Chapter 7. ROSA CLI

rosa logout [arguments]

$ rosa logout [arguments]

rosa verify permissions [arguments]

$ rosa verify permissions [arguments]

rosa verify quota [arguments]

$ rosa verify quota [arguments]

rosa download rosa [arguments]

$ rosa download rosa [arguments]

rosa download oc [arguments]

$ rosa download oc [arguments]

rosa verify oc [arguments]

$ rosa verify oc [arguments]

Create default account roles for ROSA clusters using STS

# Create default account roles for ROSA clusters using STS
  rosa create account-roles

  # Create account roles with a specific permissions boundary
  rosa create account-roles --permissions-boundary arn:aws:iam::123456789012:policy/perm-boundary

Create an admin user to login to the cluster

# Create an admin user to login to the cluster
  rosa create admin -c mycluster -p MasterKey123

Interactively create an autoscaler to a cluster named "mycluster"

# Interactively create an autoscaler to a cluster named "mycluster"
  rosa create autoscaler --cluster=mycluster --interactive

  # Create a cluster-autoscaler where it should skip nodes with local storage
  rosa create autoscaler --cluster=mycluster --skip-nodes-with-local-storage

  # Create a cluster-autoscaler with log verbosity of '3'
  rosa create autoscaler --cluster=mycluster --log-verbosity 3

  # Create a cluster-autoscaler with total CPU constraints
  rosa create autoscaler --cluster=mycluster --min-cores 10 --max-cores 100

Interactively create a break glass credential to a cluster named "mycluster"

# Interactively create a break glass credential to a cluster named "mycluster"
  rosa create break-glass-credential --cluster=mycluster --interactive

Create a cluster named "mycluster"

# Create a cluster named "mycluster"
  rosa create cluster --cluster-name=mycluster

  # Create a cluster in the us-east-2 region
  rosa create cluster --cluster-name=mycluster --region=us-east-2

Create a decision for an Access Request to approve it

# Create a decision for an Access Request to approve it
  rosa create decision --access-request <access_request_id> --decision Approved

Create DNS Domain

# Create DNS Domain
	rosa create dns-domain

Interactively create an external authentication provider to a cluster named "mycluster"

# Interactively create an external authentication provider to a cluster named "mycluster"
  rosa create external-auth-provider --cluster=mycluster --interactive

Create an IAM role for a service account

# Create an IAM role for a service account
  rosa create iamserviceaccount --cluster my-cluster --name my-app --namespace default

Add a GitHub identity provider to a cluster named "mycluster"

# Add a GitHub identity provider to a cluster named "mycluster"
  rosa create idp --type=github --cluster=mycluster

  # Add an identity provider following interactive prompts
  rosa create idp --cluster=mycluster --interactive

Create an image mirror for cluster "mycluster"

# Create an image mirror for cluster "mycluster"
  rosa create image-mirror --cluster=mycluster \
    --source=registry.example.com/team \
    --mirrors=mirror.corp.com/team,backup.corp.com/team

  # Create with a specific type (digest is default and only supported type)
  rosa create image-mirror --cluster=mycluster \
    --type=digest --source=docker.io/library \
    --mirrors=internal-registry.company.com/dockerhub

Create a custom kubeletconfig with a pod-pids-limit of 5000

# Create a custom kubeletconfig with a pod-pids-limit of 5000
  rosa create kubeletconfig --cluster=mycluster --pod-pids-limit=5000

Interactively add a machine pool to a cluster named "mycluster"

# Interactively add a machine pool to a cluster named "mycluster"
  rosa create machinepool --cluster=mycluster --interactive
  # Add a machine pool mp-1 with 3 replicas of m5.xlarge to a cluster
  rosa create machinepool --cluster=mycluster --name=mp-1 --replicas=3 --instance-type=m5.xlarge
  # Add a machine pool mp-1 with autoscaling enabled and 3 to 6 replicas of m5.xlarge to a cluster
  rosa create machinepool --cluster=mycluster --name=mp-1 --enable-autoscaling \
	--min-replicas=3 --max-replicas=6 --instance-type=m5.xlarge
  # Add a machine pool with labels to a cluster
  rosa create machinepool -c mycluster --name=mp-1 --replicas=2 --instance-type=r5.2xlarge --labels=foo=bar,bar=baz,
  # Add a machine pool with spot instances to a cluster
  rosa create machinepool -c mycluster --name=mp-1 --replicas=2 --instance-type=r5.2xlarge --use-spot-instances \
    --spot-max-price=0.5
  # Add a machine pool to a cluster and set the node drain grace period
  rosa create machinepool -c mycluster --name=mp-1 --node-drain-grace-period="90 minutes"

