p>As the admin user, create a new HTPasswd user named manager with a password of redhat.<\/p>\n<p>Extract the file data from the secret to the <code>~\/auth-provider\/htpasswd<\/code> file.<\/p>\n<pre class=\"lang:default decode:true\">$ oc extract secret\/localusers -n openshift-config \\\r\n --to ~\/DO280\/labs\/auth-provider\/ --confirm\r\n~\/auth-provider\/htpasswd<\/pre>\n<p>Add an entry to your ~\/auth-provider\/htpasswd file for the<br \/>\nadditional user manager with a password of redhat.<\/p>\n<pre class=\"lang:default decode:true \">$ htpasswd -b ~\/auth-provider\/htpasswd manager redhat\r\nAdding password for user manage<\/pre>\n<p><span class=\"fontstyle0\">Review the contents of your <\/span><code><span class=\"fontstyle2\">~\/auth-provider\/htpasswd <\/span><\/code><span class=\"fontstyle0\">file and verify that it includes three entries with hashed passwords: one each for the <\/span><span class=\"fontstyle2\">admin<\/span><span class=\"fontstyle0\">,<br \/>\n<\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">and <\/span><span class=\"fontstyle2\">manager <\/span><span class=\"fontstyle0\">users<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ cat ~\/auth-provider\/htpasswd\r\nadmin:$2y$05$KsgsueHoqHcdbXCVYCzL9exuqS.aEgzk8oR\/8R40oSLK4LlPMM2gm\r\ndeveloper:$apr1$2HDtqmJL$qQn5.LrEar4.1BMW7C3U10\r\nmanager:$apr1$FEEqXKE\/$JKEfTjlQ.HltudJZBZ1FY0\r\n<\/pre>\n<p>You must update the secret after adding additional users. Use the <code>oc set data<\/code><code>secret<\/code> command to update the secret. If you receive a failure, then rerun the command again after a few moments as the oauth operator might still be reloading<\/p>\n<pre class=\"lang:default decode:true\">$ oc set data secret\/localusers \\\r\n--from-file htpasswd=~\/auth-provider\/htpasswd \\\r\n-n openshift-config<\/pre>\n<p>Wait a few moments for the authentication operator to reload, and then log in to the cluster as the manager user.<\/p>\n<pre class=\"lang:default decode:true \">$  oc login -u manager -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Create a new project named auth-provider, and then verify that the developer user cannot access the project.<br \/>\nAs the manager user, create a new auth-provider project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc new-project auth-provider\r\nNow using project \"auth-provider\"<\/pre>\n<p>Log in as the developer user.<\/p>\n<pre class=\"lang:default decode:true\">$  oc login -u developer -p developer\r\nLogin successful.\r\n<\/pre>\n<p>Attempt to delete the auth-provider project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc delete project auth-provider\r\nError from server (Forbidden): projects.project.openshift.io \"auth-provider\"\r\nis forbidden: User \"developer\" cannot delete resource \"projects\"\r\nin API group \"project.openshift.io\" in the namespace \"auth-provider\"<\/pre>\n<p>Change the password for the manager user.<br \/>\nLog in as the admin user.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Extract the file data from the secret to the<code> ~\/auth-provider\/htpasswd<\/code> file.<\/p>\n<pre class=\"lang:default decode:true \">$ oc extract secret\/localusers -n openshift-config\u00a0 --to ~\/auth-provider\/ --confirm\r\n~\/auth-provider\/htpasswd<\/pre>\n<p>Generate a random user password and assign it to the <code>MANAGER_PASSWD<\/code> variable<\/p>\n<pre class=\"lang:default decode:true\">$ MANAGER_PASSWD=\"$(openssl rand -hex 15)\"\r\n$ echo $MANAGER_PASSWD\r\n962e0ea57950b2845632f6130ca06<\/pre>\n<p>Update the manager user to use the password stored in the <code>MANAGER_PASSWD<\/code> variable.<\/p>\n<pre class=\"lang:default decode:true\">$ htpasswd -b ~\/auth-provider\/htpasswd manager ${MANAGER_PASSWD}\r\nUpdating password for user manage<\/pre>\n<p>Update the secret<\/p>\n<pre class=\"lang:default decode:true\">$ oc set data secret\/localusers \\\r\n --from-file htpasswd=~\/DO280\/labs\/auth-provider\/htpasswd \\\r\n -n openshift-config\r\nsecret\/localusers data updated<\/pre>\n<p>Log in as the manager user to verify the updated password.<\/p>\n<pre class=\"lang:default decode:true\">$ oc login -u manager -p ${MANAGER_PASSWD}\r\nLogin successful.<\/pre>\n<p>8. Remove the manager user.<br \/>\nLog in as the admin user<\/p>\n<pre class=\"lang:default decode:true\">$ oc login -u admin -p redhat\r\nLogin successful.<\/pre>\n<p>Extract the file data from the secret to the <code>~\/auth-provider\/htpasswd<\/code> file.<\/p>\n<pre class=\"lang:default decode:true \">$ oc extract secret\/localusers -n openshift-config\u00a0 --to ~\/auth-provider\/ --confirm ~\/auth-provider\/htpasswd<\/pre>\n<p>Delete the manager user from the <code>~\/auth-provider\/htpasswd<\/code> file.<\/p>\n<pre class=\"lang:default decode:true\">$ htpasswd -D ~\/auth-provider\/htpasswd manager\r\nDeleting password for user manager<\/pre>\n<p>Update the secret.<\/p>\n<pre class=\"lang:default decode:true\">$ oc set data secret\/localusers\u00a0 --from-file htpasswd=~\/auth-provider\/htpasswd -n openshift-config\r\nsecret\/localusers data updated<\/pre>\n<p>Delete the identity resource for the manager user.<\/p>\n<pre class=\"lang:default decode:true\">$ oc delete identity \"myusers:manager\"\r\nidentity.user.openshift.io \"myusers:manager\" deleted<\/pre>\n<p>Delete the user resource for the manager user.<\/p>\n<pre class=\"lang:default decode:true\">$ oc delete user manager\r\nuser.user.openshift.io manager deleted<\/pre>\n<p>Now, attempts to log in as the manager user fail.<\/p>\n<pre class=\"lang:default decode:true\">$ oc login -u manager -p ${MANAGER_PASSWD}\r\nLogin failed (401 Unauthorized)<\/pre>\n<p>Verify you have provided correct credentials.<br \/>\nList the current users to verify that the manager user is deleted.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get users\r\nNAME UID FULL NAME IDENTITIES\r\nadmin 31f6ccd2-6c58-47ee-978d-5e5e3c30d617 myusers:admin\r\ndeveloper d4e77b0d-9740-4f05-9af5-ecfc08a85101 myusers:developer\r\n<\/pre>\n<p>Display the list of current identities to verify that the manager identity is deleted.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get identity\r\nNAME IDP NAME IDP USER NAME USER NAME\r\nmyusers:admin myusers admin admin ...\r\nmyusers:developer myusers developer developer ...<\/pre>\n<p>Extract the secret and verify that only the users admin and developer are<br \/>\ndisplayed. Using <code>--to-sends<\/code> the secret to STDOUT rather than saving it to a file.<\/p>\n<pre class=\"lang:default decode:true \">$ oc extract secret\/localusers -n openshift-config --to -\r\n# htpasswd\r\nadmin:$2y$05$TizWp\/2ct4Edn08gmeMBIO9IXujpLqkKAJ0Nldxc\/V2XYYMBf6WBy\r\ndeveloper:$apr1$8Bc6txgb$bwHke4cGRGk9C8tQLg.hi1<\/pre>\n<p>9. Remove the identity provider and clean up all users.<br \/>\nLog in as the kubeadmin user.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u kubeadmin -p kubepass<\/pre>\n<p>Delete the auth-provider project.<\/p>\n<pre class=\"lang:default decode:true\">$ oc delete project auth-provider\r\nproject.project.openshift.io \"auth-provider\" deleted<\/pre>\n<p>Edit the resource in place to remove the identity provider from <code>OAauth<\/code>:<\/p>\n<pre class=\"lang:default decode:true\">$ oc edit oauth\r\n<\/pre>\n<p>Delete all the lines under spec:, and then append {} after spec:. Leave all the<br \/>\nother information in the file unchanged. Your spec: line should match the following:<\/p>\n<pre class=\"lang:default decode:true \">...output omitted...\r\nspec: {}<\/pre>\n<p>Save your changes, and then verify that the oc edit command applied you changes:<\/p>\n<pre class=\"lang:default decode:true \">oauth.config.openshift.io\/cluster edited<\/pre>\n<p>Delete the localusers secret from the openshift-config namespace.<\/p>\n<pre class=\"lang:default decode:true \">$ oc delete secret localusers -n openshift-config\r\nsecret \"localusers\" deleted<\/pre>\n<p>Delete all user resources.<\/p>\n<pre class=\"lang:default decode:true \">$ oc delete user --all\r\nuser.user.openshift.io \"admin\" deleted\r\nuser.user.openshift.io \"developer\" deleted<\/pre>\n<p>Delete all identity resources.<\/p>\n<pre class=\"lang:default decode:true\">$ oc delete identity --all\r\nidentity.user.openshift.io \"myusers:admin\" deleted\r\nidentity.user.openshift.io \"myusers:developer\" deleted<\/pre>\n<p><span class=\"fontstyle0\">This concludes the guided exercise.<br \/>\n<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Managing Users<\/span><\/p>\n<ul>\n<li>Managing existing users is a three-step procedure\n<ul>\n<li>Use<code> oc extract<\/code> to extract the current username and password from the secret and write it back to htpasswd<\/li>\n<li>Update the current credentials using <code>htpasswd <\/code><\/li>\n<li>Use<code> oc set data secret<\/code> to write the updated data to the secret<\/li>\n<\/ul>\n<\/li>\n<li>After updating the secret, the OAuth operator redeploys Pods in the openshift-authentication namespace<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Changing a User Password<\/span><\/p>\n<ul>\n<li><code>oc extract secret\/htpasswd-secret -n openshift-config --to \/tmp\/ --confirm <\/code><\/li>\n<li><code>htpasswd -B -b \/tmp\/htpasswd anna newpassword <\/code><\/li>\n<li><code>htpasswd -B -b \/tmp\/htpasswd linda secret <\/code><\/li>\n<li><code>oc set data secret\/htpasswd-secret --from-file htpasswd=\/tmp\/htpasswd -n openshift-config<\/code><\/li>\n<\/ul>\n<pre class=\"lang:default decode:true\">$ oc login -u developer -p developer\r\nLogin successful.\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n  * auto\r\n    debug\r\n    limits\r\n    myproject\r\n    network-security\r\n    nodesel\r\n    quota-test\r\nUsing project \"auto\".\r\n\r\n$ oc extract secret\/htpasswd-secret -n openshift-config --to \/tmp\/ --confirm\r\nError from server (Forbidden): secrets \"htpasswd-secret\" is forbidden: User \"developer\" cannot get secrets in the namespace \"openshift-config\": no RBAC policy matched\r\n\r\n$ oc extract secret\/htpasswd-secret --to \/tmp\/ --confirm\r\n\r\n$ htpasswd -B -b \/tmp\/htpasswd anna password\r\nUpdating password for user anna\r\n\r\n$ htpasswd -B -b \/tmp\/htpasswd linda password\r\nUpdating password for user linda\r\n\r\n$ htpasswd -B -b \/tmp\/htpasswd bob password\r\nAdding password for user bob\r\n\r\n$ oc set data secret\/htpasswd-secret --from-file htpasswd=\/tmp\/htpasswd -n openshift-config\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Deleting Users<\/span><\/p>\n<ul>\n<li>The procedure to delete users is comparable to the procedure to update users\n<ul>\n<li>Extract the current secret data to a temporary file<\/li>\n<li>Use<code> htpasswd -D<\/code> to delete the user<\/li>\n<li>Use <code>oc set data secret<\/code> to update the secret<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Working with Groups<\/span><\/p>\n<ul>\n<li>Groups are used to assign additional privileges to people users<\/li>\n<li>Use<code> oc adm groups<\/code> to work with Groups\n<ul>\n<li><code>oc adm groups new developers<\/code><\/li>\n<li><code>oc adm groups add-users developers anna<\/code><\/li>\n<li><code>oc get groups<\/code> will show currently existing groups<\/li>\n<\/ul>\n<\/li>\n<li>After creating groups, use <code>oc policy<\/code> to grant privileges (further explained in Lesson 6)\n<ul>\n<li><code>oc policy add-role-to-group edit developers<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u system:admin \r\n\r\n$ oc adm groups -h\r\nManage groups in your cluster\r\n\r\nGroups are sets of users that can be used when describing policy.\r\n\r\nUsage:\r\n  oc adm groups [flags]\r\n\r\nAvailable Commands:\r\n  add-users    Add users to a group\r\n  new          Create a new group\r\n  prune        Remove old OpenShift groups referencing missing records on an external provider\r\n  remove-users Remove users from a group\r\n  sync         Sync OpenShift groups with records from an external provider.\r\n\r\nUse \"oc adm &lt;command&gt; --help\" for more information about a given command.\r\nUse \"oc adm options\" for a list of global command-line options (applies to all commands).\r\n\r\n\r\n$ oc adm groups new developers\r\ngroup.user.openshift.io\/developers created\r\n\r\n$ oc adm groups add-users developers anna\r\ngroup \"developers\" added: \"anna\"\r\n\r\n$ oc get groups\r\nNAME         USERS\r\ndevelopers   anna\r\n\r\n$ oc policy -h\r\nManage authorization policy\r\n\r\nUsage:\r\n  oc policy [flags]\r\n\r\nAvailable Commands:\r\n  add-role-to-group      Add a role to groups for the current project\r\n  add-role-to-user       Add a role to users or serviceaccounts for the current project\r\n  can-i                  Check whether an action is allowed\r\n  remove-group           Remove group from the current project\r\n  remove-role-from-group Remove a role from groups for the current project\r\n  remove-role-from-user  Remove a role from users for the current project\r\n  remove-user            Remove user from the current project\r\n  scc-review             Checks which ServiceAccount can create a Pod\r\n  scc-subject-review     Check whether a user or a ServiceAccount can create a Pod.