Table: openshift_user - Query OpenShift Users using SQL

OpenShift Users are the fundamental identity elements within OpenShift for authentication and authorization. They represent individual end users who may interact with the OpenShift API, and are associated with specific roles and permissions. User management in OpenShift is critical for controlling access, ensuring security, and maintaining operational efficiency.

Table Usage Guide

The openshift_user table provides insights into user profiles within OpenShift. As a system administrator, explore user-specific details through this table, including user names, identities, and associated metadata. Utilize it to uncover information about users, such as their roles, permissions, and the overall user management landscape within your OpenShift environment.

Examples

Basic info

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user;

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user;

List users who are not associated with any identities

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user
where
  identities is null;

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user
where
  identities is null;

List users created in the last 30 days

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user
where
  creation_timestamp >= now() - interval '30' day;

select
  uid,
  name,
  full_name,
  resource_version,
  creation_timestamp,
  generation,
  deletion_grace_period_seconds
from
  openshift_user
where
  creation_timestamp >= datetime('now', '-30 day');

List users who have admin access

select
  distinct u.uid,
  u.name,
  full_name,
  u.resource_version,
  u.creation_timestamp,
  u.generation,
  u.deletion_grace_period_seconds
from
  openshift_user as u,
  openshift_oauth_access_token as t,
  jsonb_array_elements_text(scopes) as scope
where
  u.uid = t.user_uid
  and scope = 'user:full';

select
  distinct u.uid,
  u.name,
  full_name,
  u.resource_version,
  u.creation_timestamp,
  u.generation,
  u.deletion_grace_period_seconds
from
  openshift_user as u,
  openshift_oauth_access_token as t,
  json_each(t.scopes) as scope
where
  u.uid = t.user_uid
  and scope.value = 'user:full';

List rules associated with a particular user

select
  uid,
  name,
  namespace,
  jsonb_pretty(rules) as rules
from
  kubernetes_role
where
  name in (
    select
      role_name
    from
      kubernetes_role_binding,
      jsonb_array_elements(subjects) as s
    where
      s ->> 'kind' = 'User'
      and s ->> 'name' = 'openshift_user'
  );

select
  uid,
  name,
  namespace,
  rules
from
  kubernetes_role
where
  name in (
    select
      role_name
    from
      kubernetes_role_binding,
      json_each(subjects) as s
    where
      json_extract(s.value, '$.kind') = 'User'
      and json_extract(s.value, '$.name') = 'openshift_user'
  );

Schema for openshift_user

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
annotations	jsonb		Annotations is an unstructured key-value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.
creation_timestamp	timestamp with time zone		CreationTimestamp is a timestamp representing the server time when this object was created.
deletion_grace_period_seconds	bigint		Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set.
deletion_timestamp	timestamp with time zone		DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted.
finalizers	jsonb		Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
full_name	text		The full name of the user.
generate_name	text		GenerateName is an optional prefix, used by the server, to generate a unique name only if the Name field has not been provided.
generation	bigint		A sequence number representing a specific generation of the desired state.
groups	jsonb		Groups specifies group names this user is a member of.
identities	jsonb		Identities are the identities associated with this user.
labels	jsonb		Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.
name	text	=	Name of the object. Name must be unique within a namespace.
namespace	text		Namespace defines the space within which each name must be unique.
owner_references	jsonb		List of objects depended by this object. If all objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
resource_version	text		An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
title	text		Title of the resource.
uid	text		UID is the unique in time and space value for this object.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- openshift

You can pass the configuration to the command with the --config argument:

steampipe_export_openshift --config '<your_config>' openshift_user