OpenShift Security Operations

Internal

• OpenShift Operations

List All Cluster Role Bindings

 oc get clusterrolebindings

List Role Bindings for a Specific Role

 oc get clusterrolebindings/cluster-admins

List All Project Role Bindings

oc project dev
oc get rolebindings

or

oc -n dev get rolebindings

Can I?

oc policy can-i

Who Can?

oc policy who-can

Make a User a Cluster Administrator

This command can be used to make regular users cluster administrators:

oadm policy add-cluster-role-to-user cluster-admin ovidiu

Enable system:admin Remote Access

Procedure to enable system:admin remote access

OAuth Client Operations

List all OAuth clients:

oc get oauthclients

List one:

oc get oauthclient kibana-proxy

oc edit oauthclient kibana-proxy

'Secret' Operations

List all secrets:

oc get secrets

Extract data from a given secret:

cd ~/tmp
oc extract secret/logging-kibana-proxy [--keys=oauth-secret] --confirm

Service Account Operations

Query Service Accounts for a Project

oc get sa

Create a New Service Account

Service accounts can be created as follows:

echo '{"kind":"ServiceAccount","apiVersion":"v1","metadata":{"name":"registry"}}'  | oc create -n default -f -