\r\n  who-can                List who can perform the specified action on a resource\r\n\r\nUse \"oc &lt;command&gt; --help\" for more information about a given command.\r\nUse \"oc options\" for a list of global command-line options (applies to all commands).\r\n\r\n\r\n$ oc policy add-role-to-group edit developers\r\nrole \"edit\" added: \"developers\"\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Assign Administrative Privileges<\/span><\/p>\n<ul>\n<li>To assign Administrative privileges, the user must be added to the cluster-admin role:\n<ul>\n<li><code>oc adm policy add-cluster-role-to-user cluster-admin anna<\/code><\/li>\n<\/ul>\n<\/li>\n<li>Tip: Use Tab completion to complete the <code>oc adm policy<\/code> command<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">$ oc whoami\r\nsystem:admin\r\n\r\n\r\n$ oc adm policy -h\r\nManage policy on the cluster\r\n\r\nThese commands allow you to assign and manage the roles and policies that apply to users. The reconcile commands allow\r\nyou to reset and upgrade your system policies to the latest default policies.\r\n\r\nTo see more information on roles and policies, use the 'get' and 'describe' commands on the following resources:\r\n'clusterroles', 'clusterpolicy', 'clusterrolebindings', 'roles', 'policy', 'rolebindings', and 'scc'.\r\n\r\nUsage:\r\n  oc adm policy [flags]\r\n\r\nDiscover:\r\n  who-can                         List who can perform the specified action on a resource\r\n  scc-subject-review              Check whether a user or a ServiceAccount can create a Pod.\r\n  scc-review                      Checks which ServiceAccount can create a Pod\r\n\r\nManage project membership:\r\n  remove-user                     Remove user from the current project\r\n  remove-group                    Remove group from the current project\r\n\r\nAssign roles to users and groups:\r\n  add-role-to-user                Add a role to users or serviceaccounts for the current project\r\n  add-role-to-group               Add a role to groups for the current project\r\n  remove-role-from-user           Remove a role from users for the current project\r\n  remove-role-from-group          Remove a role from groups for the current project\r\n\r\nAssign cluster roles to users and groups:\r\n  add-cluster-role-to-user        Add a role to users for all projects in the cluster\r\n  add-cluster-role-to-group       Add a role to groups for all projects in the cluster\r\n  remove-cluster-role-from-user   Remove a role from users for all projects in the cluster\r\n  remove-cluster-role-from-group  Remove a role from groups for all projects in the cluster\r\n\r\nManage policy on pods and containers:\r\n  add-scc-to-user                 Add security context constraint to users or a service account\r\n  add-scc-to-group                Add security context constraint to groups\r\n  remove-scc-from-user            Remove user from scc\r\n  remove-scc-from-group           Remove group from scc\r\n\r\nUpgrade and repair system policy:\r\n  reconcile-cluster-roles         Update cluster roles to match the recommended bootstrap policy\r\n  reconcile-cluster-role-bindings Update cluster role bindings to match the recommended bootstrap policy\r\n  reconcile-sccs                  Replace cluster SCCs to match the recommended bootstrap policy\r\n\r\nUse \"oc adm policy &lt;command&gt; --help\" for more information about a given command.\r\nUse \"oc adm options\" for a list of global command-line options (applies to all commands).\r\n\r\n\r\n$ oc adm policy add-cluster-role-to-user cluster-admin anna\r\ncluster role \"cluster-admin\" added: \"anna\"\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Lab: Managing Users<\/span><\/p>\n<ul>\n<li>Use the <code>HTPasswd<\/code> provider to create users <code>lisa<\/code> and <code>lori<\/code>. Both have the passwords set to &#8220;<code>password<\/code>&#8220;. User lisa should be granted administrator privileges and user lori should not.<\/li>\n<li>After creating the users, log in as either of these users to verify that the administrator command<code> oc get nodes<\/code> works<\/li>\n<li>After trying this, use <code>oc get users<\/code> to verify the existence of both users<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">$ oc whoami\r\nsystem:admin\r\n\r\n$ htpasswd -c -B -b htpasswd lisa password\r\nAdding password for user lisa\r\n\r\n$ htpasswd -c -B -b htpasswd lori password\r\nAdding password for user lori\r\n\r\n$ htpasswd -c -B -b htpasswd admin password\r\nAdding password for user admin\r\n\r\n$ oc create secret generic localusers --from-file htpasswd -n openshift-config\r\nError from server (NotFound): namespaces \"openshift-config\" not found\r\n\r\n$ oc create secret generic localusers --from-file htpasswd\r\nsecret\/localusers created\r\n\r\n$ oc get users\r\nNAME        UID                                    FULL NAME   IDENTITIES\r\nanna        9baafe09-32c1-11ee-9acf-8e5760356a66               anypassword:anna\r\ndeveloper   f4f2ad1c-28c1-11ee-be7a-8e5760356a66               anypassword:developer\r\nkubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66               anypassword:kubadmin\r\nkubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66               anypassword:kubeadmin\r\nlinda       ad85538a-32c1-11ee-9acf-8e5760356a66               anypassword:linda\r\nsystem      e0e53c6f-2ca5-11ee-9acf-8e5760356a66               anypassword:system\r\n[root@okd ex280]#\r\n[root@okd ex280]# oc adm policy add-cluster-role-to-user  cluster-admin lisa\r\nWarning: User 'lisa' not found\r\ncluster role \"cluster-admin\" added: \"lisa\"\r\n\r\n$ oc adm policy add-cluster-role-to-user  cluster-admin admin\r\nWarning: User 'admin' not found\r\ncluster role \"cluster-admin\" added: \"admin\"\r\n\r\n$ oc get oauth cluster\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ oc get oauth cluster\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ oc get oauth cluster -o yaml &gt; oauth.yaml\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ vim oauth.yaml\r\n<\/pre>\n<p>Edit the oauth.yaml file:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5055 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/openshift133.jpg\" alt=\"\" width=\"1054\" height=\"1030\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/openshift133.jpg 1054w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/openshift133-300x293.jpg 300w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/openshift133-1024x1001.jpg 1024w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/openshift133-768x751.jpg 768w\" sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/p>\n<pre class=\"lang:default decode:true\">$ oc replace -f oauth.yaml\r\n\r\n$ oc get pods\r\nNAME           READY     STATUS    RESTARTS   AGE\r\nauto-1-build   0\/1       Error     0          6d\r\n\r\n$ oc get pods -n openshift-authentication\r\nNo resources found.\r\n\r\n$ oc login -u lisa -password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * auto\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"auto\".\r\n\r\n$ oc get nodes\r\nNAME        STATUS    ROLES     AGE       VERSION\r\nlocalhost   Ready     &lt;none&gt;    12d       v1.11.0+d4cacc0\r\n[root@okd ex280]# oc login -u admin -password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * auto\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"auto\".\r\n[root@okd ex280]# oc login -u lori -password\r\nLogin successful.\r\n\r\nYou don't have any projects. You can try to create a new project, by running\r\n\r\n    oc new-project &lt;projectname&gt;\r\n\r\n$ oc get users\r\nNo resources found.\r\nError from server (Forbidden): users.user.openshift.io is forbidden: User \"lori\" cannot list users.user.openshift.io at the cluster scope: no RBAC policy matched\r\n\r\n\r\n$ oc login -u lisa -password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n    auto\r\n    debug\r\n  * default\r\n    kube-dns\r\n    kube-proxy\r\n    kube-public\r\n    kube-system\r\n    limit-project\r\n    limits\r\n    love\r\n    myproject\r\n    myvol\r\n    network-security\r\n    nodesel\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"default\".\r\n\r\n$ oc get users\r\nNAME        UID                                    FULL NAME   IDENTITIES\r\nadmin       fe5d105d-32d6-11ee-9acf-8e5760356a66               anypassword:admin\r\nanna        9baafe09-32c1-11ee-9acf-8e5760356a66               anypassword:anna\r\ndeveloper   f4f2ad1c-28c1-11ee-be7a-8e5760356a66               anypassword:developer\r\nkubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66               anypassword:kubadmin\r\nkubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66               anypassword:kubeadmin\r\nlinda       ad85538a-32c1-11ee-9acf-8e5760356a66               anypassword:linda\r\nlisa        f4341ede-32d6-11ee-9acf-8e5760356a66               anypassword:lisa\r\nlori        02cb3f54-32d7-11ee-9acf-8e5760356a66               anypassword:lori\r\nsystem      e0e53c6f-2ca5-11ee-9acf-8e5760356a66               anypassword:system\r\n<\/pre>\n<p>Lori is oridnary user so she can not get users, lori and admin can do that.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Role-based Access Control (RBAC)<\/span><\/p>\n<p>Role-based access control (RBAC) is a technique for managing access to resources in a computer system. RBAC determines if a user can perform certain actions within the cluster or project. There are two types of roles that can be used depending on the user&#8217;s level of responsibility: cluster and local.<\/p>\n<p>Understanding RBAC<\/p>\n<ul>\n<li>The purpose of RBAC is to connect users to specific roles<\/li>\n<li>Roles have either a project or a cluster scope<\/li>\n<li>Different types of users are available<\/li>\n<li>Users are created as a specific user type, and are granted access to cluster resources using role bindings<\/li>\n<\/ul>\n<p>The authorization process is managed by rules, roles, and bindings.<\/p>\n<ul>\n<li><em>Rule<\/em> &#8211; Allowed actions for objects or groups of objects.<\/li>\n<li><em>Role<\/em> &#8211; Sets of rules. Users and groups can be associated with multiple roles.<\/li>\n<li><em>Binding<\/em> &#8211; Assignment of users or groups to a role.Red Hat OpenShift Container Platform (RHOCP) defines two groups of roles and bindings depending on the user&#8217;s scope and responsibility: cluster roles and local roles.<\/li>\n<li><em>Cluster Role<\/em> &#8211; Users or groups with this role level can manage the OpenShift cluster.<\/li>\n<li><em>Local Role<\/em> &#8211; Users or groups with this role level can only manage elements at a<br \/>\nproject level.<\/li>\n<\/ul>\n<p>Understanding Roles<\/p>\n<ul>\n<li>A role is an API resource that gives specific users access to OpenShift resources, based on verbs\n<ul>\n<li>Verbs are used as permissions, and include <code>get, list, watch, create, update, patch, delete<\/code><\/li>\n<\/ul>\n<\/li>\n<li>Cluster Roles are created when OpenShift is installed<\/li>\n<li>Local Roles provide access to project-based resources<\/li>\n<li>Use <code>oc describe clusterrole.rbac<\/code> for an overview of currently existing cluster roles<\/li>\n<\/ul>\n<p>Understanding Role Bindings<\/p>\n<ul>\n<li>A Role Binding is used to connect a cluster role to a user or group<\/li>\n<li>Use <code>oc describe clusterrolebinding.rbac<\/code> for an overview of bindings between users\/groups and roles<\/li>\n<li>Use <code>oc describe rolebindings.rbac<\/code> to see all roles with a non-cluster scope<\/li>\n<li>Use <code>oc describe rolebindings.rbac -n myproject<\/code> to see local roles assigned to a specific project<\/li>\n<\/ul>\n<p>Understanding Default Roles<\/p>\n<ul>\n<li>Some default roles are provided to be applied locally or to the entire cluster\n<ul>\n<li>admin: gives full control to all project resources<\/li>\n<li>basic-user: gives read access to projects<\/li>\n<li>cluster-admin: allows a user to perform any action in the cluster<\/li>\n<li>cluster-status: allows a user to request status information<\/li>\n<li>edit: allows creating and modifying common application resources, but gives no access to permissions, quotas, or limit ranges<\/li>\n<li>self-provisioner: this cluster role allows users to create new projects<\/li>\n<li>view: allows users to view but not modify project resources<\/li>\n<\/ul>\n<\/li>\n<li>The <strong>admin<\/strong> role gives users full project permissions<\/li>\n<li>The <strong>edit<\/strong> role corresponds to the typical developer user<\/li>\n<\/ul>\n<p>The <em>admin<\/em> role gives a user access to project resources such as quotas and limit ranges, and also the ability to create new applications. The <em>edit<\/em> role gives a user sufficient access to act as a developer inside the project, but working under the constraints configured by a project administrator.