Skip to main content
Redhat Developers  Logo
  • Products

    Featured

    • Red Hat Enterprise Linux
      Red Hat Enterprise Linux Icon
    • Red Hat OpenShift AI
      Red Hat OpenShift AI
    • Red Hat Enterprise Linux AI
      Linux icon inside of a brain
    • Image mode for Red Hat Enterprise Linux
      RHEL image mode
    • Red Hat OpenShift
      Openshift icon
    • Red Hat Ansible Automation Platform
      Ansible icon
    • Red Hat Developer Hub
      Developer Hub
    • View All Red Hat Products
    • Linux

      • Red Hat Enterprise Linux
      • Image mode for Red Hat Enterprise Linux
      • Red Hat Universal Base Images (UBI)
    • Java runtimes & frameworks

      • JBoss Enterprise Application Platform
      • Red Hat build of OpenJDK
    • Kubernetes

      • Red Hat OpenShift
      • Microsoft Azure Red Hat OpenShift
      • Red Hat OpenShift Virtualization
      • Red Hat OpenShift Lightspeed
    • Integration & App Connectivity

      • Red Hat Build of Apache Camel
      • Red Hat Service Interconnect
      • Red Hat Connectivity Link
    • AI/ML

      • Red Hat OpenShift AI
      • Red Hat Enterprise Linux AI
    • Automation

      • Red Hat Ansible Automation Platform
      • Red Hat Ansible Lightspeed
    • Developer tools

      • Red Hat Trusted Software Supply Chain
      • Podman Desktop
      • Red Hat OpenShift Dev Spaces
    • Developer Sandbox

      Developer Sandbox
      Try Red Hat products and technologies without setup or configuration fees for 30 days with this shared Openshift and Kubernetes cluster.
    • Try at no cost
  • Technologies

    Featured

    • AI/ML
      AI/ML Icon
    • Linux
      Linux Icon
    • Kubernetes
      Cloud icon
    • Automation
      Automation Icon showing arrows moving in a circle around a gear
    • View All Technologies
    • Programming Languages & Frameworks

      • Java
      • Python
      • JavaScript
    • System Design & Architecture

      • Red Hat architecture and design patterns
      • Microservices
      • Event-Driven Architecture
      • Databases
    • Developer Productivity

      • Developer productivity
      • Developer Tools
      • GitOps
    • Secure Development & Architectures

      • Security
      • Secure coding
    • Platform Engineering

      • DevOps
      • DevSecOps
      • Ansible automation for applications and services
    • Automated Data Processing

      • AI/ML
      • Data Science
      • Apache Kafka on Kubernetes
      • View All Technologies
    • Start exploring in the Developer Sandbox for free

      sandbox graphic
      Try Red Hat's products and technologies without setup or configuration.
    • Try at no cost
  • Learn

    Featured

    • Kubernetes & Cloud Native
      Openshift icon
    • Linux
      Rhel icon
    • Automation
      Ansible cloud icon
    • Java
      Java icon
    • AI/ML
      AI/ML Icon
    • View All Learning Resources

    E-Books

    • GitOps Cookbook
    • Podman in Action
    • Kubernetes Operators
    • The Path to GitOps
    • View All E-books

    Cheat Sheets

    • Linux Commands
    • Bash Commands
    • Git
    • systemd Commands
    • View All Cheat Sheets

    Documentation

    • API Catalog
    • Product Documentation
    • Legacy Documentation
    • Red Hat Learning

      Learning image
      Boost your technical skills to expert-level with the help of interactive lessons offered by various Red Hat Learning programs.
    • Explore Red Hat Learning
  • Developer Sandbox

    Developer Sandbox

    • Access Red Hat’s products and technologies without setup or configuration, and start developing quicker than ever before with our new, no-cost sandbox environments.
    • Explore Developer Sandbox

    Featured Developer Sandbox activities

    • Get started with your Developer Sandbox
    • OpenShift virtualization and application modernization using the Developer Sandbox
    • Explore all Developer Sandbox activities

    Ready to start developing apps?

    • Try at no cost
  • Blog
  • Events
  • Videos

How to log into Cryostat 2.1 on OpenShift: SSO for all

May 10, 2022
Janelle Law
Related topics:
ContainersJavaKubernetesSecurity
Related products:
Red Hat OpenShift Container Platform

Share:

    Cryostat, a tool for managing JDK Flight Recorder data on Kubernetes, is now integrated with the built-in OAuth server on Red Hat OpenShift as part of the tech preview release of Cryostat 2.1. When logging into Cryostat on OpenShift, you will be redirected to the OpenShift login page and prompted to enter the username and password corresponding to your OpenShift user account. Upon success, you can stay logged in during multiple sessions—for 24 hours by default.

    What does Cryostat use OpenShift authentication for?

