Managing user & group policy in openshift with oc utility
[root@master ~]# oc adm
Administrative CommandsCommands for managing a cluster are exposed here. Many administrative actions involve interaction with the command-line
client as well.Usage:
oc adm [flags]Component Installation:
router Install a router
ipfailover Install an IP failover group to a set of nodes
registry Install the integrated Docker registrySecurity and Policy:
new-project Create a new project
policy Manage policy
groups Manage groups
ca Manage certificates and keys
certificate Modify certificate resources.Node Management:
create-node-config Create a configuration bundle for a node
manage-node Manage nodes – list pods, evacuate, or mark ready
cordon Mark node as unschedulable
uncordon Mark node as schedulable
drain Drain node in preparation for maintenance
taint Update the taints on one or more nodes
pod-network Manage pod networkMaintenance:
diagnostics Diagnose common cluster problems
prune Remove older versions of resources from the server
build-chain Output the inputs and dependencies of your builds
migrate Migrate data in the cluster
top Show usage statistics of resources on the server
verify-image-signature Verify the image identity contained in the image signatureConfiguration:
create-kubeconfig Create a basic .kubeconfig file from client certs
create-api-client-config Create a config file for connecting to the server as a user
create-bootstrap-project-template Create a bootstrap project template
create-bootstrap-policy-file Create the default bootstrap policy
create-login-template Create a login template
create-provider-selection-template Create a provider selection template
create-error-template Create an error page templateOther Commands:
completion Output shell completion code for the specified shell (bash or zsh)
config Change configuration files for the clientUse “oc adm –help” for more information about a given command.
Use “oc adm options” for a list of global command-line options (applies to all commands).
[root@master ~]# oc adm policy
add-cluster-role-to-group add-role-to-user reconcile-sccs remove-group remove-scc-from-group scc-review
add-cluster-role-to-user add-scc-to-group remove-cluster-role-from-group remove-role-from-group remove-scc-from-user scc-subject-review
add-role-to-group add-scc-to-user remove-cluster-role-from-user remove-role-from-user remove-user who-can
[root@master ~]# oc adm policy
Manage policy on the cluster
These commands allow you to assign and manage the roles and policies that apply to users. The reconcile commands allow
you to reset and upgrade your system policies to the latest default policies.
To see more information on roles and policies, use the ‘get’ and ‘describe’ commands on the following resources:
‘clusterroles’, ‘clusterpolicy’, ‘clusterrolebindings’, ‘roles’, ‘policy’, ‘rolebindings’, and ‘scc’.
Usage:
oc adm policy [flags]
Discover:
who-can List who can perform the specified action on a resource
scc-subject-review Check whether a user or a ServiceAccount can create a Pod.
scc-review Checks which ServiceAccount can create a Pod
Manage project membership:
remove-user Remove user from the current project
remove-group Remove group from the current project
Assign roles to users and groups:
add-role-to-user Add a role to users or serviceaccounts for the current project
add-role-to-group Add a role to groups for the current project
remove-role-from-user Remove a role from users for the current project
remove-role-from-group Remove a role from groups for the current project
Assign cluster roles to users and groups:
add-cluster-role-to-user Add a role to users for all projects in the cluster
add-cluster-role-to-group Add a role to groups for all projects in the cluster
remove-cluster-role-from-user Remove a role from users for all projects in the cluster
remove-cluster-role-from-group Remove a role from groups for all projects in the cluster
Manage policy on pods and containers:
add-scc-to-user Add security context constraint to users or a service account
add-scc-to-group Add security context constraint to groups
remove-scc-from-user Remove user from scc
remove-scc-from-group Remove group from scc
Upgrade and repair system policy:
reconcile-cluster-roles Update cluster roles to match the recommended bootstrap policy
reconcile-cluster-role-bindings Update cluster role bindings to match the recommended bootstrap policy
reconcile-sccs Replace cluster SCCs to match the recommended bootstrap policy
Use “oc adm policy –help” for more information about a given command.
Use “oc adm options” for a list of global command-line options (applies to all commands).
