Red Hat OpenShift Container

Red Hat OpenShift is a Kubernetes container platform that allows developers and operators to manage cloud-native applications throughout the DevOps cycle, for any cloud.

Use Cases the Adapter Solves

Connecting Axonius to Red Hat OpenShift enables you to:

• Discover Container Infrastructure - Identify all OpenShift nodes, pods, and containers running in your environment to maintain complete visibility into your containerized workloads
• Track Container Deployments - Monitor which applications are deployed as containers and correlate them with traditional infrastructure to understand your hybrid environment

Asset Types Fetched

This adapter fetches the following types of assets:

• Devices
• Containers

Data Retrieved through the Adapter

The following data can be fetched by the adapter:

Devices (Nodes) - Fields such as Node names, IP addresses, operating system information, Kubernetes version, container runtime details

Containers (Pods) - Fields such as Pod names, namespaces, labels, annotations, Container images

Before You Begin

Required Ports

Axonius must be able to communicate with the value supplied in Host Name or IP Address via the following ports:

• TCP port 443 (HTTPS) - OpenShift API Server
• TCP port 6443 (HTTPS) - Kubernetes API Server (alternative port for some deployments)

Authentication Methods

• API Token Authentication

API Endpoints Used

Axonius uses the Red Hat OpenShift Container Platform API. The adapter makes the following API calls to the OpenShift/Kubernetes API:

Note: Pod fetching can be disabled via the "Include Pods in Device Data" advanced setting.

Required Permissions

The API Token must be associated with a service account that has the following permissions:

Required Kubernetes Resources and Verbs

The adapter requires read-only access to the following Kubernetes resources:

What the Adapter Does NOT Require:

• ❌ watch verb (no real-time monitoring)
• ❌ create, update, delete, patch verbs (read-only integration)
• ❌ Access to secrets, configmaps, or other sensitive resources
• ❌ Access to deployments, services, replicasets, or other workload resources
• ❌ Namespace-specific permissions (uses cluster-wide access)

📘

Note

These permissions can be granted using a ClusterRole with get, list, and watch verbs for the resources listed above. For instructions on creating a service account and generating an API token, see Setting Up OpenShift to Work with Axonius.

Supported From Version

Supported from Axonius version 4.5

Setting Up OpenShift to Work with Axonius

Recommended Approach: Custom ClusterRole (Least Privilege)

Instead of using the broad cluster-reader role, we recommend creating a custom ClusterRole with only the minimum necessary permissions.

Step 1: Create Custom ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: axonius-openshift-reader
rules:
- apiGroups: [""]
  resources:
    - nodes
    - pods
  verbs:
    - get
    - list

Step 2: Create Service Account

oc create serviceaccount axonius-sa -n default

Step 3: Bind Custom Role to Service Account

oc create clusterrolebinding axonius-binding \
  --clusterrole=axonius-openshift-reader \
  --serviceaccount=default:axonius-sa

Step 4: Get API Token

# For OpenShift 4.11+
oc create token axonius-sa -n default --duration=8760h

# For older versions
oc serviceaccounts get-token axonius-sa -n default

Connecting the Adapter in Axonius

Navigate to the Adapters page, search for Red Hat OpenShift Container, and click on the adapter tile.

Click Add Connection.

To connect the adapter in Axonius, provide the following parameters:

Required Parameters

1. Host Name or IP Address (required) - The hostname or IP address of the Red Hat OpenShift Container API server. Example: https://api.openshift.example.com:6443

2. API Token (required) - An API Token associated with a service account that has the Required Permissions to fetch assets.

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

2. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

3. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

4. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

📘

Note

Advanced settings can either apply to all connections for this adapter, or to a specific connection. Refer to Advanced Configuration for Adapters.

• Include Pods in device data - Select this option to enrich devices (nodes) with their pods data. When enabled, each node will include detailed information about all pods running on that node.

📘

Note

To learn more about Adapter Configuration tab advanced settings, see Adapter Advanced Settings.