    In order for Cryostat to monitor Java applications running in your containerized Java Virtual Machines (JVMs), Cryostat searches for target applications within the same namespace where Cryostat is deployed. This means that Cryostat needs permission from your OpenShift user account to discover Kubernetes objects such as pods and deployments. Whenever a user makes a request to start, stop, or save a JDK flight recording on a target application, Cryostat ensures that the user's requests come from the same namespace, and that the user has access to view and manage JDK flight recordings on each target application.

    Changes to Cryostat authentication since Cryostat 2.0

    Cryostat 2.0 required users to paste their authorization token from the OpenShift console into the Cryostat login page and re-enter their token upon refreshing a browser session. Cryostat 2.1 combines the OpenShift OAuth server with Cryostat's RBAC permissions to give users configurable permissions for each of their OpenShift user accounts. By default, each web browser session lasts 24 hours.

    How to log in to Cryostat 2.1

    This article assumes you have an instance of Cryostat running in an OpenShift 4.6+ cluster. You can check out Getting started with Cryostat 2.1 to learn how to install Cryostat.

    Once you have an instance of Cryostat running, log in to the OpenShift web console, navigate to Installed Operators, and select Cryostat Operator. From there, select your desired Cryostat instance under the Cryostat tab. Click the Application URL link to access the login screen, where you can enter your username and password for your OpenShift user account.

    For access to all of Cryostat's features, you may need to request RBAC permissions for your OpenShift user account. Users with limited permissions have access only to the Cryostat features for which they are authorized. For example, users with read-only permissions can view JDK flight recordings created by other users but cannot create or delete recordings. At the time of writing, the following user permissions are required to access all of the features in Cryostat:

    - apiGroups:
      - ""
      resources:
      - pods
      verbs:
      - create
      - get
    - apiGroups:
      - ""
      resources:
      - replicationcontrollers
      - endpoints
      verbs:
      - get
    - apiGroups:
      - operator.cryostat.io
      resources:
      - cryostats
      verbs:
      - create
      - delete
      - get
    - apiGroups:
      - operator.cryostat.io
      resources:
      - flightrecorders
      - recordings
      verbs:
      - create
      - delete
      - get
      - patch
    - apiGroups:
      - apps
      resources:
      - deployments
      verbs:
      - create
      - get
    - apiGroups:
      - apps
      resources:
      - daemonsets
      - replicasets
      - statefulsets
      verbs:
      - get
    

    Overview of Cryostat RBAC permissions

    If more than one user is managing JDK flight recordings with Cryostat in a single namespace, and you want to give each user specific permissions for Cryostat features, create a role with your desired Cryostat-specific RBAC permissions and bind that role to the desired user account. In general, Cryostat uses get permissions for the apiGroups: "" and apiGroups: apps resources listed in the previous section, to discover any target applications within the namespace. The create, delete, get, and patch permissions for Cryostat's flightrecorders and recordings resources allow users to create, delete, retrieve, and save JDK flight recordings from their target applications.

    Conclusion

    This article explains how to log in to Cryostat 2.1 on OpenShift and outlines the required RBAC permissions for your user account. To learn more about defining RBAC permissions, visit the OpenShift Container Platform documentation. For more information about Cryostat, visit cryostat.io. For questions, comments, and feedback, feel free to connect with us on Github or join our mailing list.

    Last updated: September 20, 2023

    Recent Posts

    • GuideLLM: Evaluate LLM deployments for real-world inference

    • Unleashing multimodal magic with RamaLama

    • Integrate Red Hat AI Inference Server & LangChain in agentic workflows

    • Streamline multi-cloud operations with Ansible and ServiceNow

    • Automate dynamic application security testing with RapiDAST

    What’s up next?

    book cover

    The microservice architectural approach is more than just about technology: It reaches into the foundation of your organization to allow you to build truly scalable, adaptive, complex systems that help a business adapt to rapidly changing competitive markets. In Microservices for Java Developers, you'll get a hands-on introduction to frameworks and containers through a handful of familiar patterns.

    Get the free e-book
    Red Hat Developers logo LinkedIn YouTube Twitter Facebook

    Products

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform

    Build

    • Developer Sandbox
    • Developer Tools
    • Interactive Tutorials
    • API Catalog

    Quicklinks

    • Learning Resources
    • E-books
    • Cheat Sheets
    • Blog
    • Events
    • Newsletter

    Communicate

    • About us
    • Contact sales
    • Find a partner
    • Report a website issue
    • Site Status Dashboard
    • Report a security problem

    RED HAT DEVELOPER

    Build here. Go anywhere.

    We serve the builders. The problem solvers who create careers with code.

    Join us if you’re a developer, software engineer, web designer, front-end designer, UX designer, computer scientist, architect, tester, product manager, project manager or team lead.

    Sign me up

    Red Hat legal and privacy links

    • About Red Hat
    • Jobs
    • Events
    • Locations
    • Contact Red Hat
    • Red Hat Blog
    • Inclusion at Red Hat
    • Cool Stuff Store
    • Red Hat Summit

    Red Hat legal and privacy links

    • Privacy statement
    • Terms of use
    • All policies and guidelines
    • Digital accessibility

    Report a website issue