OpenShift
Give each CI pipeline run its own short-lived OpenShift service account, scoped to one namespace and deleted at check-in, and keep a scanned inventory of the standing access that remains. Works with Azure Red Hat OpenShift (ARO) and self-managed OpenShift clusters with private APIs.
In This Section
- Per-Run Pipeline Credentials
How Britive issues each CI pipeline run its own OpenShift service account and token, scoped to one namespace and deleted at check-in, with no OpenShift secret stored in CI.
- Namespace Resource Type
Create an OpenShift namespace resource type in Britive Resource Manager whose checkout creates a per-run service account and token, and whose check-in deletes it.
- CI Pipelines
Give each CI pipeline run its own OpenShift credential: the pipeline proves its identity with an OIDC token, checks out a namespace profile, and checks in when the job ends. GitHub Actions as the worked example.
- Standing-Access Scan
Scan each OpenShift namespace with Britive Resource Manager to inventory the service accounts, users and groups that hold standing access, and the roles they hold.