Accessing Red Hat OpenShift clusters

After your Red Hat OpenShift on IBM Cloud cluster is created, you can connect to it using several methods depending on your cluster type, network configuration, and use case. If you're not sure which method applies to you, start by identifying your cluster's infrastructure type and whether it has a public service endpoint (see Choosing an access method below).

Before you begin

  1. Install the IBM Cloud CLI, the OpenShift CLI (oc), and required plug-ins.
  2. If you haven't created a cluster yet, create one now. Otherwise, proceed to the next step.
  3. If your network is protected by a company firewall, allow access to the required API endpoints and ports.
  4. Verify your cluster is healthy by running ibmcloud oc cluster get -c CLUSTER_NAME_OR_ID. A healthy cluster shows State: normal. If you see a different state, see Debugging clusters.
  5. If your IBM Cloud account uses multifactor authentication (MFA), ensure it is enabled at the account level — contact your account owner if you're unsure. This is required for the ibmcloud login step when connecting to your cluster. For instructions, see Enabling MFA.

Choosing an access method

The right access method depends on your cluster infrastructure type, whether your cluster has a public or private service endpoint, and your network connectivity.

Not sure which type you have? In the IBM Cloud console, go to OpenShift → Clusters, click your cluster, and check the Infrastructure field on the Overview tab — it shows VPC, Classic, or Satellite. To check whether your cluster has a public or private service endpoint, look at the Public Service Endpoint URL and Private Service Endpoint URL fields on the same page, or run ibmcloud oc cluster get -c CLUSTER_NAME_OR_ID and check those fields in the output.

Cluster access methods
Access method Cluster type Use when
Public cloud service endpoint Classic, VPC Your cluster has a public endpoint and you are connecting from outside the IBM Cloud network
Private cloud service endpoint — VPC VPC Your cluster is private-only and you are connected to the VPC network through a VPN or Direct Link connection
Private cloud service endpoint — Classic Classic Your cluster is private-only and you are connected to the classic private network
Virtual Private Endpoint (VPE) gateway VPC Your VPC cluster uses VPE for private master connectivity
Satellite cluster service URL Satellite Your cluster runs on Satellite infrastructure
API key or service ID All Automated pipelines and non-interactive scripts
Accessing private clusters by using the WireGuard VPN Classic, VPC You want to access a private-only cluster from outside IBM Cloud using a WireGuard VPN

Advanced configuration

The following topics cover additional configuration required for specific access scenarios. Complete the primary access method above before applying these steps.

Advanced access configuration
Configuration topic Cluster type When to use
Setting the OAuth access type VPC Your VPC cluster uses only the private service endpoint and you need to configure how the OpenShift console and OAuth are exposed
Configuring security group rules for VPE gateway console access VPC Your cluster uses VPE gateway OAuth access and you need to add security group rules to allow VPN client connections to the API server and OAuth server