菜单
Use when setting up or managing Entra ID (Azure AD) OAuth authentication for an OKD/OpenShift cluster. This skill covers the creation of Azure App Registrations, cluster secrets, and the OAuth configuration resource.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | openshift-cluster-entraid-setup |
| description | Use when setting up or managing Entra ID (Azure AD) OAuth authentication for an OKD/OpenShift cluster. This skill covers the creation of Azure App Registrations, cluster secrets, and the OAuth configuration resource. |
This skill provides instructions and context for configuring Entra ID (formerly Azure AD) as an identity provider for an OKD/OpenShift cluster using the OpenID Connect (OIDC) protocol.
OpenShift includes a built-in OAuth Custom Resource Definition (CRD) that allows you to connect to external OIDC providers. This enables non-Kubernetes-based users to authenticate to the cluster using their existing corporate credentials.
The setup process involves creating an Azure App Registration to represent the OKD cluster in Entra ID.
OKD-<cluster_name>-OAuth.https://oauth-openshift.apps.<cluster_name>.<base_domain>/oauth2callback/azurehttps://oauth-openshift.apps.okd.kubesoar.com/oauth2callback/azureThe App Registration requires the following API Permissions (Scopes) from Microsoft Graph:
User.Read (Sign in and read user profile)email (View users' email address)openid (Sign users in)profile (View users' basic profile)The configuration is typically automated via the cluster's makefile.
make setup-entraid: This is the primary target that handles the complete Entra ID OAuth setup. It validates Azure credentials, creates the App Registration, sets permissions, generates secrets, and applies the configuration to the cluster.The Ansible playbook okd/ansible/setup-entraid-oauth.yml is the core component executed by this target.
The setup script generates a client secret for the Azure App Registration.
A Kubernetes Secret is created in the openshift-config namespace (usually named azure-oauth-client-secret). This secret contains the clientSecret from the Azure App Registration.
The cluster's OAuth object (named cluster) is updated to include azure as an identity provider. It references:
clientID of the Azure App Registration.issuer URL (e.g., https://login.microsoftonline.com/<tenant_id>/v2.0).clientSecret.After the script has successfully run:
ClusterRoleBinding that maps their Azure email identity to the cluster-admin role. This ensures that when logging in via Azure, they retain full administrative control.okd/ansible/setup-entraid-oauth.ymlokd/cluster-setup/entraid-oauth.yamlokd/ansible/templates/entraid-oauth.yaml.j2okd/makefile (target: setup-entraid)Use when you need to understand the physical servers, their operating systems, or hardware specifications in the homelab.
Use when you need to understand or configure the DNS setup for the homelab and the OKD cluster, including Pi-hole records.
Use when you need to understand the homelab's network topology, IP ranges, gateway, or DNS server locations.
Use when managing or troubleshooting the Nginx-based load balancer (okd-lb) for the OKD cluster.
Use when you need to understand how the OKD nodes (VMs) are created, managed, and destroyed on the desktop-server libvirt host in the homelab.
High-level overview of the OKD cluster setup process. Use this to understand the end-to-end flow from planning IPs and DNS to starting the VMs.