An OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?
Trap 1: oc get events -n openshift-config-managed
Cluster events show state changes but lack the deep HTTP client stack trace for OAuth token validation.
Trap 2: oc get clusteroperator authentication -o yaml
This only displays the status conditions and does not provide the underlying error logs.
Trap 3: oc adm must-gather…
Must-gather is for broad data collection, not the targeted real-time log inspection needed for specific routing validation failures.
- A
oc logs -n openshift-authentication deployment/oauth-openshift
The oauth-openshift pod hosts the OAuth server that serves metadata and token endpoints. Its logs record failures retrieving OAuth metadata when ingress routes are unreachable, directly exposing the misconfigured ingress controller's impact on token validation.
- B
oc get events -n openshift-config-managed
Why it fails: Cluster events show state changes but lack the deep HTTP client stack trace for OAuth token validation.
- C
oc get clusteroperator authentication -o yaml
Why it fails: This only displays the status conditions and does not provide the underlying error logs.
- D
oc adm must-gather --image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...
Why it fails: Must-gather is for broad data collection, not the targeted real-time log inspection needed for specific routing validation failures.