[root@master ~]# oc adm policy add-cluster-role-to-user cluster-admin admin
cluster role “cluster-admin” added: “admin”
[root@master ~]# oc get users
NAME UID FULL NAME IDENTITIES
admin cfca0a0c-ff98-11e8-a972-42010a8e0002 allow_all:admin
[root@master ~]# oc get identity
NAME IDP NAME IDP USER NAME USER NAME USER UID
allow_all:admin allow_all admin admin cfca0a0c-ff98-11e8-a972-42010a8e0002
[root@master ~]# oc describe user admin
Name: admin
Created: 2 days ago
Labels:
Annotations:
Identities: allow_all:admin
[root@master ~]# oc adm groups new group1
group.user.openshift.io/group1 created
[root@master ~]# oc get groups
NAME USERS
group1
[root@master ~]# oc create user user1
user.user.openshift.io/user1 created
[root@master ~]# oc get users
NAME UID FULL NAME IDENTITIES
admin cfca0a0c-ff98-11e8-a972-42010a8e0002 allow_all:admin
user1 c44efe30-0134-11e9-a972-42010a8e0002
[root@master ~]# oc adm groups
Manage groups in your cluster
Groups are sets of users that can be used when describing policy.
Usage:
oc adm groups [flags]
Available Commands:
add-users Add users to a group
new Create a new group
prune Remove old OpenShift groups referencing missing records on an external provider
remove-users Remove users from a group
sync Sync OpenShift groups with records from an external provider.
Use “oc adm –help” for more information about a given command.
Use “oc adm options” for a list of global command-line options (applies to all commands).[root@master ~]# oc adm groups add-users -h Add users to a group. This command will append unique users to the list of members for a group. Usage: oc adm groups add-users GROUP USER [USER ...] [flags] Examples: # Add user1 and user2 to my-group oc adm groups add-users my-group user1 user2 Use "oc adm options" for a list of global command-line options (applies to all commands). [root@master ~]# oc adm groups add-users group1 user1 group "group1" added: "user1" [root@master ~]# oc get groups NAME USERS group1 user1
[root@master ~]# oc get rolebindings
NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
prometheus-k8s default/prometheus-k8s openshift-monitoring/prometheus-k8s
system:deployers /system:deployer deployer
system:image-builders /system:image-builder builder
system:image-pullers /system:image-puller system:serviceaccounts:default
[root@master ~]# oc get clusterrolebindings
NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
admin /admin kube-service-catalog/default
admin-0 /admin openshift-ansible-service-broker/asb
alertmanager-main /alertmanager-main openshift-monitoring/alertmanager-main
asb-access /asb-access openshift-ansible-service-broker/asb-client
asb-auth /asb-auth openshift-ansible-service-broker/asb
auth-delegator-openshift-template-service-broker /system:auth-delegator openshift-template-service-broker/apiserver
basic-users /basic-user system:authenticated
cluster-admin /cluster-admin system:masters
cluster-admin-0 /cluster-admin admin
cluster-admins /cluster-admin system:admin system:cluster-admins
cluster-monitoring-operator /cluster-monitoring-operator openshift-monitoring/cluster-monitoring-operator
cluster-reader /cluster-reader management-infra/management-admin
cluster-reader-0 /cluster-reader default/router
cluster-readers /cluster-reader system:cluster-readers
cluster-status-binding
[root@master ~]# oc describe clusterrolebinding self-provisioner
Name: self-provisioner
Created: 2 days ago
Labels: <none>
Annotations: <none>
Role: /self-provisioner
Users: <none>
Groups: <none>
ServiceAccounts: management-infra/management-admin
Subjects: <none>
Verbs Non-Resource URLs Resource Names API Groups Resources
[create] [] [] [ project.openshift.io] [projectrequests]
Refer for below url more info https://docs.openshift.com/containerplatform/3.11/admin_guide/manage_users.html
[root@master ~]# oc new-project project1
Now using project "project1" on server "https://master.openshift.com:8443".
You can add applications to this project with the 'new-app' command. For example, try:
oc new-app centos/ruby-25-centos7~https://github.com/sclorg/ruby-ex.git
to build a new example application in Ruby.
[root@master ~]# oc adm policy add-role-to-user view user1 -n project1
role "view" added: "user1"
[root@master ~]# oc get rolebindings |grep user1
view /view user1
[root@master ~]# oc adm policy remove-role-from-user view user1
role "view" removed: "user1"
linuxmadeeasy 