1

Problem Scenario: OKD cluster is having two cluster-admins: User1 and User2.

If User1 connects to cluster using ssh and performs oc login and parallely User2 connects to the same cluster with new ssh session and performs oc login.

Now when User1 checks oc whoami the result will be User2 (which is desired to have User1). This will create problems like User1 operations(ex:deployements) to clash with User2.

How can this problem be eliminated so that two users can parallelly use the cluster?

Note: Both User1 and User2 are configured with LDAP, is this creating problem?

rakesh kotian
  • 232
  • 1
  • 5
  • 30

2 Answers2

2

How can this problem be eliminated so that two users can parallelly use the cluster?

AFAIK, the OKD session is saved in $HOME/.kube/config by default. So it depends on a OS account session. If you'd like to use at the same time, then you should use different OS account each other. OR you should run oc login --config context_file_path per each execution for saving session to different context file. Refer Loading and Merging Rules for more details.

Note: Both User1 and User2 are configured with LDAP, is this creating problem?

No. Identity provider configuration does not affect this.

Daein Park
  • 4,393
  • 2
  • 12
  • 21
  • with ```oc login --config context_file_path``` if i login then for all the oc operations/commands i need to pass config parameter right? Is it possible to set the config to particular context file once so that user need not bother about passing extra arguement-config with other oc commands – rakesh kotian Jan 22 '20 at 16:03
  • 1
    You mean how to use oc CLI without "--config" with referring each context, right ? If it's right, you can use `KUBECONFIG=each_user_context_file_path`. Before using oc CLI, define this env for each user session. Then oc CLI consider this env without `--config`. – Daein Park Jan 23 '20 at 01:39
1

You should not share user accounts in this way. Each person who is logging in to the cluster should using a command-line client be doing so under their own linux uid against their own home directory. Sharing user accounts is a security vulnerability and removes your ability to track who is doing what.

kubectl and oc take this as a prerequisite, which is why you're running into this issue.

Nick
  • 1,834
  • 20
  • 32