// Module included in the following assemblies:
//
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-ext-auth.adoc

:_mod-docs-content-type: PROCEDURE
[id="rosa-hcp-sts-accessing-a-break-glass-cred-cli_{context}"]
= Accessing a {product-title} cluster by using a break glass credential

[role="_abstract"]
Use the new `kubeconfig` from the break glass credential to gain temporary admin access to a {product-title} cluster.

.Prerequisites

* You have access to a {product-title} cluster with external authentication enabled. For more information, see _Creating a {product-title} cluster that uses direct authentication with an external OIDC identity provider_.
* You have installed the `oc` and the `kubectl` CLIs.
* You have configured the new `kubeconfig`. For more information, see _Creating a break glass credential for a {product-title} cluster_.

.Procedure

. Access the details for the cluster:
+
[source,terminal]
----
$ rosa describe break-glass-credential <break_glass_credential_id> -c <cluster_name>  --kubeconfig > $KUBECONFIG
----
+
. List the nodes from the cluster:
+
[source,terminal]
----
$ oc get nodes
----
+
.Example output
[source,terminal]
----
NAME                        STATUS   ROLES   AGE   VERSION
ip-10-0-0-27.ec2.internal   Ready    worker  8m    v1.28.7+f1b5f6c
ip-10-0-0-67.ec2.internal   Ready    worker  9m    v1.28.7+f1b5f6c
----
. Verify you have the correct credentials:
+
[source,terminal]
----
$ kubectl auth whoami
----
+
.Example output
[source,terminal]
----
ATTRIBUTE    VALUE
Username     system:customer-break-glass:test-user
Groups       [system:masters system:authenticated]
----
. Apply the `ClusterRoleBinding` for the groups defined in the external OIDC provider. The `ClusterRoleBinding` maps the `rosa-hcp-admins` group that is created in Microsoft Entra ID to a group in the {product-title} cluster.
+
[source,terminal]
----
$ oc apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: rosa-hcp-admins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: f715c264-ab90-45d5-8a29-2e91a609a895
EOF
----
+
The output of this command is:
+
[source,terminal]
----
clusterrolebinding.rbac.authorization.k8s.io/rosa-hcp-admins created
----
+
[NOTE]
====
After applying the `ClusterRoleBinding`, the {product-title} cluster is configured and the `rosa` CLI and {hybrid-console-url} authenticate through the external OIDC provider. You can now start assigning roles and deploying applications on the cluster.
====