Getting Started

Once the initial baremetal OpenShift 4.6 IPI install is complete, you will see output similar to what is shown below.

This output contains the URL for the OpenShift WebUI along with the “kubeadmin” password. You will be able to log into the WebUI using these credentials.

If you forget your kubeadmin login (which you will,. because it’s ugly) you will be able to find in the auth directory.

{ocptest}[kni@bastion ~]$ cat clusterconfigs/auth/kubeadmin-password 
WMAWX-QkGc3-IQKy2-XJDI6

Upon initial login to the WebUI you will see a blue bar at the near the top of the page – as shown below.

Adding a New User with Admin Rights

Bottom line, the Openshift “kubeadmin” password is not user friendly. In my lab I do not want to have to look it up each time I attempt to access the webui. I need simple and easy to remember credentials.

So I am going to create a new admin user. In the example below I am creating a user named ‘admin‘ with the password of ‘admin‘.

I am working in a homelab, so security is not exactly a priority.

{ocp}[kni@bastion ~]$ htpasswd -c -B -b users.htpasswd admin admin
Adding password for user admin

Now I define a secret which uses the HTPasswd user file as shown below.

{ocp}[kni@bastion ~]$ oc create secret generic htpass-secret --from-file=htpasswd=/home/kni/users.htpasswd -n openshift-config
secret/htpass-secret created

Next, I create a custom resource (htpasswd.cr) that defines the use of the HTPasswd identity provider. This file is straight out of the user doc and is unmodified.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: my_htpasswd_provider 
    mappingMethod: claim 
    type: HTPasswd
    htpasswd:
      fileData:
        name: htpass-secret 

Now we apply the Custom Resource (CR) via oc apply.

{ocp}[kni@bastion ~]$ oc apply -f /home/kni/htpasswd.cr
oauth.config.openshift.io/cluster configured

Now let’s test your new id and password on the CLI. If the step below fails, you will need to start all over again.

{ocp}[kni@bastion ~]$ oc login -u admin
Authentication required for https://api.ocp.lab.localdomain:6443 (openshift)
Username: admin
Password: 
Login successful.

You have access to 59 projects, the list has been suppressed. You can list all projects with ' projects'

Using project "default".

Confirm URL for WebUI.

{ocp}[kni@bastion ~]$ oc whoami --show-console
https://console-openshift-console.apps.ocp.lab.localdomain

Navigate to the URL above and select my_htpasswd_provider. Enter your new credentials. At this point you should be able to login without issue. If not, please work through the process again.

Troubleshooting

If you do run into errors, the files that you created and run the command below to delete the secret.

oc delete secret htpass-secret -n openshift-config

At this point you should be able to repeat the procedure and check for errors.

Reference

https://docs.openshift.com/container-platform/4.5/authentication/identity_providers/configuring-htpasswd-identity-provider.html#identity-provider-creating-htpasswd-file-linux_configuring-htpasswd-identity-provider