<\/p>\n<p>Understanding User Types<\/p>\n<ul>\n<li>Regular users represent a user object that is granted access to the cluster\u00a0 platform<\/li>\n<li>System users are created automatically to allow system components to access specific resources\n<ul>\n<li>system:admin has full admin access<\/li>\n<li>system:openshift-registry is used for registry access<\/li>\n<li>system:node:serverl.example.com is used for node access<\/li>\n<\/ul>\n<\/li>\n<li>Service accounts are special system accounts used to give extra privileges to pods or deployments\n<ul>\n<li>deployer: is used to create deployments<\/li>\n<li>builder: is used to create build configs in S2I<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Managing RBAC<\/p>\n<ul>\n<li>Cluster administrators can use <code>oc adm policy<\/code> to manage cluster and namespace roles\n<ul>\n<li><code>oc adm policy add-cluster-role-to-user rolenname username<\/code><\/li>\n<li><code> oc adm policy remove-cluster-role-from-user rolename username<\/code><\/li>\n<\/ul>\n<\/li>\n<li>To figure out who can do what, use <code>oc adm policy who-can delete user<\/code><\/li>\n<\/ul>\n<p><span style=\"color: #3366ff;\">Managing RBAC Using the CLI<\/span><\/p>\n<ul>\n<li><strong>Cluster administrators<\/strong> can use the <code>oc adm<\/code> policy command to both add and remove cluster roles and namespace roles.<br \/>\nTo add a cluster role to a user, use the add-cluster-role-to-user subcommand:<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">$ oc adm policy add-cluster-role-to-user cluster-role username<\/pre>\n<p>For example, to change a regular user to a cluster administrator, use the following command:<\/p>\n<pre class=\"lang:default decode:true\">$ oc adm policy add-cluster-role-to-user cluster-admin username<\/pre>\n<p>To remove a cluster role from a user, use the remove-cluster-role-from-user<br \/>\nsubcommand:<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy remove-cluster-role-from-user cluster-role username<\/pre>\n<p>For example, to change a cluster administrator to a regular user, use the following command:<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy remove-cluster-role-from-user cluster-admin username<\/pre>\n<p>Rules are defined by an action and a resource. For example, the create user rule is part of the cluster-admin role. You can use the oc adm policy who-can command to determine if a user can execute an action on a resource. For example:<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy who-can delete user<\/pre>\n<ul>\n<li><strong>Project administrators<\/strong> can use the<code> oc policy<\/code> command to add and remove namespace roles. Add a specified role to a user with the add-role-to-user subcommand. For example:\n<pre class=\"lang:default decode:true \">[user@host ~]$ oc policy add-role-to-user role-name username -n project<\/pre>\n<p>For example, to add the user dev to the role basic-user in the wordpress project:<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true\">[user@host ~]$ oc policy add-role-to-user basic-user dev -n wordpress<\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Exercise 1<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ oc explain oauth.spec\r\nerror: You must be logged in to the server (the server has asked for the client to provide credentials)\r\n\r\n$ oc login -u developer -p developer\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * auto\r\n    debug\r\nUsing project \"auto\".\r\n\r\n$ oc explain oauth.spec\r\nthe server doesn't have a resource type \"oauth\"\r\n\r\n$ oc explain oauth\r\nthe server doesn't have a resource type \"oauth\"\r\n\r\n$ oc get oauth cluster\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ httpasswd -c -B -b\r\nUsing username \"root\".\r\nroot@172.30.9.22's password:\r\nSend automatic password\r\nLast login: Thu Aug  3 18:26:07 2023 from 10.8.152.84\r\n\r\n$ oc whoami\r\ndeveloper\r\n\r\n$ htpasswd -c -B -b \/tmp\/htpasswd admin password\r\nAdding password for user admin\r\n\r\n$ htpasswd -b \/tmp\/htpasswd anna password\r\nAdding password for user anna\r\n\r\n$ htpasswd -b \/tmp\/htpasswd linda password\r\nAdding password for user linda\r\n\r\n$ cat \/tmp\/htpasswd\r\nadmin:$2y$05$xp7L9AwDnI9Mil28zfSeIO71.Q3M\/YcPRtYkxx8VxiixcIyV8ElFq\r\nanna:$apr1$Yh2pvQKM$OZpqHTmjaf.UAFngMy5891\r\nlinda:$apr1$E3tvZMiK$DCe0VPfNUIuHgu5e58BOo\/\r\n\r\n$ oc create secret generic htpasswd-secret\r\nsecret\/htpasswd-secret created\r\n\r\n$ oc create secret generic htpasswd-secret --from-file htpasswd=\/tmp\/htpasswd\r\nError from server (AlreadyExists): secrets \"htpasswd-secret\" already exists\r\n\r\n$ oc create secret generic htpasswd-secret --from-file htpasswd=\/tmp\/htpasswd -n openshift-config\r\nError from server (Forbidden): secrets is forbidden: User \"developer\" cannot create secrets in the namespace \"openshift-config\": no RBAC policy mat                                                                                          ched\r\n\r\n$ oc login -u system:admin\r\nLogged into \"https:\/\/172.30.9.22:8443\" as \"system:admin\" using existing credentials.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * auto\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"auto\".\r\n$ oc create secret generic htpasswd-secret --from-file htpasswd=\/tmp\/htpasswd -n openshift-config\r\nError from server (NotFound): namespaces \"openshift-config\" not found\r\n\r\n$ oc describe secret htpasswd-secret -n openshift-config\r\nError from server (NotFound): namespaces \"openshift-config\" not found\r\n\r\n$ oc describe secret htpasswd-secret\r\nName:         htpasswd-secret\r\nNamespace:    auto\r\nLabels:       &lt;none&gt;\r\nAnnotations:  &lt;none&gt;\r\n\r\nType:  Opaque\r\n\r\nData\r\n====\r\n\r\n$ oc adm policy add-cluster-role-to-user cluster-admin anna\r\nWarning: User 'anna' not found\r\ncluster role \"cluster-admin\" added: \"anna\"\r\n\r\n$ oc get oauth\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ cd ~\/ex280\r\n\r\n$ oc get oauth -o yaml &gt; oauth.yaml\r\nerror: the server doesn't have a resource type \"oauth\"\r\n\r\n$ vim oauth.yaml\r\n\r\n$ oc replace -f oauth.yaml\r\n\r\n$ oc get pods\r\nNAME           READY     STATUS    RESTARTS   AGE\r\nauto-1-build   0\/1       Error     0          6d\r\n[root@okd ex280]# oc get pods -n openshift-authentication\r\nNo resources found.\r\n\r\n$ oc get  users\r\nNAME        UID                                    FULL NAME   IDENTITIES\r\ndeveloper   f4f2ad1c-28c1-11ee-be7a-8e5760356a66               anypassword:developer\r\nkubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66               anypassword:kubadmin\r\nkubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66               anypassword:kubeadmin\r\nsystem      e0e53c6f-2ca5-11ee-9acf-8e5760356a66               anypassword:system\r\n\r\n$ oc login -u anna -p password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * auto\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n\r\n\r\nUsing project \"auto\".\r\n\r\n$ oc get users\r\nNAME        UID                                    FULL NAME   IDENTITIES\r\nanna        9baafe09-32c1-11ee-9acf-8e5760356a66               anypassword:anna\r\ndeveloper   f4f2ad1c-28c1-11ee-be7a-8e5760356a66               anypassword:developer\r\nkubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66               anypassword:kubadmin\r\nkubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66               anypassword:kubeadmin\r\nsystem      e0e53c6f-2ca5-11ee-9acf-8e5760356a66               anypassword:system\r\n\r\n$ oc get nodes\r\nNAME        STATUS    ROLES     AGE       VERSION\r\nlocalhost   Ready     &lt;none&gt;    12d       v1.11.0+d4cacc0\r\n\r\n\r\n$ oc login -u linda -p password\r\nLogin successful.\r\n\r\nYou don't have any projects. You can try to create a new project, by running\r\n\r\n    oc new-project &lt;projectname&gt;\r\n\r\n\r\n$ oc get nodes\r\nNo resources found.\r\nError from server (Forbidden): nodes is forbidden: User \"linda\" cannot list nodes at the cluster scope: no RBAC policy matched\r\n\r\n$ oc login -u anna -p password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n    auto\r\n    debug\r\n  * default\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"default\".\r\n\r\n$ oc get users\r\nNAME        UID                                    FULL NAME   IDENTITIES\r\nanna        9baafe09-32c1-11ee-9acf-8e5760356a66               anypassword:anna\r\ndeveloper   f4f2ad1c-28c1-11ee-be7a-8e5760356a66               anypassword:developer\r\nkubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66               anypassword:kubadmin\r\nkubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66               anypassword:kubeadmin\r\nlinda       ad85538a-32c1-11ee-9acf-8e5760356a66               anypassword:linda\r\nsystem      e0e53c6f-2ca5-11ee-9acf-8e5760356a66               anypassword:system\r\n\r\n$ oc get identity\r\nNAME                    IDP NAME      IDP USER NAME   USER NAME   USER UID\r\nanypassword:anna        anypassword   anna            anna        9baafe09-32c1-11ee-9acf-8e5760356a66\r\nanypassword:developer   anypassword   developer       developer   f4f2ad1c-28c1-11ee-be7a-8e5760356a66\r\nanypassword:kubadmin    anypassword   kubadmin        kubadmin    f64059d1-2d63-11ee-9acf-8e5760356a66\r\nanypassword:kubeadmin   anypassword   kubeadmin       kubeadmin   c30e9822-2976-11ee-9acf-8e5760356a66\r\nanypassword:linda       anypassword   linda           linda       ad85538a-32c1-11ee-9acf-8e5760356a66\r\nanypassword:system      anypassword   system          system      e0e53c6f-2ca5-11ee-9acf-8e5760356a66\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Excercise 2<br \/>\n<\/span><\/p>\n<p>List all cluster role bindings that reference the self-provisioner cluster role.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get clusterrolebinding | grep -E 'NAME|self-provisioner'\r\nNAME                                                                       AGE\r\nself-provisioners                                                          4d\r\n<\/pre>\n<p>Confirm that the self-provisioners cluster role binding that you found<br \/>\nin the previous step assigns the self-provisioner cluster role to the<br \/>\n<code>system:authenticated:oauth<\/code> group.<\/p>\n<pre class=\"lang:default decode:true\">$ oc describe clusterrolebindings self-provisioners\r\nName:         self-provisioners\r\nLabels:       &lt;none&gt;\r\nAnnotations:  rbac.authorization.kubernetes.io\/autoupdate=true\r\nRole:\r\n  Kind:  ClusterRole\r\n  Name:  self-provisioner\r\nSubjects:\r\n  Kind   Name                        Namespace\r\n  ----   ----                        ---------\r\n  Group  <strong>system:authenticated:oauth\r\n<\/strong><\/pre>\n<p>Remove the self-provisioner cluster role from the system:authenticated:oauth virtual group, which deletes the selfprovisioners role binding.<\/p>\n<pre class=\"lang:default decode:true \">$oc adm policy remove-cluster-role-from-group \\\r\nself-provisioner system:authenticated:oauth\r\nWarning: Your changes may get lost whenever a master is restarted, unless you prevent reconciliation of this rolebinding using the following command: oc annotate clusterrolebinding.rbac self-provisioners 'rbac.authorization.kubernetes.io\/autoupdate=false' --overwritecluster role \"self-provisioner\" removed: \"system:authenticated:oauth\"\r\n<\/pre>\n<p>You can safely ignore the warning about your changes being lost. Verify that the role has been removed from the group. The cluster role binding selfprovisioners should not exist.<\/p>\n<pre class=\"lang:default decode:true \">$ oc describe clusterrolebindings self-provisioners\r\nError from server (NotFound): clusterrolebindings.rbac.authorization.k8s.io \"self-provisioners\" not found\r\n<\/pre>\n<p>Determine if any other cluster role bindings reference the self-provisioner<br \/>\ncluster role:<\/p>\n<pre class=\"lang:default decode:true\">$ oc get clusterrolebinding -o wide | grep -E 'NAME|self-provisioner'\r\nNAME           AGE       ROLE       USERS       GROUPS     SERVICEACCOUNTS\r\n<\/pre>\n<p>Log in as the leader user with a password of redhat<\/p>\n<pre class=\"lang:default decode:true \">$  oc login -u leader -p redhat\r\nLogin successful.\r\nYou don't have any projects. Contact your system administrator to request a project.<\/pre>\n<p><span class=\"fontstyle0\">Try to create a project, the operation should fail.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc new-project test\r\nError from server (Forbidden): You may not request a new project via this API.<\/pre>\n<p><span class=\"fontstyle0\">Log in as the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">user.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Create the <code>auth-rbac<\/code> project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc new-project auth-rbac\r\nNow using project \"auth-rbac\" on server \"https:\/\/172.30.9.22:8443\".\r\n<\/pre>\n<p>Grant project administration privileges to the leader user on the auth-rbac<br \/>\nproject.<\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-user admin leader\r\nrole \"admin\" added: \"leader\"\r\n<\/pre>\n<p>Create a group called dev-group.