OpenShift ROSA: Get the OIDC URL within the cluster

AWS Kubernetes OpenShift ROSA OIDC Identity provider

1 min read | by Jordi Prats

When running a ROSA cluster (OpenShift on AWS) we might need to get it's Identity provider (OIDC) for, for example, configure STS (IRSA). We can get it directly from the cluster reading the Authentication object

To do so we just need to use kubectl get on the Authentication object named **cluster as follows:

$ kubectl get authentication -o yaml apiVersion: config.openshift.io/v1 kind: Authentication metadata:  name: cluster  (...) spec:  oauthMetadata:  name: ""  serviceAccountIssuer: https://rh-oidc.s3.us-east-1.amazonaws.com/cdefb6lj4p4k1a01i561h9rb221cv53  type: ""  webhookTokenAuthenticator:  kubeConfig:  name: webhook-authentication-integrated-oauth status:  integratedOAuthMetadata:  name: oauth-openshift

We can always use a jsonpath to directly retrieve the URL:

$ kubectl get authentication cluster -o jsonpath='{ .spec.serviceAccountIssuer }' https://rh-oidc.s3.us-east-1.amazonaws.com/cdefb6lj4p4k1a01i561h9rb221cv53

Posted on 20/10/2022

Categories