---
name: openshift-openshift_cluster_access
title: Accessing Red Hat OpenShift clusters
description: After your Red Hat OpenShift on IBM Cloud cluster is created, you can connect to it using several methods depending on your cluster type, network configuration, and use case. If you're not sure which method applies to you, start by identifying your cluster's infrastructure type and whether it has a public service endpoint (see Choosing an access method below).
last-updated: 2026-08-11
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing Red Hat OpenShift clusters
{: #access_cluster}
{: help}
{: support}

After your Red Hat OpenShift on IBM Cloud cluster is created, you can connect to it using several methods depending on your cluster type, network configuration, and use case. If you're not sure which method applies to you, start by identifying your cluster's infrastructure type and whether it has a public service endpoint (see [Choosing an access method](#access-method-choose) below).
{: shortdesc}

## Before you begin
{: #access-prereqs}

1. [Install the IBM Cloud CLI, the OpenShift CLI (`oc`), and required plug-ins](https://cloud.ibm.com/docs/openshift?topic=openshift-cli-install&format=markdown).
1. If you haven't created a cluster yet, [create one now](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters&format=markdown). Otherwise, proceed to the next step.
1. If your network is protected by a company firewall, [allow access to the required API endpoints and ports](https://cloud.ibm.com/docs/openshift?topic=openshift-firewall&format=markdown#corporate).
1. Verify your cluster is healthy by running `ibmcloud oc cluster get -c CLUSTER_NAME_OR_ID`. A healthy cluster shows `State: normal`. If you see a different state, see [Debugging clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters&format=markdown).
1. If your IBM Cloud account uses multifactor authentication (MFA), ensure it is enabled at the account level — contact your account owner if you're unsure. This is required for the `ibmcloud login` step when connecting to your cluster. For instructions, see [Enabling MFA](https://cloud.ibm.com/docs/iam?topic=iam-enablemfa&format=markdown).

## Choosing an access method
{: #access-method-choose}

The right access method depends on your cluster infrastructure type, whether your cluster has a public or private service endpoint, and your network connectivity.

Not sure which type you have? In the IBM Cloud console, go to **OpenShift → Clusters**, click your cluster, and check the **Infrastructure** field on the Overview tab — it shows **VPC**, **Classic**, or **Satellite**. To check whether your cluster has a public or private service endpoint, look at the **Public Service Endpoint URL** and **Private Service Endpoint URL** fields on the same page, or run `ibmcloud oc cluster get -c CLUSTER_NAME_OR_ID` and check those fields in the output.
{: tip}

| Access method | Cluster type | Use when |
| --- | --- | --- |
| [Public cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-access-public&format=markdown) | Classic, VPC | Your cluster has a public endpoint and you are connecting from outside the IBM Cloud network |
| [Private cloud service endpoint — VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-access-private-vpc&format=markdown) | VPC | Your cluster is private-only and you are connected to the VPC network through a VPN or Direct Link connection |
| [Private cloud service endpoint — Classic](https://cloud.ibm.com/docs/openshift?topic=openshift-access-private-classic&format=markdown) | Classic | Your cluster is private-only and you are connected to the classic private network |
| [Virtual Private Endpoint (VPE) gateway](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-vpe&format=markdown) | VPC | Your VPC cluster uses VPE for private master connectivity |
| [Satellite cluster service URL](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-satellite&format=markdown) | Satellite | Your cluster runs on Satellite infrastructure |
| [API key or service ID](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-automation&format=markdown) | All | Automated pipelines and non-interactive scripts |
| [Accessing private clusters by using the WireGuard VPN](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-wireguard&format=markdown) | Classic, VPC | You want to access a private-only cluster from outside IBM Cloud using a WireGuard VPN |
{: caption="Cluster access methods" caption-side="bottom"}

## Advanced configuration
{: #access-advanced-config}

The following topics cover additional configuration required for specific access scenarios. Complete the primary access method above before applying these steps.

| Configuration topic | Cluster type | When to use |
| --- | --- | --- |
| [Setting the OAuth access type](https://cloud.ibm.com/docs/openshift?topic=openshift-setting-oauth-access-type&format=markdown) | VPC | Your VPC cluster uses only the private service endpoint and you need to configure how the OpenShift console and OAuth are exposed |
| [Configuring security group rules for VPE gateway console access](https://cloud.ibm.com/docs/openshift?topic=openshift-console-apiserver-oauthvpe&format=markdown) | VPC | Your cluster uses VPE gateway OAuth access and you need to add security group rules to allow VPN client connections to the API server and OAuth server |
{: caption="Advanced access configuration" caption-side="bottom"}