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups new dev-group\r\ngroup.user.openshift.io\/dev-group created\r\n<\/pre>\n<p><span class=\"fontstyle0\">Add the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user to <\/span><span class=\"fontstyle2\">dev-group<\/span><span class=\"fontstyle0\">.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$  oc adm groups add-users dev-group developer\r\ngroup \"dev-group\" added: \"developer\"\r\n<\/pre>\n<p>Create a second group called qa-group.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups new qa-group\r\ngroup.user.openshift.io\/qa-group created\r\n<\/pre>\n<p>Add the qa-engineer user to qa-group.<\/p>\n<pre class=\"lang:default decode:true \">oc adm groups add-users qa-group qa-engineer\r\ngroup \"qa-group\" added: \"qa-engineer\"\r\n<\/pre>\n<p>Review all existing OpenShift groups to verify that they have the correct members.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get groups\r\nNAME        USERS\r\ndev-group   developer\r\nqa-group    qa-engineer\r\n<\/pre>\n<p>Log in as the leader user<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u leader -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Add write privileges to dev-group on the auth-rbac project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-group edit dev-group\r\nrole \"edit\" added: \"dev-group\"\r\n<\/pre>\n<p>Add read privileges to qa-group on the auth-rbac project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-group view qa-group\r\nrole \"view\" added: \"qa-group\"\r\n<\/pre>\n<p>Review all role bindings on the auth-rbac project to verify that they assign roles to the correct groups and users. The following output omits default role bindings assigned by OpenShift to service accounts.<\/p>\n<pre class=\"lang:default decode:true\">$ oc get rolebindings -o wide\r\nNAME                    AGE       ROLE                               USERS     GROUPS                             SERVICEACCOUNTS\r\nadmin                   10m       ClusterRole\/admin                  admin\r\nadmin-0                 9m        ClusterRole\/admin                  leader\r\nedit                    2m        ClusterRole\/edit                             dev-group\r\nsystem:deployers        10m       ClusterRole\/system:deployer                                                     auth-rbac\/deployer\r\nsystem:image-builders   10m       ClusterRole\/system:image-builder                                                auth-rbac\/builder\r\nsystem:image-pullers    10m       ClusterRole\/system:image-puller              system:serviceaccounts:auth-rbac\r\nview                    1m        ClusterRole\/view                             qa-group\r\n<\/pre>\n<p>Log in as the developer user<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u developer -p developer\r\nLogin successful.\r\n<\/pre>\n<p>Deploy an Apache HTTP Server using the standard image stream from OpenShift.<\/p>\n<pre class=\"lang:default decode:true\">$ oc new-app --name httpd httpd\r\n--&gt; Found Docker image d140b77 (7 days old) from Docker Hub for \"httpd\"\r\n\r\n    * An image stream tag will be created as \"httpd:latest\" that will track this image\r\n    * This image will be deployed in deployment config \"httpd\"\r\n    * Port 80\/tcp will be load balanced by service \"httpd\"\r\n      * Other containers can access this service through the hostname \"httpd\"\r\n    * WARNING: Image \"httpd\" runs as the 'root' user which may not be permitted by your cluster administrator\r\n\r\n--&gt; Creating resources ...\r\n    imagestream.image.openshift.io \"httpd\" created\r\n    deploymentconfig.apps.openshift.io \"httpd\" created\r\n    service \"httpd\" created\r\n--&gt; Success\r\n    Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:\r\n     'oc expose svc\/httpd'\r\n    Run 'oc status' to view your app.\r\n<\/pre>\n<p>Try to grant write privileges to the qa-engineer user, the operation should fail<\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-user edit qa-engineer\r\nError from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User \"developer\" cannot list rolebindings.rbac.authorization.k8s.io in the namespace \"auth-rbac\": no RBAC policy matched<\/pre>\n<p>Verify that the qa-engineer user only has read privileges on the httpd application.<\/p>\n<pre class=\"lang:default decode:true \">oc login -u qa-engineer -p redhat\r\nLogin successful.\r\nYou have one project on this server: \"auth-rbac\" \r\nUsing project \"auth-rbac\".\r\n<\/pre>\n<p><span class=\"fontstyle0\">Attempt to scale the <\/span><span class=\"fontstyle2\">httpd <\/span><span class=\"fontstyle0\">application, the operation should fail.<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ oc scale deployment httpd --replicas 3\r\nError from server (NotFound): deployments.extensions \"httpd\" not found<\/pre>\n<p>Log in as the admin user<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p redhat\r\nLogin successful.\r\n<\/pre>\n<p>Restore project creation privileges for all users by recreating the selfprovisioners cluster role binding created by the OpenShift installer<\/p>\n<pre class=\"lang:default decode:true \"> oc adm policy add-cluster-role-to-group \\\r\n&gt; --rolebinding-name self-provisioners \\\r\n&gt; self-provisioner system:authenticated:oauth\r\nWarning: Group 'system:authenticated:oauth' not found\r\ncluster role \"self-provisioner\" added: \"system:authenticated:oauth\"\r\n<\/pre>\n<p>You can safely ignore the warning that the group was not found.<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Excercise.<\/span><\/p>\n<p>We have <code>~\/auth-review\/tmp_users<\/code> file:<\/p>\n<pre class=\"lang:default decode:true \">$ cat tmp_user\r\ntester:$apr1$0eqhKgbU$DWd0CB4IumhasaRuEr6hp0\r\nleader:$apr1$.EB5IXlu$FDV.Av16njlOCMzgolScr\/\r\nanalyst:$apr1$0eqhKgbU$DWd0CB4IumhasaRuEr6hp0<\/pre>\n<p>1. Update the existing <code>~\/auth-review\/tmp_users<\/code> HTPasswd authentication<br \/>\nfile to remove the <code>analyst<\/code> user. Ensure that the <code>tester<\/code> and <code>leader<\/code> users in the file use a password of <code>Labreview<\/code>. Add two new entries to the file for the users <code>admin<\/code> and <code>developer<\/code>. Use <code>Labreview<\/code> as the password for each new user.<br \/>\n2. Log in to your OpenShift cluster as the kubeadmin user using the<br \/>\npassword\u00a0 defined in the <code>\/root\/.kube\/config<\/code> file as the password. Configure your cluster to use the HTPasswd identity provider using the user names and passwords in the <code>~\/auth-review\/tmp_users<\/code> file.<br \/>\n3. Make the admin user a cluster administrator. Log in as both admin and as developer to verify HTPasswd user configuration and cluster privileges.<br \/>\n4. As the admin user, remove the ability to create projects cluster wide.<br \/>\n5. Create a group named managers, and add the leader user to the group. Grant project creation privileges to the managers group. As the leader user, create the auth-review project.<br \/>\n6. Create a group named developers and grant edit privileges on the auth-review project. Add the developer user to the group.<br \/>\n7. Create a group named qa and grant view privileges on the auth-review project. Add the tester user to the group.<\/p>\n<p>&nbsp;<\/p>\n<p>1. Remove the analyst user from the ~\/auth-review\/tmp_users<br \/>\nHTPasswd authentication file.<\/p>\n<pre class=\"lang:default decode:true \">$ htpasswd -D ~\/auth-review\/tmp_users analyst\r\nDeleting password for user analyst<\/pre>\n<p><span class=\"fontstyle0\">Update the entries for the <\/span><span class=\"fontstyle2\">tester <\/span><span class=\"fontstyle0\">and <\/span><span class=\"fontstyle2\">leader <\/span><span class=\"fontstyle0\">users so that they use a password of <\/span><span class=\"fontstyle2\">Labreview<\/span><span class=\"fontstyle0\">. Add entries for the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">and <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">users using a password of <\/span><span class=\"fontstyle2\">Labreview<\/span><span class=\"fontstyle0\">.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ for NAME in tester leader admin developer \\\r\n do \\\r\n htpasswd -b ~\/auth-review\/tmp_users ${NAME} 'Labreview' \\\r\n done\r\nUpdating password for user tester\r\nUpdating password for user leader\r\nAdding password for user admin\r\nAdding password for user developer\r\n<\/pre>\n<p><span class=\"fontstyle0\">Review the contents of the <\/span><code><span class=\"fontstyle2\">~\/auth-review\/tmp_users <\/span><\/code><span class=\"fontstyle0\">file. It does not contain a line for the <\/span><code><span class=\"fontstyle2\">analyst <\/span><\/code><span class=\"fontstyle0\">user. It includes two new entries with hashed<br \/>\npasswords for the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">and <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">users.<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ cat ~\/auth-review\/tmp_users\r\ntester:$apr1$L4omTyg\/$71Lvf\/iFItnJa8T1ggNMq1\r\nleader:$apr1$nhs.mUqE$3r5MrE6fiNQ.o7d5SxHDw\/\r\n<strong>admin:$apr1$evJCAbt\/$jJ5TR51yw0P4sbWFGcu.d\/\r\ndeveloper:$apr1$w2oO1UjM$frPgBp54mdnVpp3S1Q1Se1\r\n<\/strong><\/pre>\n<p>&nbsp;<\/p>\n<p>2. <span class=\"fontstyle0\">Log in to the cluster as the <\/span><span class=\"fontstyle2\">kubeadmin <\/span><span class=\"fontstyle0\">user.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u kubeadmin -p kubepass<\/pre>\n<p>Create a secret named auth-review using the <code>~\/auth-review\/tmp_users<\/code> file<\/p>\n<pre class=\"lang:default decode:true\">$ oc create secret generic auth-review \\\r\n--from-file htpasswd=~\/auth-review\/tmp_users \\\r\n-n openshift-config\r\nsecret\/auth-review created<\/pre>\n<p>Export the existing OAuth resource to <code>~\/auth-review\/oauth.yaml<\/code>.<\/p>\n<pre class=\"lang:default decode:true \">$ oc get oauth cluster -o yaml &gt; ~\/auth-review\/oauth.yaml<\/pre>\n<p>Edit the ~\/auth-review\/oauth.yaml file to replace the spec: {} line with the following bold lines. Note that htpasswd, mappingMethod, name and type are at the same indentation level.<\/p>\n<pre class=\"lang:default decode:true \"># cat oauth.yaml\r\napiVersion: config.openshift.io\/v1\r\nkind: OAuth\r\nmetadata:\r\n  name: cluster\r\nspec:\r\n  identityProviders:\r\n  - htpasswd:\r\n      fileData:\r\n        name: auth-review\r\n    mappingMethod: claim\r\n    name: htpasswd\r\n    type: HTPasswd\r\n<\/pre>\n<p><span class=\"fontstyle0\">Apply the customized resource defined in the previous step<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc replace -f ~\/auth-review\/oauth.yaml\r\noauth.config.openshift.io\/cluster replaced<\/pre>\n<p>A successful update to the oauth\/cluster resource recreates the oauthopenshift pods in the openshift-authentication namespace.<\/p>\n<pre class=\"lang:default decode:true \">$ watch oc get pods -n openshift-authentication<\/pre>\n<p>Wait until the new oauth-openshift pods are ready and running and the previous pods have terminated.<\/p>\n<pre class=\"lang:default decode:true \">Every 2.0s: oc get pods -n openshift-authentication ...\r\nNAME READY STATUS RESTARTS AGE\r\noauth-openshift-6755d8795-h8bgv 1\/1 Running 0 34s\r\noauth-openshift-6755d8795-rk4m6 1\/1 Running 0 38s\r\noauth-openshift-6755d8795-2859w 1\/1 Running 0 53s<\/pre>\n<p>Press Ctrl+C to exit the watch command.<\/p>\n<p>3. Assign the admin user the cluster-admin role<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy add-cluster-role-to-user cluster-admin admin\r\ncluster role \"cluster-admin\" added: \"admin\"<\/pre>\n<p>Log in to the cluster as the admin user to verify that HTPasswd authentication was configured correctly.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p 'Labreview'\r\nLogin successful.\r\n<\/pre>\n<p><span class=\"fontstyle0\">Use <\/span><span class=\"fontstyle2\">oc get nodes <\/span><span class=\"fontstyle0\">command to verify the <\/span><span class=\"fontstyle2\">admin <\/span><span class=\"fontstyle0\">user has the <\/span><span class=\"fontstyle2\">cluster-admin <\/span><span class=\"fontstyle0\">role. The names of the nodes from your cluster might be different.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc get nodes\r\nNAME        STATUS    ROLES     AGE       VERSION\r\nlocalhost   Ready     &lt;none&gt;    4d        v1.11.0+d4cacc0<\/pre>\n<p><span class=\"fontstyle0\">Log in to the cluster as the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user to verify the HTPasswd authentication is configured correctly.<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u developer -p 'Labreview'\r\nLogin successful.\r\n<\/pre>\n<p><span class=\"fontstyle0\">Use the <\/span><span class=\"fontstyle2\">oc get nodes <\/span><span class=\"fontstyle0\">command to verify that the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user does not have cluster administration privileges.<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ oc get nodes\r\nNo resources found.