OpenShift Security Operations

Internal

• OpenShift Operations

List All Cluster Role Bindings

 oc get clusterrolebindings

List Role Bindings for a Specific Role

 oc get clusterrolebindings/cluster-admins

List All Project Role Bindings

oc get rolebindings [-n <target-project-name>]

Alternative:

oc describe policyBindings

Can I?

oc policy can-i

Who Can?

oc policy who-can

Make a User a Cluster Administrator

This command can be used to make regular users cluster administrators:

oadm policy add-cluster-role-to-user cluster-admin ovidiu

Assign a Cluster Role to an User

oadm policy add-cluster-role-to-user cluster-reader nodev

Enable system:admin Remote Access

Procedure to enable system:admin remote access

OAuth Client Operations

List all OAuth clients:

oc get oauthclients

List one:

oc get oauthclient kibana-proxy

oc edit oauthclient kibana-proxy

'Secret' Operations

List Secrets

List all secrets:

oc get secrets

Create a Secret

echo "..." > ./some-data.txt
oc secret new some-secret key_1=some-data.txt

.gitconfig File-Based

oc secret new <secret-name> .gitconfig=path/to/.gitconfig

Basic Authentication

oc secrets new-basicauth <secret-name> --username=<user-name> --password=<password>

SSK Key

oc secrets new-sshauth <secret-name> --ssh-privatekey=$HOME/.ssh/id_rsa

Secrets can be combined.

Link the Secret to a Service Account

oc secrets link <service-account-name> <secret-name>

More service account operations, below Service Account Operations.

Extract Data from a Secret

Extract data from a given secret:

cd ~/tmp
oc extract secret/logging-kibana-proxy [--keys=oauth-secret] --confirm

Expose as Environment Variable

oc env <target-object> --from=secret/<secret-name> --prefix=DB_

Expose as a Mounted Volume

oc set volume <target-object> --add --overwrite --name=<some-name> --mount-path /some-path --secret-name=<secret-name>

Service Account Operations

Service Accounts

Query Service Accounts for a Project

oc get sa

oc get serviceaccount [service-account-name]

List the Secrets associated with a Service Account

oc get sa -o yaml <service-account-name>

apiVersion: v1
kind: ServiceAccount
...
imagePullSecrets:
- name: builder-dockercfg-pgcfb
secrets:
- name: builder-token-04jmh
- name: builder-dockercfg-pgcfb

Link the Secret to a Service Account

Link the Secret to a Service Account

Create a New Service Account

Service accounts can be created as follows:

echo '{"kind":"ServiceAccount","apiVersion":"v1","metadata":{"name":"registry"}}'  | oc create -n default -f -

Security Context Constraints Operations

See

Security Context Constraints

Get All SCCs

Return all cluster-wide available SCCs. The cluster administrators can execute the command:

oc get scc

Get a SCC

oc get -o yaml scc/<scc-name>

Create a New SCC

https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html#creating-new-security-context-constraints

Update an SCC

https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html#updating-security-context-constraints

https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html#updating-the-default-security-context-constraints

Delete an SCC

https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html#deleting-security-context-constraints