Using a cronjob is a good option.

First, you'll need an image that has the oc command line client available. I'm sure there's a prebuilt one out there somewhere, but since this will be running with privileges in your OpenShift cluster you want something you trust, which probably means building it yourself. I used:

FROM quay.io/centos/centos:8

RUN curl -o /tmp/openshift-client.tar.gz \
                https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz; \
    tar -C /bin -xf /tmp/openshift-client.tar.gz oc kubectl; \
    rm -f /tmp/openshift-client.tar.gz

ENTRYPOINT ["/bin/oc"]

In order to handle authentication correctly, you'll need to create a ServiceAccount and then assign it appropriate privileges through a Role and a RoleBinding. I created a ServiceAccount named oc-client-sa:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: oc-client-sa
  namespace: oc-client-example

A Role named oc-client-role that grants privileges to Pod and Deployment objects:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: oc-client-role
  namespace: oc-client-example
rules:
  - verbs:
      - get
      - list
      - create
      - watch
      - patch
    apiGroups:
      - ''
    resources:
      - pods
  - verbs:
      - get
      - list
      - create
      - watch
      - patch
    apiGroups:
      - 'apps'
    resources:
      - deployments
      - deployments/scale

And a RoleBinding that connects the oc-client-sa ServiceAccount to the oc-client-role Role:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: oc-client-rolebinding
  namespace: oc-client-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: oc-client-role
subjects:
  - kind: ServiceAccount
    name: oc-client-sa

With all this in place, we can write a CronJob like this that will scale down a deployment at a specific time. Note that we're running the jobs using the oc-client-sa ServiceAccount we created earlier:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: scale-web-down
  namespace: oc-client-example
spec:
  schedule: "00 00 * * *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: oc-client-sa
          restartPolicy: Never
          containers:
          - image: docker.io/larsks/openshift-client
            args:
              - scale
              - deployment/sampleservice
              - --replicas=0
            name: oc-scale-down

You would write a similar one to scale things back up at 5AM.

The oc client will automatically use the credentials provided to your pod by Kubernetes because of the serviceAccountName setting.