\r\nError from server (Forbidden): nodes is forbidden: User \"developer\" cannot list nodes at the cluster scope: no RBAC policy matched<\/pre>\n<p>4. Log in to the cluster as the admin user.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u admin -p 'Labreview'\r\nLogin successful.\r\n<\/pre>\n<p>Remove the self-provisioner cluster role from the<code> system:authenticated:oauth<\/code> virtual group.<\/p>\n<pre class=\"lang:default decode:true\">$ oc adm policy remove-cluster-role-from-group \\\r\nself-provisioner system:authenticated:oauth\r\n\r\ncluster role \"self-provisioner\" removed: \"system:authenticated:oauth\"\r\n<\/pre>\n<p>5. Create a group named managers.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups new managers\r\ngroup.user.openshift.io\/managers created\r\n<\/pre>\n<p>Add the leader user to the managers group.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups add-users managers leader\r\ngroup \"managers\" added: \"leader\"\r\n<\/pre>\n<p>Assign the self-provisioner cluster role to the managers group<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm policy add-cluster-role-to-group self-provisioner managers\r\ncluster role \"self-provisioner\" added: \"managers\"<\/pre>\n<p>As the leader user, create the auth-review project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc login -u leader -p 'Labreview'\r\nLogin successful.\r\n<\/pre>\n<p>The user who creates a project is automatically assigned the admin role on the project.<\/p>\n<pre class=\"lang:default decode:true\">$  oc new-project auth-review\r\nNow using project \"auth-review\" on server \"https:\/\/172.30.9.22:8443\".\r\nYou can add applications to this project with the 'new-app' command. For example, try:\r\n    oc new-app centos\/ruby-25-centos7~https:\/\/github.com\/sclorg\/ruby-ex.git\r\n<\/pre>\n<p><span class=\"fontstyle0\">6.<\/span><span class=\"fontstyle2\"> Log in to the cluster as the <\/span><span class=\"fontstyle3\">admin <\/span><span class=\"fontstyle2\">user.<\/span><\/p>\n<pre class=\"lang:default decode:true\">$ oc login -u admin -p 'Labreview'\r\nLogin successful.\r\n<\/pre>\n<p>Create a group named developers.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups new developers\r\ngroup.user.openshift.io\/developers created\r\n<\/pre>\n<p><span class=\"fontstyle0\">Add the <\/span><span class=\"fontstyle2\">developer <\/span><span class=\"fontstyle0\">user to the <\/span><span class=\"fontstyle2\">developers <\/span><span class=\"fontstyle0\">group<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups add-users developers developer\r\ngroup \"developers\" added: \"developer\"\r\n<\/pre>\n<p><span class=\"fontstyle0\">Grant edit privileges to the <\/span><span class=\"fontstyle2\">developers <\/span><span class=\"fontstyle0\">group on the <\/span><span class=\"fontstyle2\">auth-review <\/span><span class=\"fontstyle0\">project<\/span><\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-group edit developers\r\nrole \"edit\" added: \"developers\"\r\n<\/pre>\n<p>7. Create a group named <code>qa<\/code>.<\/p>\n<pre class=\"lang:default decode:true \">$ oc adm groups new qa\r\ngroup.user.openshift.io\/qa created\r\n<\/pre>\n<p>Add the <code>tester<\/code> user to the <code>qa<\/code> group.<\/p>\n<pre class=\"lang:default decode:true\">$ oc adm groups add-users qa tester\r\ngroup.user.openshift.io\/qa added: \"tester\"<\/pre>\n<p>Grant view privileges to the qa group on the auth-review project.<\/p>\n<pre class=\"lang:default decode:true \">$ oc policy add-role-to-group view qa\r\nclusterrole.rbac.authorization.k8s.io\/view added: \"qa\"<\/pre>\n<p>&nbsp;<\/p>\n<p>Excercise<\/p>\n<pre class=\"lang:default decode:true\">$ oc login -u system:admin\r\nLogged into \"https:\/\/172.30.9.22:8443\" as \"system:admin\" using existing credentials.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n    auto\r\n    debug\r\n  * default\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"default\".\r\n\r\n$ oc get clusterrolebinding\r\nNAME                                                                       AGE\r\nbasic-users                                                                13d\r\ncluster-admin                                                              13d\r\ncluster-admin-0                                                            13d\r\ncluster-admin-1                                                            1d\r\ncluster-admin-2                                                            1d\r\ncluster-admin-3                                                            1d\r\ncluster-admins                                                             13d\r\ncluster-readers                                                            13d\r\ncluster-status-binding                                                     13d\r\nregistry-registry-role                                                     13d\r\nrouter-router-role                                                         13d\r\nself-access-reviewers                                                      13d\r\nself-provisioners                                                          13d\r\nsystem:aws-cloud-provider                                                  13d\r\nsystem:basic-user                                                          13d\r\nsystem:build-strategy-docker-binding                                       13d\r\nsystem:build-strategy-jenkinspipeline-binding                              13d\r\nsystem:build-strategy-source-binding                                       13d\r\nsystem:controller:attachdetach-controller                                  13d\r\nsystem:controller:certificate-controller                                   13d\r\nsystem:controller:clusterrole-aggregation-controller                       13d\r\nsystem:controller:cronjob-controller                                       13d\r\nsystem:controller:daemon-set-controller                                    13d\r\nsystem:controller:deployment-controller                                    13d\r\nsystem:controller:disruption-controller                                    13d\r\nsystem:controller:endpoint-controller                                      13d\r\nsystem:controller:expand-controller                                        13d\r\nsystem:controller:generic-garbage-collector                                13d\r\nsystem:controller:horizontal-pod-autoscaler                                13d\r\nsystem:controller:job-controller                                           13d\r\nsystem:controller:namespace-controller                                     13d\r\nsystem:controller:node-controller                                          13d\r\nsystem:controller:persistent-volume-binder                                 13d\r\nsystem:controller:pod-garbage-collector                                    13d\r\nsystem:controller:pv-protection-controller                                 13d\r\nsystem:controller:pvc-protection-controller                                13d\r\nsystem:controller:replicaset-controller                                    13d\r\nsystem:controller:replication-controller                                   13d\r\nsystem:controller:resourcequota-controller                                 13d\r\nsystem:controller:route-controller                                         13d\r\nsystem:controller:service-account-controller                               13d\r\nsystem:controller:service-controller                                       13d\r\nsystem:controller:statefulset-controller                                   13d\r\nsystem:controller:ttl-controller                                           13d\r\nsystem:deployer                                                            13d\r\nsystem:discovery                                                           13d\r\nsystem:discovery-binding                                                   13d\r\nsystem:image-builder                                                       13d\r\nsystem:image-puller                                                        13d\r\nsystem:kube-controller-manager                                             13d\r\nsystem:kube-dns                                                            13d\r\nsystem:kube-proxy                                                          13d\r\nsystem:kube-scheduler                                                      13d\r\nsystem:masters                                                             13d\r\nsystem:node                                                                13d\r\nsystem:node-admin                                                          13d\r\nsystem:node-admins                                                         13d\r\nsystem:node-bootstrapper                                                   13d\r\nsystem:node-proxier                                                        13d\r\nsystem:node-proxiers                                                       13d\r\nsystem:nodes                                                               13d\r\nsystem:oauth-token-deleters                                                13d\r\nsystem:openshift:controller:apiservice-cabundle-injector                   13d\r\nsystem:openshift:controller:build-config-change-controller                 13d\r\nsystem:openshift:controller:build-controller                               13d\r\nsystem:openshift:controller:cluster-quota-reconciliation-controller        13d\r\nsystem:openshift:controller:default-rolebindings-controller                13d\r\nsystem:openshift:controller:deployer-controller                            13d\r\nsystem:openshift:controller:deploymentconfig-controller                    13d\r\nsystem:openshift:controller:horizontal-pod-autoscaler                      13d\r\nsystem:openshift:controller:image-import-controller                        13d\r\nsystem:openshift:controller:image-trigger-controller                       13d\r\nsystem:openshift:controller:ingress-to-route-controller                    13d\r\nsystem:openshift:controller:namespace-security-allocation-controller       13d\r\nsystem:openshift:controller:origin-namespace-controller                    13d\r\nsystem:openshift:controller:pv-recycler-controller                         13d\r\nsystem:openshift:controller:resourcequota-controller                       13d\r\nsystem:openshift:controller:sdn-controller                                 13d\r\nsystem:openshift:controller:service-ingress-ip-controller                  13d\r\nsystem:openshift:controller:service-serving-cert-controller                13d\r\nsystem:openshift:controller:service-serving-cert-signer                    13d\r\nsystem:openshift:controller:serviceaccount-controller                      13d\r\nsystem:openshift:controller:serviceaccount-pull-secrets-controller         13d\r\nsystem:openshift:controller:template-instance-controller                   13d\r\nsystem:openshift:controller:template-instance-controller:admin             13d\r\nsystem:openshift:controller:template-instance-finalizer-controller         13d\r\nsystem:openshift:controller:template-instance-finalizer-controller:admin   13d\r\nsystem:openshift:controller:template-service-broker                        13d\r\nsystem:openshift:controller:unidling-controller                            13d\r\nsystem:openshift:discovery                                                 13d\r\nsystem:openshift:openshift-controller-manager                              13d\r\nsystem:openshift:operator:service-cert-signer                              13d\r\nsystem:openshift:operator:web-console                                      13d\r\nsystem:scope-impersonation                                                 13d\r\nsystem:sdn-readers                                                         13d\r\nsystem:volume-scheduler                                                    13d\r\nsystem:webhooks                                                            13d\r\n\r\n\r\n$ oc get clusterrolebinding -o wide\r\nNAME                                                                       AGE       ROLE                                                                                                                                         USERS                            GROUPS                                         SERVICEACCOUNTS\r\nbasic-users                                                                13d       ClusterRole\/basic-user                                                                                                                                                        system:authenticated\r\ncluster-admin                                                              13d       ClusterRole\/cluster-admin                                                                                                                                                     system:masters\r\ncluster-admin-0                                                            13d       ClusterRole\/cluster-admin                                                                                                                                                                                                    