Table of Contents

Creating Local Users in OKD/Openshift 4.21 Using HTPasswd

A fresh OKD installation only provides the ``kubeadmin`` user. To allow local users to log in and deploy pods, configure an HTPasswd identity provider.

Step 1: Create the htpasswd file

docker run --rm \
  -v $(pwd):/work \
  docker.io/httpd:2 \
  htpasswd -cbB /work/users.htpasswd user1 MyPassword123
 
docker run --rm \
  -v $(pwd):/work \
  docker.io/httpd:2 \
  htpasswd -bB /work/users.htpasswd user2 MyPassword123
 
docker run --rm \
  -v $(pwd):/work \
  docker.io/httpd:2 \
  htpasswd -bB /work/users.htpasswd user3 MyPassword123

Step 2: Create the secret in the openshift-config namespace

oc create secret generic htpasswd-secret \
  --from-file=htpasswd=users.htpasswd \
  -n openshift-config

Step 3: Configure OAuth to use HTPasswd

Edit the OAuth configuration: 

oc edit oauth cluster

Add: 

spec:
  identityProviders:
  - name: local-users
    mappingMethod: claim
    type: HTPasswd
    htpasswd:
      fileData:
        name: htpasswd-secret

Wait for the OAuth operator to restart.

Step 4: Test login

Log out of the Web Console and log in with:

Step 5: Grant permissions to the new user

Allow user to create their own Projects: 

oc adm policy add-cluster-role-to-user self-provisioner myuser

Or give admin access to a specific namespace: 

oc adm policy add-role-to-user admin myuser -n mynamespace

The user can now create and run pods.

Grant access to others to existing project: 

oc adm policy add-role-to-user admin user1 -n project1
oc adm policy add-role-to-user admin user2 -n project1
oc adm policy add-role-to-user admin user3 -n project1