Reconcile federated identity credentials for your Azure Red Hat OpenShift cluster with managed identities enabled

In this article, learn how to reconcile federated identity credentials for OpenShift operator managed identities in your Azure Red Hat OpenShift clusters with managed / workload identity enabled.

Reconciling the federated identity credentials for the OpenShift operator managed identities can be needed if any OpenShift operators are unable to authenticate to Azure. This procedure ensures the federated identity credentials for each of the OpenShift operators exist, are configured correctly, and are correctly deployed into the in-cluster secrets so that the OpenShift operators can use them.

Prerequisites

This article assumes that the following conditions are met.

• You have an existing Azure Red Hat OpenShift cluster with managed / workload identity enabled with the latest updates applied.

• You are using using Azure CLI version 2.84.0 or higher, which contains the fully supported CLI arguments for managed identity clusters.

• If you need to check the version of Azure CLI, run:

  az --version
  

• To install or upgrade the Azure CLI, follow Install Azure CLI.

Reconcile federated identity credentials

Important

The az aro update command can take up to two hours depending on the cluster state (for example, it can take longer for a larger cluster, etc.). Smaller clusters can take less time. The command reconciles federated identity credentials without requiring any special arguments. There are no adverse effects of running this command on healthy clusters.

To update the resource and reconcile the federated identity credentials, run:

az aro update --name <CLUSTER_NAME> --resource-group <RESOURCE_GROUP>

Next steps

• Learn more about managed identities.
• Create an Azure Red Had OpenShift cluster with managed identities.