default\/pvinstaller\r\ncluster-admin-1                                                            1d        ClusterRole\/cluster-admin                                                                                                                    anna\r\ncluster-admin-2                                                            1d        ClusterRole\/cluster-admin                                                                                                                    lisa\r\ncluster-admin-3                                                            1d        ClusterRole\/cluster-admin                                                                                                                    admin\r\ncluster-admins                                                             13d       ClusterRole\/cluster-admin                                                                                                                    system:admin                     system:cluster-admins\r\ncluster-readers                                                            13d       ClusterRole\/cluster-reader                                                                                                                                                    system:cluster-readers\r\ncluster-status-binding                                                     13d       ClusterRole\/cluster-status                                                                                                                                                    system:authenticated, system:unauthenticated\r\nregistry-registry-role                                                     13d       ClusterRole\/system:registry                                                                                                                                                                                                  default\/registry\r\nrouter-router-role                                                         13d       ClusterRole\/system:router                                                                                                                                                                                                    default\/router\r\nself-access-reviewers                                                      13d       ClusterRole\/self-access-reviewer                                                                                                                                              system:authenticated, system:unauthenticated\r\nself-provisioners                                                          13d       ClusterRole\/self-provisioner                                                                                                                                                  system:authenticated:oauth\r\nsystem:aws-cloud-provider                                                  13d       ClusterRole\/system:aws-cloud-provider                                                                                                                                                                                        kube-system\/aws-cloud-provider\r\nsystem:basic-user                                                          13d       ClusterRole\/system:basic-user                                                                                                                                                 system:authenticated, system:unauthenticated\r\nsystem:build-strategy-docker-binding                                       13d       ClusterRole\/system:build-strategy-docker                                                                                                                                      system:authenticated\r\nsystem:build-strategy-jenkinspipeline-binding                              13d       ClusterRole\/system:build-strategy-jenkinspipeline                                                                                                                             system:authenticated\r\nsystem:build-strategy-source-binding                                       13d       ClusterRole\/system:build-strategy-source                                                                                                                                      system:authenticated\r\nsystem:controller:attachdetach-controller                                  13d       ClusterRole\/system:controller:attachdetach-controller                                                                                                                                                                        kube-system\/attachdetach-controller\r\nsystem:controller:certificate-controller                                   13d       ClusterRole\/system:controller:certificate-controller                                                                                                                                                                         kube-system\/certificate-controller\r\nsystem:controller:clusterrole-aggregation-controller                       13d       ClusterRole\/system:controller:clusterrole-aggregation-controll                                                          er                                                                                                   kube-system\/clusterrole-aggregation-controller\r\nsystem:controller:cronjob-controller                                       13d       ClusterRole\/system:controller:cronjob-controller                                                                                                                                                                             kube-system\/cronjob-controller\r\nsystem:controller:daemon-set-controller                                    13d       ClusterRole\/system:controller:daemon-set-controller                                                                                                                                                                          kube-system\/daemon-set-controller\r\nsystem:controller:deployment-controller                                    13d       ClusterRole\/system:controller:deployment-controller                                                                                                                                                                          kube-system\/deployment-controller\r\nsystem:controller:disruption-controller                                    13d       ClusterRole\/system:controller:disruption-controller                                                                                                                                                                          kube-system\/disruption-controller\r\nsystem:controller:endpoint-controller                                      13d       ClusterRole\/system:controller:endpoint-controller                                                                                                                                                                            kube-system\/endpoint-controller\r\nsystem:controller:expand-controller                                        13d       ClusterRole\/system:controller:expand-controller                                                                                                                                                                              kube-system\/expand-controller\r\nsystem:controller:generic-garbage-collector                                13d       ClusterRole\/system:controller:generic-garbage-collector                                                                                                                                                                      kube-system\/generic-garbage-collector\r\nsystem:controller:horizontal-pod-autoscaler                                13d       ClusterRole\/system:controller:horizontal-pod-autoscaler                                                                                                                                                                      kube-system\/horizontal-pod-autoscaler, openshi                                                          ft-infra\/horizontal-pod-autoscaler\r\nsystem:controller:job-controller                                           13d       ClusterRole\/system:controller:job-controller                                                                                                                                                                                 kube-system\/job-controller\r\nsystem:controller:namespace-controller                                     13d       ClusterRole\/system:controller:namespace-controller                                                                                                                                                                           kube-system\/namespace-controller\r\nsystem:controller:node-controller                                          13d       ClusterRole\/system:controller:node-controller                                                                                                                                                                                kube-system\/node-controller\r\nsystem:controller:persistent-volume-binder                                 13d       ClusterRole\/system:controller:persistent-volume-binder                                                                                                                                                                       kube-system\/persistent-volume-binder\r\nsystem:controller:pod-garbage-collector                                    13d       ClusterRole\/system:controller:pod-garbage-collector                                                                                                                                                                          kube-system\/pod-garbage-collector\r\nsystem:controller:pv-protection-controller                                 13d       ClusterRole\/system:controller:pv-protection-controller                                                                                                                                                                       kube-system\/pv-protection-controller\r\nsystem:controller:pvc-protection-controller                                13d       ClusterRole\/system:controller:pvc-protection-controller                                                                                                                                                                      kube-system\/pvc-protection-controller\r\nsystem:controller:replicaset-controller                                    13d       ClusterRole\/system:controller:replicaset-controller                                                                                                                                                                          kube-system\/replicaset-controller\r\nsystem:controller:replication-controller                                   13d       ClusterRole\/system:controller:replication-controller                                                                                                                                                                         kube-system\/replication-controller\r\nsystem:controller:resourcequota-controller                                 13d       ClusterRole\/system:controller:resourcequota-controller                                                                                                                                                                       kube-system\/resourcequota-controller\r\nsystem:controller:route-controller                                         13d       ClusterRole\/system:controller:route-controller                                                                                                                                                                               kube-system\/route-controller\r\nsystem:controller:service-account-controller                               13d       ClusterRole\/system:controller:service-account-controller                                                                                                                                                                     kube-system\/service-account-controller\r\nsystem:controller:service-controller                                       13d       ClusterRole\/system:controller:service-controller                                                                                                                                                                             kube-system\/service-controller\r\nsystem:controller:statefulset-controller                                   13d       ClusterRole\/system:controller:statefulset-controller                                                                                                                                                                         