OCL (OpenShift Login)
OCL does an automatic login to an OpenShift cluster. It fetches cluster information from app-interface and performs a login via Red Hat SSO.
Installation
You can install this tool from PyPI with pip:
python3 -m pip install openshift-cluster-login
or install it with uv:
uv tool install openshift-cluster-login
You can also use uv to run the tool without installing it:
uvx openshift-cluster-login
Usage
Interactive login
ocl
This spawns a new shell with the following environment variables set:
KUBECONFIG- path to kubeconfig fileOCL_CLUSTER_NAME- cluster nameOCL_CLUSTER_CONSOLE- url to cluster console
kubectl exec credential plugin
OCL can act as a kubectl exec credential plugin, allowing kubectl to transparently fetch and refresh credentials without a separate login step.
One-time setup:
ocl --import-cluster <cluster>
This adds the cluster to ~/.kube/config and creates a shared ocl user entry (if not already present) that all imported contexts reference. After that, any kubectl command against the cluster works directly — OCL handles authentication in the background.
To import all clusters at once:
ocl --import-clusters
Use --overwrite to update existing entries.
How it works:
kubectl calls ocl --get-token whenever it needs credentials. OCL reads the cluster's server URL from the KUBERNETES_EXEC_INFO environment variable that kubectl sets, looks up the matching cluster, checks its token cache, validates via oc whoami if needed, re-authenticates if expired, and returns an ExecCredential JSON. Tokens are cached and revalidated at most once every 5 minutes to avoid per-command overhead.
Because all imported contexts share a single ocl user entry, running ocl --import-clusters is a true one-time setup — no per-cluster credential configuration required.
Features
OCL currently provides the following features (get help with --help):
- OpenShift console login (
oc login) via GitHub or Red Hat authentication - kubectl exec credential plugin (
--get-token,--import-cluster,--import-clusters) - Get cluster and namespace information from app-interface or user-defined (
OCL_USER_CLUSTERS) - Open the OpenShift console in the browser (
--open-in-browser) - Star your most often used namespaces
Ctrl+Sin the UI - Shell completion (
--install-completion,--show-completion) - Credentials via environment variables or shell command (e.g., 1password CLI)
- Cache App-Interface queries (via GraphQL) for one week
Environment Variables
| Variable Name | Description | Default |
|---|---|---|
| OCL_APP_INTERFACE_URL OCL_APP_INTERFACE_URL_COMMAND | App-Interface URL | |
| OCL_APP_INT_TOKEN OCL_APP_INT_TOKEN_COMMAND | App-Interface authentication token [optional] | |
| OCL_USER_CLUSTERS OCL_USER_CLUSTERS_COMMAND | User defined clusters as json format (e.g. [{"name": "local-kind", "serverUrl": "https://localhost:6443", "consoleUrl": "not available}]) |
"[]" |
| OCL_CACHE_TIMEOUT_MINUTES | GraphQL cache timeout in minutes | 1 hour |
| OCL_HISTORY | Enable/Disable the usage of the last selected namespace | enabled |
| OCL_CSS_PATH | Path to custom Textual CSS file |
You can either set a variable, e.g. export OCL_GITHUB_USERNAME="mail@example.com" or retrieve it via a command, e.g. export OCL_GITHUB_USERNAME_COMMAND="op read op://Private/Github/username".
If a variable is not set but needed, OCL will ask for it interactively.
App-Interface
OCL retrieves the cluster information from app-interface via GraphQL (OCL_APP_INTERFACE_URL) and caches them
in your user cache directory (on MacOS, e.g., ~/Library/Caches/ocl/gql_cache/).
Remove this directory to force a refresh.
Limitations
- Kerberos authentication only
- Works only with a Red Hat associate account
Development
1 maintainer
Metadata
1 maintainer
Release files for openshift-cluster-login 1.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| openshift_cluster_login-1.5.0.tar.gz | 14.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openshift_cluster_login-1.5.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 33.2 kB
Release files / openshift_cluster_login-1.5.0.tar.gz
| Download URL | openshift_cluster_login-1.5.0.tar.gz |
|---|---|
| Size | 14.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
84461ea8012d78692b22f0096c8c5a098fe12018840f99e3c28fa6b671e43615
|
|
BLAKE2b-256 checksum How to use checksums |
67d7c1bb131aa9714b26fc9aff8b6cce880c42390e1c41820ca1134167afb172
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.7 {"installer":{"name":"uv","version":"0.11.7","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / openshift_cluster_login-1.5.0-py3-none-any.whl
| Download URL | openshift_cluster_login-1.5.0-py3-none-any.whl |
|---|---|
| Size | 18.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5b98f1d32f6f795edd289f65266625880ff6bbcb6e329e028b4f3ce1866e04db
|
|
BLAKE2b-256 checksum How to use checksums |
f541b64ee5ebeec0574413ded76a033c5bdc8e2d166ddc861541d9b164d2cc13
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.7 {"installer":{"name":"uv","version":"0.11.7","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