Create a AWS cloudformation stack
TEMPLATE_NAME:

# Create a AWS cloudformation stack
  rosa create network <template-name> --param Param1=Value1 --param Param2=Value2

  # ROSA quick start HCP VPC example with one availability zone
  rosa create network rosa-quickstart-default-vpc --param Region=us-west-2 --param Name=quickstart-stack --param AvailabilityZoneCount=1 --param VpcCidr=10.0.0.0/16

  # ROSA quick start HCP VPC example with two explicit availability zones
  rosa create network rosa-quickstart-default-vpc --param Region=us-west-2 --param Name=quickstart-stack --param AZ1=us-west-2b --param AZ2=us-west-2d --param VpcCidr=10.0.0.0/16

  # To delete the AWS cloudformation stack
  aws cloudformation delete-stack --stack-name <name> --region <region>

# TEMPLATE_NAME:
Specifies the name of the template to use. This should match the name of a directory
under the path specified by '--template-dir' or the 'OCM_TEMPLATE_DIR' environment variable.
The directory should contain a YAML file defining the custom template structure.

If no TEMPLATE_NAME is provided, or if no matching directory is found, the default
built-in template 'rosa-quickstart-default-vpc' will be used.

Create default ocm role for ROSA clusters using STS

# Create default ocm role for ROSA clusters using STS
  rosa create ocm-role

  # Create ocm role with a specific permissions boundary
  rosa create ocm-role --permissions-boundary arn:aws:iam::123456789012:policy/perm-boundary

Create OIDC config

# Create OIDC config
	rosa create oidc-config

Create OIDC provider for cluster named "mycluster"

# Create OIDC provider for cluster named "mycluster"
  rosa create oidc-provider --cluster=mycluster

Create default operator roles for cluster named "mycluster"

# Create default operator roles for cluster named "mycluster"
  rosa create operator-roles --cluster=mycluster

  # Create operator roles with a specific permissions boundary
  rosa create operator-roles -c mycluster --permissions-boundary arn:aws:iam::123456789012:policy/perm-boundary

Add a tuning config with name "tuned1" and spec from a file "file1" to a cluster named "mycluster"

# Add a tuning config with name "tuned1" and spec from a file "file1" to a cluster named "mycluster"
 rosa create tuning-config --name=tuned1 --spec-path=file1 --cluster=mycluster"

Create user roles

# Create user roles
  rosa create user-role

  # Create user role with a specific permissions boundary
  rosa create user-role --permissions-boundary arn:aws:iam::123456789012:policy/perm-boundary

Delete Account roles"

# Delete Account roles"
  rosa delete account-roles -p prefix

Delete the admin user

# Delete the admin user
  rosa delete admin --cluster=mycluster

Delete the autoscaler config for cluster named "mycluster"

# Delete the autoscaler config for cluster named "mycluster"
  rosa delete autoscaler --cluster=mycluster

Delete a cluster named "mycluster"

# Delete a cluster named "mycluster"
  rosa delete cluster --cluster=mycluster

Delete a DNS domain with ID github-1

# Delete a DNS domain with ID github-1
  rosa delete dns-domain github-1

Delete an external authentication provider named exauth-1

# Delete an external authentication provider named exauth-1
  rosa delete external-auth-provider exauth-1  --cluster=mycluster

Delete IAM role for service account

# Delete IAM role for service account
  rosa delete iamserviceaccount --cluster my-cluster \
    --name my-app \
    --namespace default

Delete an identity provider named github-1

# Delete an identity provider named github-1
  rosa delete idp github-1 --cluster=mycluster

Delete image mirror with ID "abc123" from cluster "mycluster"

# Delete image mirror with ID "abc123" from cluster "mycluster"
  rosa delete image-mirror --cluster=mycluster abc123

  # Delete without confirmation prompt
  rosa delete image-mirror --cluster=mycluster abc123 --yes

  # Alternative: using the --id flag
  rosa delete image-mirror --cluster=mycluster --id=abc123

Delete ingress with ID a1b2 from a cluster named 'mycluster'

# Delete ingress with ID a1b2 from a cluster named 'mycluster'
  rosa delete ingress --cluster=mycluster a1b2

  # Delete secondary ingress using the sub-domain name
  rosa delete ingress --cluster=mycluster apps2

Delete the KubeletConfig for ROSA Classic cluster 'foo'