kube-system\/statefulset-controller\r\nsystem:controller:ttl-controller                                           13d       ClusterRole\/system:controller:ttl-controller                                                                                                                                                                                 kube-system\/ttl-controller\r\nsystem:deployer                                                            13d       ClusterRole\/system:deployer                                                                                                                                                                                                  openshift-infra\/default-rolebindings-controlle                                                          r\r\nsystem:discovery                                                           13d       ClusterRole\/system:discovery                                                                                                                                                  system:authenticated, system:unauthenticated\r\nsystem:discovery-binding                                                   13d       ClusterRole\/system:discovery                                                                                            \r\nsystem:image-builder                                                       13d       ClusterRole\/system:image-builder                                                                                                                                                                                             openshift-infra\/default-rolebindings-controlle                                                          r\r\nsystem:image-puller                                                        13d       ClusterRole\/system:image-puller                                                                                                                                                                                              openshift-infra\/default-rolebindings-controlle                                                          r\r\nsystem:kube-controller-manager                                             13d       ClusterRole\/system:kube-controller-manager                                                                                                   system:kube-controller-manager\r\nsystem:kube-dns                                                            13d       ClusterRole\/system:kube-dns                                                                                                                                                                                                  kube-system\/kube-dns\r\nsystem:kube-proxy                                                          13d       ClusterRole\/system:node-proxier                                                                                                                                               system:nodes                                   kube-proxy\/kube-proxy\r\nsystem:kube-scheduler                                                      13d       ClusterRole\/system:kube-scheduler                                                                                                            system:kube-scheduler\r\nsystem:masters                                                             13d       ClusterRole\/system:master                                                                                                                                                     system:masters\r\nsystem:node                                                                13d       ClusterRole\/system:node                                                                                                 \r\nsystem:node-admin                                                          13d       ClusterRole\/system:node-admin                                                                                                                system:master                    system:node-admins\r\nsystem:node-admins                                                         13d       ClusterRole\/system:node-admin                                                                                                                system:master                    system:node-admins\r\nsystem:node-bootstrapper                                                   13d       ClusterRole\/system:node-bootstrapper                                                                                                                                                                                         openshift-infra\/node-bootstrapper\r\nsystem:node-proxier                                                        13d       ClusterRole\/system:node-proxier                                                                                                              system:kube-proxy\r\nsystem:node-proxiers                                                       13d       ClusterRole\/system:node-proxier                                                                                                                                               system:nodes\r\nsystem:nodes                                                               13d       ClusterRole\/system:node                                                                                                 \r\nsystem:oauth-token-deleters                                                13d       ClusterRole\/system:oauth-token-deleter                                                                                                                                        system:authenticated, system:unauthenticated\r\nsystem:openshift:controller:apiservice-cabundle-injector                   13d       ClusterRole\/system:openshift:controller:apiservice-cabundle-in                                                          jector                                                                                               openshift-service-cert-signer\/apiservice-cabun                                                          dle-injector-sa\r\nsystem:openshift:controller:build-config-change-controller                 13d       ClusterRole\/system:openshift:controller:build-config-change-co                                                          ntroller                                                                                             openshift-infra\/build-config-change-controller\r\nsystem:openshift:controller:build-controller                               13d       ClusterRole\/system:openshift:controller:build-controller                                                                                                                                                                     openshift-infra\/build-controller\r\nsystem:openshift:controller:cluster-quota-reconciliation-controller        13d       ClusterRole\/system:openshift:controller:cluster-quota-reconcil                                                          iation-controller                                                                                    openshift-infra\/cluster-quota-reconciliation-c                                                          ontroller\r\nsystem:openshift:controller:default-rolebindings-controller                13d       ClusterRole\/system:openshift:controller:default-rolebindings-c                                                          ontroller                                                                                            openshift-infra\/default-rolebindings-controlle                                                          r\r\nsystem:openshift:controller:deployer-controller                            13d       ClusterRole\/system:openshift:controller:deployer-controller                                                                                                                                                                  openshift-infra\/deployer-controller\r\nsystem:openshift:controller:deploymentconfig-controller                    13d       ClusterRole\/system:openshift:controller:deploymentconfig-contr                                                          oller                                                                                                openshift-infra\/deploymentconfig-controller\r\nsystem:openshift:controller:horizontal-pod-autoscaler                      13d       ClusterRole\/system:openshift:controller:horizontal-pod-autosca                                                          ler                                                                                                  openshift-infra\/horizontal-pod-autoscaler\r\nsystem:openshift:controller:image-import-controller                        13d       ClusterRole\/system:openshift:controller:image-import-controlle                                                          r                                                                                                    openshift-infra\/image-import-controller\r\nsystem:openshift:controller:image-trigger-controller                       13d       ClusterRole\/system:openshift:controller:image-trigger-controll                                                          er                                                                                                   openshift-infra\/image-trigger-controller\r\nsystem:openshift:controller:ingress-to-route-controller                    13d       ClusterRole\/system:openshift:controller:ingress-to-route-contr                                                          oller                                                                                                openshift-infra\/ingress-to-route-controller\r\nsystem:openshift:controller:namespace-security-allocation-controller       13d       ClusterRole\/system:openshift:controller:namespace-security-all                                                          ocation-controller                                                                                   openshift-infra\/namespace-security-allocation-                                                          controller\r\nsystem:openshift:controller:origin-namespace-controller                    13d       ClusterRole\/system:openshift:controller:origin-namespace-contr                                                          oller                                                                                                openshift-infra\/origin-namespace-controller\r\nsystem:openshift:controller:pv-recycler-controller                         13d       ClusterRole\/system:openshift:controller:pv-recycler-controller                                                                                                                                                               openshift-infra\/pv-recycler-controller\r\nsystem:openshift:controller:resourcequota-controller                       13d       ClusterRole\/system:openshift:controller:resourcequota-controll                                                          er                                                                                                   openshift-infra\/resourcequota-controller\r\nsystem:openshift:controller:sdn-controller                                 13d       ClusterRole\/system:openshift:controller:sdn-controller                                                                                                                                                                       openshift-infra\/sdn-controller\r\nsystem:openshift:controller:service-ingress-ip-controller                  13d       ClusterRole\/system:openshift:controller:service-ingress-ip-con                                                          troller                                                                                              openshift-infra\/service-ingress-ip-controller\r\nsystem:openshift:controller:service-serving-cert-controller                13d       ClusterRole\/system:openshift:controller:service-serving-cert-c                                                          ontroller                                                                                            openshift-infra\/service-serving-cert-controlle                                                          r\r\nsystem:openshift:controller:service-serving-cert-signer                    13d       ClusterRole\/system:openshift:controller:service-serving-cert-s                                                          igner                                                                                                openshift-service-cert-signer\/service-serving-                                                          cert-signer-sa\r\nsystem:openshift:controller:serviceaccount-controller                      13d       ClusterRole\/system:openshift:controller:serviceaccount-control                                                          