OpenShift on AWS can look smooth on the docs but jagged in the shell. The key is knowing exactly how AWS CLI and OpenShift CLI (oc) fit together, and how to hook AWS authentication into a cluster workflow without friction. Done right, the setup is fast, repeatable, and secure.
First, install and configure AWS CLI with credentials that have the right IAM policies for your OpenShift environment. Minimalism wins here—use the smallest set of permissions needed, but make sure they cover ec2, s3, iam, and networking resources. Run aws configure and verify with aws sts get-caller-identity before touching OpenShift.
Next, install the OpenShift CLI (oc) and log in to your cluster. If you deployed OpenShift on AWS using ROSA (Red Hat OpenShift Service on AWS) or an installer-provisioned infrastructure (IPI), there’s a specific API endpoint for authentication. Use it. Run:
oc login --token=<token> --server=<server-url>
and confirm oc whoami returns the expected user.
Where AWS CLI stands out is automation. You can script VPC creation, IAM role setup, security groups, Route53 DNS entries, and S3 bucket storage, all before OpenShift even comes online. When combined with oc, you can write pipelines that deploy apps, manage cluster nodes, and scale workloads using AWS-native triggers.
Common pitfalls:
- Mismatched regions between AWS CLI config and cluster resources.
- Expired
oc tokens that silently break scripts. - Permissions gaps in IAM when deleting or scaling nodes.
Lock these down early. Always sync AWS CLI’s --region flag with the actual region of your OpenShift deployment. Refresh tokens for CI pipelines and verify role assumptions with aws sts.
The true power comes when you link AWS CLI-driven infrastructure changes directly to OpenShift cluster automation. Imagine provisioning worker nodes on the fly, attaching them to an autoscaling group, and having OpenShift schedule workloads instantly—all without touching the AWS console.
If you want to skip the grind of wiring AWS CLI and OpenShift by hand and just see the whole pipeline working, check out hoop.dev. You can spin it up and watch it run in minutes.