# Delete the KubeletConfig for ROSA Classic cluster 'foo'
  rosa delete kubeletconfig --cluster foo
  # Delete the KubeletConfig named 'bar' from cluster 'foo'
  rosa delete kubeletconfig --cluster foo --name bar

Delete machine pool with ID mp-1 from a cluster named 'mycluster'

# Delete machine pool with ID mp-1 from a cluster named 'mycluster'
  rosa delete machinepool --cluster=mycluster mp-1

Delete OCM role

# Delete OCM role
rosa delete ocm-role --role-arn arn:aws:iam::123456789012:role/xxx-OCM-Role-1223456778

Delete OIDC config based on registered OIDC Config ID that has been supplied

# Delete OIDC config based on registered OIDC Config ID that has been supplied
	rosa delete oidc-config --oidc-config-id <oidc_config_id>

Delete OIDC provider for cluster named "mycluster"

# Delete OIDC provider for cluster named "mycluster"
  rosa delete oidc-provider --cluster=mycluster

Delete Operator roles for cluster named "mycluster"

# Delete Operator roles for cluster named "mycluster"
  rosa delete operator-roles --cluster=mycluster

Delete tuning config with name tuned1 from a cluster named 'mycluster'

# Delete tuning config with name tuned1 from a cluster named 'mycluster'
  rosa delete tuning-config --cluster=mycluster tuned1

Delete user role

# Delete user role
rosa delete user-role --role-arn {prefix}-User-{username}-Role

Describe an Access Request wit id <access_request_id>

# Describe an Access Request wit id <access_request_id>
  rosa describe access-request --id <access_request_id>

Describe an add-on named "codeready-workspaces"

# Describe an add-on named "codeready-workspaces"
  rosa describe addon codeready-workspaces

Describe the 'bar' add-on installation on cluster 'foo'

# Describe the 'bar' add-on installation on cluster 'foo'
  rosa describe addon-installation --cluster foo --addon bar

Describe cluster-admin user of a cluster named mycluster

# Describe cluster-admin user of a cluster named mycluster
  rosa describe admin -c mycluster

Describe the autoscaler for cluster 'foo'

# Describe the autoscaler for cluster 'foo'
rosa describe autoscaler --cluster foo

Show details of a break glass credential with ID "12345" on a cluster named "mycluster"

# Show details of a break glass credential with ID "12345" on a cluster named "mycluster"
  rosa describe break-glass-credential 12345 --cluster=mycluster

Describe a cluster named "mycluster"

# Describe a cluster named "mycluster"
  rosa describe cluster --cluster=mycluster

Show details of an external authentication provider named "exauth" on a cluster named "mycluster"

# Show details of an external authentication provider named "exauth" on a cluster named "mycluster"
  rosa describe external-auth-provider exauth --cluster=mycluster

Describe IAM role for service account

# Describe IAM role for service account
  rosa describe iamserviceaccount --cluster my-cluster \
    --name my-app \
    --namespace default

rosa describe ingress <ingress_id> -c mycluster

rosa describe ingress <ingress_id> -c mycluster

Describe the custom kubeletconfig for ROSA Classic cluster 'foo'

# Describe the custom kubeletconfig for ROSA Classic cluster 'foo'
  rosa describe kubeletconfig --cluster foo
  # Describe the custom kubeletconfig named 'bar' for cluster 'foo'
  rosa describe kubeletconfig --cluster foo --name bar

Show details of a machine pool named "mymachinepool" on a cluster named "mycluster"

# Show details of a machine pool named "mymachinepool" on a cluster named "mycluster"
  rosa describe machinepool --cluster=mycluster --machinepool=mymachinepool

Describe the 'tuned1' tuned config on cluster 'foo'

# Describe the 'tuned1' tuned config on cluster 'foo'
  rosa describe tuning-config --cluster foo tuned1

Describe an upgrade-policy"

# Describe an upgrade-policy"
  rosa describe upgrade

Download oc client tools

# Download oc client tools
  rosa download oc

Download rosa client tools

# Download rosa client tools
  rosa download rosa

Edit the parameters of the Red Hat OpenShift logging operator add-on installation

# Edit the parameters of the Red Hat OpenShift logging operator add-on installation
  rosa edit addon --cluster=mycluster cluster-logging-operator

Interactively edit an autoscaler to a cluster named "mycluster"

