> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenShift Setup

> Connect an OpenShift cluster with a read-only kubeconfig and include OpenShift platform resources in inventory and scans.

# OpenShift Setup

OpenShift integrations use the Kubernetes API plus OpenShift-specific APIs. One integration maps to
one cluster and one kubeconfig context.

## Create The Integration

1. Choose the target workspace, open `Integrations`, and select **Cloud**.
2. Open **Other** and choose **Connect OpenShift**.
3. Enter the cluster name and paste a read-only kubeconfig.
4. Select the intended context and optionally restrict allowed API-server hosts or CIDR ranges.
5. Run the connection probe, resolve authentication or permission errors, and save.
6. Run a resource sync to verify that both Kubernetes and OpenShift objects appear.

Use a static service-account bearer token or inline client certificate credentials. Kubeconfigs
that call `oc`, a cloud CLI, or another local `exec` plugin cannot run in the hosted scanner. The
setup form provides a read-only service-account manifest and extraction commands when you need a
compatible kubeconfig.

## OpenShift Coverage

Alongside the Kubernetes resource set, Cloudgeni inventories OpenShift projects, routes, security
context constraints, and cluster versions. Framework views include CIS Kubernetes 1.11.1, SOC 2,
ISO 27001:2022, and NIS2 when the corresponding compliance scan data is available.

For private cluster API servers, use the Cloudgeni in-cluster connector when it is enabled for your
deployment, or provide an approved network path from the scanner to the API endpoint.

## Troubleshooting

* **Only Kubernetes objects appear:** confirm the service account can read the OpenShift API groups.
* **Authentication uses `oc login`:** replace it with a static-token or inline-certificate
  kubeconfig.
* **The probe cannot reach the cluster:** verify the API hostname, certificate chain, allowlists,
  and connector/network path.