Set up offline token authentication

Use Red Hat Single Sign-On (SSO) with a service account to authenticate automation to OpenShift Cluster Manager.

Before you begin
Copy link

About this task
Copy link

Use this method when automation needs to access OpenShift Cluster Manager without a user. This doesn’t apply to logging in to the OpenShift Cluster Manager console or to the CLI. Common examples of automation that need access to OpenShift Cluster Manager include Terraform configurations, CI/CD pipelines, scripts that call OpenShift Cluster Manager APIs, and scheduled jobs that interact with OpenShift Cluster Manager.

Procedure
Copy link

  1. Set environment variables for the service account credentials in the environment where the automation runs, such as a local shell, build pipeline, or execution environment: 
    export RHCS_CLIENT_ID="<your_client_id>"
export RHCS_CLIENT_SECRET="<your_client_secret>"
  2. (Optional) To authenticate to OpenShift Cluster Manager in Terraform using environment variables, export the variables before running your configuration. Terraform can detect them automatically: 
    export RHCS_CLIENT_ID="<your_client_id>"
export RHCS_CLIENT_SECRET="<your_client_secret>"
  3. (Optional) To configure the OpenShift Cluster Manager provider directly in Terraform, reference the service account credentials in the provider block: 
    provider "ocm" {
  client_id     = var.rhcs_client_id
  client_secret = var.rhcs_client_secret
}

Results
Copy link

  • Run a script or automation workflow that authenticates to OpenShift Cluster Manager.
  • Confirm that the automation runs successfully without user interaction.

Offline tokens and automation
Copy link

The new secure method of authenticating using Red Hat Single Sign-On will not break any existing automations that rely on offline tokens.

To use offline tokens for automation or other purposes, you can download the OpenShift Cluster Manager API Token page, linked in Additional resources. You can also use service accounts, linked in Additional resources, for automation purposes.

Revoke OpenShift Cluster Manager API tokens
Copy link

You can revoke offline tokens if you no longer need them or if you've reached the token limit.

Procedure
Copy link

  1. Go to the Applications page of your Red Hat account.
  2. Find the cloud-services client ID and, if necessary, expand its row.
  3. Select Remove access.
    Note

    All refresh tokens stop working immediately after you remove access. Existing access tokens that the ocm and rosa commands cache might take up to 15 minutes to expire.
  4. To generate a new token, refresh the page.