# Interactively edit an autoscaler to a cluster named "mycluster"
  rosa edit autoscaler --cluster=mycluster --interactive

  # Edit a cluster-autoscaler to skip nodes with local storage
  rosa edit autoscaler --cluster=mycluster --skip-nodes-with-local-storage

  # Edit a cluster-autoscaler with log verbosity of '3'
  rosa edit autoscaler --cluster=mycluster --log-verbosity 3

  # Edit a cluster-autoscaler with total CPU constraints
  rosa edit autoscaler --cluster=mycluster --min-cores 10 --max-cores 100

Edit a cluster named "mycluster" to make it private

# Edit a cluster named "mycluster" to make it private
  rosa edit cluster -c mycluster --private

  # Edit a cluster named "mycluster" to enable User Workload Monitoring
  rosa edit cluster -c mycluster --disable-workload-monitoring=false

  # Edit all options interactively
  rosa edit cluster -c mycluster --interactive

Update mirrors for image mirror with ID "abc123" on cluster "mycluster"

# Update mirrors for image mirror with ID "abc123" on cluster "mycluster"
  rosa edit image-mirror --cluster=mycluster abc123 \
    --mirrors=mirror.corp.com/team,backup.corp.com/team,new-mirror.corp.com/team

  # Alternative: using the --id flag
  rosa edit image-mirror --cluster=mycluster --id=abc123 \
    --mirrors=mirror.corp.com/team,backup.corp.com/team,new-mirror.corp.com/team

Make additional ingress with ID 'a1b2' private on a cluster named 'mycluster'

# Make additional ingress with ID 'a1b2' private on a cluster named 'mycluster'
  rosa edit ingress --private --cluster=mycluster a1b2

  # Update the router selectors for the additional ingress with ID 'a1b2'
  rosa edit ingress --label-match=foo=bar --cluster=mycluster a1b2

  # Update the default ingress using the sub-domain identifier
  rosa edit ingress --private=false --cluster=mycluster apps

  # Update the load balancer type of the apps2 ingress
  rosa edit ingress --lb-type=nlb --cluster=mycluster apps2

Edit a KubeletConfig to have a pod-pids-limit of 10000

# Edit a KubeletConfig to have a pod-pids-limit of 10000
  rosa edit kubeletconfig --cluster=mycluster --pod-pids-limit=10000
  # Edit a KubeletConfig named 'bar' to have a pod-pids-limit of 10000
  rosa edit kubeletconfig --cluster=mycluster --name=bar --pod-pids-limit=10000

Set 4 replicas on machine pool 'mp1' on cluster 'mycluster'

# Set 4 replicas on machine pool 'mp1' on cluster 'mycluster'
	rosa edit machinepool --replicas=4 --cluster=mycluster mp1
	# Enable autoscaling and Set 3-5 replicas on machine pool 'mp1' on cluster 'mycluster'
	rosa edit machinepool --enable-autoscaling --min-replicas=3 --max-replicas=5 --cluster=mycluster mp1
	# Set the node drain grace period to 1 hour on machine pool 'mp1' on cluster 'mycluster'
	rosa edit machinepool --node-drain-grace-period="1 hour" --cluster=mycluster mp1

Update the tuning config with name 'tuning-1' with the spec defined in file1

# Update the tuning config with name 'tuning-1' with the spec defined in file1
  rosa edit tuning-config --cluster=mycluster tuning-1 --spec-path file1

Add cluster-admin role to a user

# Add cluster-admin role to a user
  rosa grant user cluster-admin --user=myusername --cluster=mycluster

  # Grant dedicated-admins role to a user
  rosa grant user dedicated-admin --user=myusername --cluster=mycluster

Configure your AWS account to allow IAM (non-STS) ROSA clusters

# Configure your AWS account to allow IAM (non-STS) ROSA clusters
  rosa init

  # Configure a new AWS account using pre-existing OCM credentials
  rosa init --token=$OFFLINE_ACCESS_TOKEN

Add the CodeReady Workspaces add-on installation to the cluster

# Add the CodeReady Workspaces add-on installation to the cluster
  rosa install addon --cluster=mycluster codeready-workspaces

Link OCM role

# Link OCM role
  rosa link ocm-role --role-arn arn:aws:iam::123456789012:role/ManagedOpenshift-OCM-Role

Link user roles

# Link user roles
  rosa link user-role --role-arn arn:aws:iam::{accountid}:role/{prefix}-User-{username}-Role

List all Access Requests for cluster 'foo'

