Red Hat OpenShift Container Platform

Sample Keystone custom resource

You can configure a Keystone identity provider for your cluster by applying an OAuth custom resource (CR) with a Keystone identity provider. Review domain name, server URL, certificate authority, and TLS client certificate parameters in this sample before you connect to your Keystone server.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: keystoneidp
    mappingMethod: claim
    type: Keystone
    keystone:
      domainName: default
      url: https://keystone.example.com:5000
      ca:
        name: ca-config-map
      tlsClientCert:
        name: client-cert-secret
      tlsClientKey:
        name: client-key-secret

where:

spec.identityProviders.name: Specifies the provider name, which is prefixed to provider usernames to form an identity name.
spec.identityProviders.mappingMethod: Specifies how mappings are established between identities from this provider and User objects.
spec.identityProviders.keystone.domainName: Specifies the Keystone domain name. In Keystone, usernames are domain-specific. Only a single domain is supported.
spec.identityProviders.keystone.url: Specifies the URL to use to connect to the Keystone server (required). This must use https.
spec.identityProviders.keystone.ca: Specifies an optional reference to an Red Hat OpenShift Container Platform ConfigMap object containing the PEM-encoded certificate authority bundle to use in validating server certificates for the configured URL.
spec.identityProviders.keystone.tlsClientCert: Specifies an optional reference to an Red Hat OpenShift Container Platform Secret object containing the client certificate to present when making requests to the configured URL.
spec.identityProviders.keystone.tlsClientKey: Specifies a reference to an Red Hat OpenShift Container Platform Secret object containing the key for the client certificate. Required if tlsClientCert is specified.