Access (reference)
Credential values are in Vault / on-host — see Credentials. This is the where + how to reach map.
From a laptop
sshuttle -r ze@dl385-2 192.168.130.0/24 192.168.122.0/24Then add *.airgap.lab names → VIPs in /etc/hosts, and trust the Airgap Lab root CA.
Consoles & UIs
| Service | URL | Auth |
|---|---|---|
| hub console | console-openshift-console.apps.hub.airgap.lab |
Keycloak SSO (zeadmin) / kubeadmin |
| wl console | console-openshift-console.apps.wl.airgap.lab |
Keycloak SSO / kubeadmin |
| hub-dr / wl-dr consoles | ...apps.hub-dr.airgap.lab / ...apps.wl-dr.airgap.lab |
same |
| ACM | hub console → All Clusters | Keycloak SSO |
| GitLab | gitlab.airgap.lab |
administrator / SSO |
| Vault | vault.airgap.lab:8200 |
Keycloak OIDC (role admin) / root token |
| Keycloak | sso.airgap.lab |
realm platform |
| MinIO | s3.airgap.lab:9001 |
root (Vault) |
| ACS | central-stackrox.apps.hub.airgap.lab |
Keycloak (zeadmin→Admin) |
| Kiali (wl) | kiali-istio-system.apps.wl.airgap.lab |
OpenShift OAuth |
| Grafana (ACM MCO) | grafana-open-cluster-management-observability.apps.hub.airgap.lab |
OAuth |
| APISIX | api.airgap.lab |
route-dependent |
SSO: one Keycloak login (zeadmin) across all major UIs; kubeadmin = break-glass.
kubeconfig (from bastion)
export KUBECONFIG=/root/<cluster>/auth/kubeconfig # hub | hub-dr | wl | wl-dr
# kubeadmin password: /root/<cluster>/auth/kubeadmin-passwordSSH paths (important)
| Target | How |
|---|---|
| bastion | ssh ze@dl385-2 then ssh bastion (or ssh root@192.168.122.61) |
| Vault nodes | via the host: ssh ze@dl385-2 'ssh root@192.168.130.21 ...' (bastion has no key) |
| cluster nodes | ssh core@<node-ip> from the bastion |
Authoring rule: don’t build complex YAML via nested
ssh "..."heredocs — Write file → scp → run. See Gotchas.