# List all Access Requests for cluster 'foo'
  rosa list access-request --cluster foo

List all account roles

# List all account roles
  rosa list account-roles

List all add-on installations on a cluster named "mycluster"

# List all add-on installations on a cluster named "mycluster"
  rosa list addons --cluster=mycluster

List all break glass credentials for a cluster named 'mycluster'"

# List all break glass credentials for a cluster named 'mycluster'"
  rosa list break-glass-credentials -c mycluster

List all clusters

# List all clusters
  rosa list clusters

List all DNS Domains tied to your organization ID"

# List all DNS Domains tied to your organization ID"
  rosa list dns-domain

List all external authentication providers for a cluster named 'mycluster'"

# List all external authentication providers for a cluster named 'mycluster'"
  rosa list external-auth-provider -c mycluster

List all OCP gates for OCP version

# List all OCP gates for OCP version
  rosa list gates --version 4.9

  # List all STS gates for OCP version
  rosa list gates --gate sts --version 4.9

  # List all OCP gates for OCP version
  rosa list gates --gate ocp --version 4.9

  # List available gates for cluster upgrade version
  rosa list gates -c <cluster_id> --version 4.9.15

List IAM roles for service accounts

# List IAM roles for service accounts
  rosa list iamserviceaccounts --cluster my-cluster

List all identity providers on a cluster named "mycluster"

# List all identity providers on a cluster named "mycluster"
  rosa list idps --cluster=mycluster

List all image mirrors on a cluster named "mycluster"

# List all image mirrors on a cluster named "mycluster"
  rosa list image-mirrors --cluster=mycluster

List all routes on a cluster named "mycluster"

# List all routes on a cluster named "mycluster"
  rosa list ingresses --cluster=mycluster

List all instance types

# List all instance types
	rosa list instance-types

List the kubeletconfigs for cluster 'foo'

# List the kubeletconfigs for cluster 'foo'
rosa list kubeletconfig --cluster foo

List all machine pools on a cluster named "mycluster"

# List all machine pools on a cluster named "mycluster"
  rosa list machinepools --cluster=mycluster

  # List machine pools showing all information
  rosa list machinepools --cluster=mycluster --all

List all ocm roles

# List all ocm roles
rosa list ocm-roles

List all OIDC Configurations tied to your organization ID"

# List all OIDC Configurations tied to your organization ID"
  rosa list oidc-config

List all oidc providers

# List all oidc providers
  rosa list oidc-providers

List all operator roles

# List all operator roles
  rosa list operator-roles

List all available regions

# List all available regions
  rosa list regions

List all tuning configuration for a cluster named 'mycluster'"

# List all tuning configuration for a cluster named 'mycluster'"
  rosa list tuning-configs -c mycluster

List all user roles

# List all user roles
rosa list user-roles

List all users on a cluster named "mycluster"

# List all users on a cluster named "mycluster"
  rosa list users --cluster=mycluster

List all OpenShift versions

# List all OpenShift versions
  rosa list versions

Login to the OpenShift API with an existing token generated from https://console.redhat.com/openshift/token/rosa

# Login to the OpenShift API with an existing token generated from https://console.redhat.com/openshift/token/rosa
  rosa login --token=$OFFLINE_ACCESS_TOKEN

Show install logs for a cluster named 'mycluster'

# Show install logs for a cluster named 'mycluster'
  rosa logs install --cluster=mycluster

  # Show uninstall logs for a cluster named 'mycluster'
  rosa logs uninstall --cluster=mycluster

Show last 100 install log lines for a cluster named "mycluster"

# Show last 100 install log lines for a cluster named "mycluster"
  rosa logs install mycluster --tail=100

  # Show install logs for a cluster using the --cluster flag
  rosa logs install --cluster=mycluster

Show last 100 uninstall log lines for a cluster named "mycluster"

# Show last 100 uninstall log lines for a cluster named "mycluster"
  rosa logs uninstall mycluster --tail=100

  # Show uninstall logs for a cluster using the --cluster flag
  rosa logs uninstall --cluster=mycluster

Register OIDC config

# Register OIDC config
	rosa register oidc-config

Revoke all break glass credentials

# Revoke all break glass credentials
  rosa revoke break-glass-credentials --cluster=mycluster

Revoke cluster-admin role from a user

# Revoke cluster-admin role from a user
  rosa revoke user cluster-admins --user=myusername --cluster=mycluster

  # Revoke dedicated-admin role from a user
  rosa revoke user dedicated-admins --user=myusername --cluster=mycluster

Remove the CodeReady Workspaces add-on installation from the cluster

# Remove the CodeReady Workspaces add-on installation from the cluster
  rosa uninstall addon --cluster=mycluster codeready-workspaces

