This is a cache of https://docs.okd.io/4.16/networking/accessing-hosts.html. It is a snapshot of the page at 2026-01-21T02:45:16.786+0000.
Accessing hosts | Networking | OKD 4.16
  1. Documentation
×

Accessing hosts

To establish secure administrative access to OKD instances and control plane nodes, create a bastion host.

Configuring a bastion host provides an entry point for Secure Shell (SSH) traffic, ensuring that your cluster remains protected while allowing for remote management.

Accessing hosts on Amazon Web Services in an installer-provisioned infrastructure cluster

To establish Secure Shell (SSH) access to OKD hosts on Amazon EC2 instances that lack public IP addresses, configure a bastion host or secure gateway. Defining this access path ensures that you can safely manage and troubleshoot your private infrastructure within an installer-provisioned environment.

Procedure

  1. Create a security group that allows SSH access into the virtual private cloud (VPC) that the openshift-install command-line interface creates.

  2. Create an Amazon EC2 instance on one of the public subnets the installation program created.

  3. Associate a public IP address with the Amazon EC2 instance that you created.

    Unlike with the OKD installation, associate the Amazon EC2 instance you created with an SSH keypair. The operating system selection is not important for this instance, because the instanace serves as an SSH bastion to bridge the internet into the VPC of your OKD cluster. The Amazon Machine Image (AMI) you use does matter. With Fedora CoreOS (FCOS), for example, you can provide keys through Ignition by using a similar method to the installation program.

  4. After you provisioned your Amazon EC2 instance and can SSH into the instance, add the SSH key that you associated with your OKD installation. This key can be different from the key for the bastion instance, but this is not a strict requirement.

    Use direct SSH access only for disaster recovery. When the Kubernetes API is responsive, run privileged pods instead.

  5. Run oc get nodes, inspect the output, and choose one of the nodes that is a control plane. The hostname looks similar to ip-10-0-1-163.ec2.internal.

  6. From the bastion SSH host that you manually deployed into Amazon EC2, SSH into that control plane host by entering the following command. Ensure that you use the same SSH key that you specified during installation:

    $ ssh -i <ssh-key-path> core@<control_plane_hostname>