ler                                                                                                  openshift-infra\/serviceaccount-controller\r\nsystem:openshift:controller:serviceaccount-pull-secrets-controller         13d       ClusterRole\/system:openshift:controller:serviceaccount-pull-se                                                          crets-controller                                                                                     openshift-infra\/serviceaccount-pull-secrets-co                                                          ntroller\r\nsystem:openshift:controller:template-instance-controller                   13d       ClusterRole\/system:openshift:controller:template-instance-cont                                                          roller                                                                                               openshift-infra\/template-instance-controller\r\nsystem:openshift:controller:template-instance-controller:admin             13d       ClusterRole\/admin                                                                                                                                                                                                            openshift-infra\/template-instance-controller\r\nsystem:openshift:controller:template-instance-finalizer-controller         13d       ClusterRole\/system:openshift:controller:template-instance-fina                                                          lizer-controller                                                                                     openshift-infra\/template-instance-finalizer-co                                                          ntroller\r\nsystem:openshift:controller:template-instance-finalizer-controller:admin   13d       ClusterRole\/admin                                                                                                                                                                                                            openshift-infra\/template-instance-finalizer-co                                                          ntroller\r\nsystem:openshift:controller:template-service-broker                        13d       ClusterRole\/system:openshift:controller:template-service-broke                                                          r                                                                                                    openshift-infra\/template-service-broker\r\nsystem:openshift:controller:unidling-controller                            13d       ClusterRole\/system:openshift:controller:unidling-controller                                                                                                                                                                  openshift-infra\/unidling-controller\r\nsystem:openshift:discovery                                                 13d       ClusterRole\/system:openshift:discovery                                                                                                                                        system:authenticated, system:unauthenticated\r\nsystem:openshift:openshift-controller-manager                              13d       ClusterRole\/system:openshift:openshift-controller-manager                                                                                                                                                                    openshift-controller-manager\/openshift-control                                                          ler-manager\r\nsystem:openshift:operator:service-cert-signer                              13d       ClusterRole\/cluster-admin                                                                                                                                                                                                    openshift-core-operators\/openshift-service-cer                                                          t-signer-operator\r\nsystem:openshift:operator:web-console                                      13d       ClusterRole\/cluster-admin                                                                                                                                                                                                    openshift-core-operators\/openshift-web-console                                                          -operator\r\nsystem:scope-impersonation                                                 13d       ClusterRole\/system:scope-impersonation                                                                                                                                        system:authenticated, system:unauthenticated\r\nsystem:sdn-readers                                                         13d       ClusterRole\/system:sdn-reader                                                                                                                                                 system:nodes\r\nsystem:volume-scheduler                                                    13d       ClusterRole\/system:volume-scheduler                                                                                                          system:kube-scheduler\r\nsystem:webhooks                                                            13d       ClusterRole\/system:webhook                                                                                                                                                    system:authenticated, system:unauthenticated\r\n\r\n\r\n$ oc get clusterrolebinding -o wide | grep 'self-provisioner'\r\nself-provisioners                                                          13d       ClusterRole\/self-provisioner                                                                                                                                                  system:authenticated:oauth\r\n\r\n\r\n$ oc describe clusterrolebindings self-provisioners\r\nName:         self-provisioners\r\nLabels:       &lt;none&gt;\r\nAnnotations:  rbac.authorization.kubernetes.io\/autoupdate=true\r\nRole:\r\n  Kind:  ClusterRole\r\n  Name:  self-provisioner\r\nSubjects:\r\n  Kind   Name                        Namespace\r\n  ----   ----                        ---------\r\n  Group  system:authenticated:oauth\r\n\r\n$ oc adm policy remmove-cluster-role-from-group self-provisioner system:authenticated:oauth\r\nerror: unknown command \"remmove-cluster-role-from-group self-provisioner system:authenticated:oauth\"\r\nSee 'oc adm policy -h' for help and examples.\r\n\r\n$ oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth\r\nWarning: Your changes may get lost whenever a master is restarted, unless you prevent reconciliation of this rolebinding using the following comman                                                          d: oc annotate clusterrolebinding.rbac self-provisioners 'rbac.authorization.kubernetes.io\/autoupdate=false' --overwritecluster role \"self-provisio                                                          ner\" removed: \"system:authenticated:oauth\"\r\n\r\n\r\n$ oc describe clusterrolebindings self-provisioners\r\nError from server (NotFound): clusterrolebindings.rbac.authorization.k8s.io \"self-provisioners\" not found\r\n\r\n$ oc login -u linda -p password\r\nLogin successful.\r\n\r\nYou don't have any projects. Contact your system administrator to request a project.\r\n\r\n$ oc login -u admin -p password\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n    auto\r\n    debug\r\n  * default\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"default\".\r\n[root@okd ~]#\r\n[root@okd ~]# oc new-project authorization-rbac\r\nNow using project \"authorization-rbac\" on server \"https:\/\/172.30.9.22:8443\".\r\n\r\nYou can add applications to this project with the 'new-app' command. For example, try:\r\n\r\n    oc new-app centos\/ruby-25-centos7~https:\/\/github.com\/sclorg\/ruby-ex.git\r\n\r\nto build a new example application in Ruby.\r\n\r\n\r\n$ oc policy add-role-to-user admin linda\r\nrole \"admin\" added: \"linda\"\r\n\r\n$ oc adm groups new dev-group\r\ngroup.user.openshift.io\/dev-group created\r\n\r\n$ oc adm groups add-users dev-group anouk\r\ngroup \"dev-group\" added: \"anouk\"\r\n\r\n$ oc adm groups new qa-group\r\ngroup.user.openshift.io\/qa-group created\r\n\r\n$ oc adm groups add-users qa-group lisa\r\ngroup \"qa-group\" added: \"lisa\"\r\n\r\n$ oc get groups\r\nNAME         USERS\r\ndev-group    anouk\r\ndevelopers   anna\r\nqa-group     lisa\r\n[root@okd ~]#\r\n[root@okd ~]# oc login -u anna -p passwords\r\nLogin successful.\r\n\r\nYou have access to the following projects and can switch between them with 'oc project &lt;projectname&gt;':\r\n\r\n  * authorization-rbac\r\n    openshift\r\n    openshift-apiserver\r\n    openshift-controller-manager\r\n    openshift-core-operators\r\n    openshift-infra\r\n    openshift-node\r\n    openshift-service-cert-signer\r\n    openshift-web-console\r\n    quota-test\r\n    source-project\r\n    target-project\r\n    template-project\r\n    test-project\r\n\r\nUsing project \"authorization-rbac\".\r\n\r\n$ oc policy add-role-to-group edit dev-group\r\nrole \"edit\" added: \"dev-group\"\r\n\r\n$ oc policy add-role-to-group view qa-group\r\nrole \"view\" added: \"qa-group\"\r\n\r\n$ oc get rolebindings -o wide\r\nNAME                    AGE       ROLE                               USERS     GROUPS                                      SERVICEACCOUNTS\r\nadmin                   3m        ClusterRole\/admin                  admin\r\nadmin-0                 3m        ClusterRole\/admin                  linda\r\nedit                    51s       ClusterRole\/edit                             dev-group\r\nsystem:deployers        3m        ClusterRole\/system:deployer                                                              authorization-rbac\/deplo                                                          yer\r\nsystem:image-builders   3m        ClusterRole\/system:image-builder                                                         authorization-rbac\/build                                                          er\r\nsystem:image-pullers    3m        ClusterRole\/system:image-puller              system:serviceaccounts:authorization-rbac\r\nview                    26s       ClusterRole\/view                             qa-group\r\n\r\n$ oc adm policy add-cluster-role-to-group --rolebinding-name self-provisioners self-provisioners system:authenticated:oauth\r\nWarning: role 'self-provisioners' not found\r\nWarning: Group 'system:authenticated:oauth' not found\r\ncluster role \"self-provisioners\" added: \"system:authenticated:oauth\"\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Creating Roles<\/span><\/p>\n<ul>\n<li>New roles can be created by assigning verbs and resources to the newly created role<\/li>\n<li><code>oc create role podview --verb-get --resource-pod -n userstuff <\/code><\/li>\n<li><code>oc adm policy add-role-to-user podview ahmed --role-namespace=userstuff -n userstuff \u2022 oc create clusterrole podviewonly --verb-get --resource=pod <\/code><\/li>\n<li><code>oc adm policy add-cluster-role-to-user podviewonly lori<\/code><\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">$ oc new-project userstaff\r\nNow using project \"userstaff\" on server \"https:\/\/172.30.9.22:8443\".\r\n\r\nYou can add applications to this project with the 'new-app' command. For example, try:\r\n\r\n    oc new-app centos\/ruby-25-centos7~https:\/\/github.com\/sclorg\/ruby-ex.git\r\n\r\nto build a new example application in Ruby.\r\n\r\n$ oc create role podview --verb=get --resource=pod -n userstaff\r\nrole.rbac.authorization.k8s.io\/podview created\r\n\r\n$ oc adm policy add-role-to-user podview ahmed --role-namespace=userstaff -n userstaff\r\nWarning: User 'ahmed' not found\r\nrole \"podview\" added: \"ahmed\"\r\n\r\n$ oc create clusterrole podviewonly --verb=get --resource=pod\r\nclusterrole.rbac.authorization.k8s.io\/podviewonly created\r\n\r\n$ oc adm policy add-cluster-role-to-user podviewonly lori\r\ncluster role \"podviewonly\" added: \"lori\"\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There are several OpenShift resources related to authentication and authorization. The following is a list of the primary resource types and their definitions:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"quote","meta":{"footnotes":""},"categories":[93],"tags":[],"_links":{"self":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4805"}],"collection":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/comments?post=4805"}],"version-history":[{"count":83,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4805\/revisions"}],"predecessor-version":[{"id":5093,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4805\/revisions\/5093"}],"wp:attachment":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media?parent=4805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/categories?post=4805"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/tags?post=4805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}