#Unlink ocm role
rosa unlink ocm-role --role-arn arn:aws:iam::123456789012:role/ManagedOpenshift-OCM-Role

#Unlink ocm role
rosa unlink ocm-role --role-arn arn:aws:iam::123456789012:role/ManagedOpenshift-OCM-Role

Unlink user role

# Unlink user role
rosa unlink user-role --role-arn arn:aws:iam::{accountid}:role/{prefix}-User-{username}-Role

Upgrade account roles for ROSA STS clusters

# Upgrade account roles for ROSA STS clusters
  rosa upgrade account-roles

Interactively schedule an upgrade on the cluster named "mycluster"

# Interactively schedule an upgrade on the cluster named "mycluster"
  rosa upgrade cluster --cluster=mycluster --interactive

  # Schedule a cluster upgrade within the hour
  rosa upgrade cluster -c mycluster --version 4.12.20

  # Check if any gates need to be acknowledged prior to attempting an upgrading
  rosa upgrade cluster -c mycluster --version 4.12.20 --dry-run

Interactively schedule an upgrade on the cluster named "mycluster"" for a machinepool named "np1"

# Interactively schedule an upgrade on the cluster named "mycluster"" for a machinepool named "np1"
  rosa upgrade machinepool np1 --cluster=mycluster --interactive

  # Schedule a machinepool upgrade within the hour
  rosa upgrade machinepool np1 -c mycluster --version 4.12.20

Upgrade cluster-specific operator IAM roles

# Upgrade cluster-specific operator IAM roles
  rosa upgrade operators-roles

Upgrade cluster roles for ROSA STS clusters

# Upgrade cluster roles for ROSA STS clusters
		rosa upgrade roles -c <cluster_key>

Verify two subnets

# Verify two subnets
	rosa verify network --subnet-ids subnet-03046a9b92b5014fb,subnet-03046a9c92b5014fb

Verify oc client tools

# Verify oc client tools
  rosa verify oc

Verify AWS permissions are configured correctly

# Verify AWS permissions are configured correctly
  rosa verify permissions

  # Verify AWS permissions in a different region
  rosa verify permissions --region=us-west-2

Verify AWS quotas are configured correctly

# Verify AWS quotas are configured correctly
  rosa verify quota

  # Verify AWS quotas in a different region
  rosa verify quota --region=us-west-2

Verify rosa client tools

# Verify rosa client tools
  rosa verify rosa

Displays user information

# Displays user information
  rosa whoami

rosa create oidc-config --mode auto

$ rosa create oidc-config --mode auto

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CreateOidcConfig",
            "Effect": "Allow",
            "Action": [
                "iam:TagOpenIDConnectProvider",
                "iam:CreateOpenIDConnectProvider"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CreateOidcConfig",
            "Effect": "Allow",
            "Action": [
                "iam:TagOpenIDConnectProvider",
                "iam:CreateOpenIDConnectProvider"
            ],
            "Resource": "*"
        }
    ]
}

rosa create oidc-config --mode auto --managed=false

$ rosa create oidc-config --mode auto --managed=false

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:TagOpenIDConnectProvider",
                "iam:ListRoleTags",
                "iam:ListRoles",
                "iam:CreateOpenIDConnectProvider",
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:PutBucketTagging",
                "s3:PutBucketPolicy",
                "s3:PutObjectTagging",
                "s3:PutBucketPublicAccessBlock",
                "secretsmanager:CreateSecret",
                "secretsmanager:TagResource"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:TagOpenIDConnectProvider",
                "iam:ListRoleTags",
                "iam:ListRoles",
                "iam:CreateOpenIDConnectProvider",
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:PutBucketTagging",
                "s3:PutBucketPolicy",
                "s3:PutObjectTagging",
                "s3:PutBucketPublicAccessBlock",
                "secretsmanager:CreateSecret",
                "secretsmanager:TagResource"
            ],
            "Resource": "*"
        }
    ]
}

rosa list account-roles

$ rosa list account-roles

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListAccountRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoleTags",
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListAccountRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoleTags",
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

rosa list operator-roles

$ rosa list operator-roles