OpenShift - oc login command

If you are not familiar with the oc command, refer to OpenShift - Getting Started with the oc command.

The oc login command is used to authenticate against the API service in the master node. The oc config view or oc get apiserver commands can be used to display the API Server URL (api.openshift.example.com in this example), but you need to be logged in to use these commands.

oc login api.openshift.example.com:6443

 

AVOID TROUBLE

Before version 4.7 of OpenShift, the oc login command could be used without the -u or --username option. Starting with version 4.7, if the -u or --username option is not include, "you must obtain an API token" will be returned. Refer to How to resolve "you must obtain an API token" on OpenShift.

 

If you provide a bogus host to connect to, something like this will be displayed.

~]# oc login bogus.example.com
error: dial tcp: lookup bogus.example.com on 10.14.155.57:53: no such host - verify you have provided the correct host and port and that the server is currently running.

 

On the other hand, after providing a valid hostname, you should be prompted to provide your username . . .

Authentication required for https://api.openshift.example.com:6443 (openshift)
Username:

 

. . . and password.

Password:

 

Or, your username and password can be included.

oc login api.openshift.example.com:6443 -u=<username> -p=<password>

 

Or, a token can be used, so that you don't need to authenticate with a username and password. Obviously, replace "abc123" with the actual token.

oc login api.openshift.example.com:6443 --token=abc123

 

If the authentication attempt fails, something like this should be displayed.

Login failed (401 Unauthorized)
Verify you have provided correct credentials.

 

If you are authenticated, something like this should be displayed.

Login successful.

You have access to 193 projects, the list has been suppressed. You can list all projects with 'oc projects'

Using project "default".
Welcome! See 'oc help' to get started.

 

If the /home/your_username/.kube/confilg does not exist, it will be created after the first successful log in. Here is an example of the ~/.kube/config file.

apiVersion: v1
clusters:
- cluster:
    server: https://api.openshift.example.com:6443
  name: os.example.com:6443
contexts:
- context:
    cluster: api.openshift.example.com:6443
    namespace: default
    user: john.doe
  name: default/api.openshift.example.com:6443/john.doe
current-context: default/api.openshift.example.com:6443/john.doe
kind: Config
preferences: {}
users:
- name: john.doe
  user:
    token: Mn8cvscRkYgEUo_DcoUHUk3Z7Cu8W2RQikRBwmglet8

 

The --kubeconfig option can be used to specify the ~/.kube/config file to use, like this.

oc login api.openshift.example.com:6443 --kubeconfig /home/john.doe/.kube/config

 

When debugging some issue, you may want to use the --loglevel option.

oc login api.openshift.example.com:6443 --loglevel=6

 

In this scenario, log level 6 is probably a good starting place, and should return output like this.

I0128 07:06:43.146516   27366 loader.go:375] Config loaded from file:  /home/john.doe/.kube/config
I0128 07:06:43.238439   27366 round_trippers.go:443] HEAD https://api.op.example.com:6443/ 403 Forbidden in 90 milliseconds
I0128 07:06:43.238471   27366 request_token.go:86] GSSAPI Enabled
I0128 07:06:43.240481   27366 round_trippers.go:443] GET https://api.op.example.com:6443/.well-known/oauth-authorization-server 200 OK in 1 milliseconds
I0128 07:06:43.258731   27366 request_token.go:447] using system roots as no error was encountered
I0128 07:06:43.288514   27366 round_trippers.go:443] GET https://oauth-openshift.apps.openshift.example.com/oauth/authorize?client_id=openshift-challenging-client&code_challenge=abc123&code_challenge_method=S256&redirect_uri=https%3A%2F%2Foauth-openshift.apps.op.example.com%2Foauth%2Ftoken%2Fimplicit&response_type=code 401 Unauthorized in 29 milliseconds
Authentication required for https://api.openshift.example.com:6443 (openshift)
Username: john.doe
Password: 
I0128 07:06:49.834683   27366 round_trippers.go:443] GET https://oauth-openshift.apps.op.example.com/oauth/authorize?client_id=openshift-challenging-client&code_challenge=abc123&code_challenge_method=S256&redirect_uri=https%3A%2F%2Foauth-openshift.apps.op.example.com%2Foauth%2Ftoken%2Fimplicit&response_type=code 302 Found in 79 milliseconds
I0128 07:06:49.891957   27366 round_trippers.go:443] POST https://oauth-openshift.apps.op.example.com/oauth/token 200 OK in 57 milliseconds
I0128 07:06:49.921048   27366 round_trippers.go:443] GET https://api.op.example.com:6443/apis/user.openshift.io/v1/users/~ 200 OK in 28 milliseconds
Login successful.

 



Add a Comment




We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.





Please enter ab2c3 in the box below so that we can be sure you are a human.




Comments

Web design by yours truely - me, myself, and I   |   jeremy.canfield@freekb.net   |