Chapter 8. ROSA CLI

--client-id

The OpenID client identifier (string). Default: cloud-services

--client-secret

The OpenID client secret (string).

--insecure

Enables insecure communication with the server. This disables verification of TLS certificates and host names.

--scope

The OpenID scope (string). If this option is used, it replaces the default scopes. This can be repeated multiple times to specify multiple scopes. Default: openid

--token

Accesses or refreshes the token (string).

--token-url

The OpenID token URL (string). Default: https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--region

The AWS region (string) in which to run the command. This value overrides the AWS_REGION environment variable.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--region

The AWS region (string) in which to run the command. This value overrides the AWS_REGION environment variable.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--help

Shows help for this command.

--debug

Enables debug mode.

--help

Shows help for this command.

--debug

Enables debug mode.

--region

The AWS region (string) in which to verify quota and permissions. This value overrides the AWS_REGION environment variable only when running the init command, but it does not change your AWS CLI configuration.

--delete

Deletes the stack template that is applied to your AWS account during the init command.

--client-id

The OpenID client identifier (string). Default: cloud-services

--client-secret

The OpenID client secret (string).

--insecure

Enables insecure communication with the server. This disables verification of TLS certificates and host names.

--scope

The OpenID scope (string). If this option is used, it completely replaces the default scopes. This can be repeated multiple times to specify multiple scopes. Default: openid

--token

Accesses or refreshes the token (string).

--token-url

The OpenID token URL (string). Default: https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--debug

Enable debug mode.

-i, --interactive

Enable interactive mode.

-m, --mode string

How to perform the operation. Valid options are:

--path string

The Amazon Resource Name (ARN) path for the account-wide roles and policies, including the Operator policies.

--permissions-boundary string

The ARN of the policy that is used to set the permissions boundary for the account roles.

--prefix string

User-defined prefix for all generated AWS resources. The default is ManagedOpenShift.

--profile string

Use a specific AWS profile from your credential file.

-y, --yes

Automatically answer yes to confirm operations.

--cluster <cluster_name>|<cluster_id>

Required. The name or ID (string) of the cluster to add to the identity provider (IDP).

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile string

Specifies an AWS profile from your credentials file.

--cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster to which the break glass credential will be added.

--expiration

Optional: How long a break glass credential can be used before expiring. The expiration duration must be a minimum of 10 minutes and a maximum of 24 hours. If you do not enter a value, the expiration duration defaults to 24 hours.

--username

Optional. The username for the break glass credential. If you do not enter a value, a random username is generated for you.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--region

Specifies an AWS region, overriding the AWS_REGION environment variable.

--yes

Automatically answers yes to confirm the operation.

--additional-compute-security-group-ids <sec_group_id>

The identifier of one or more additional security groups to use along with the default security groups that are used with the standard machine pool created alongside the cluster. For more information on additional security groups, see the requirements for Security groups under Additional resources.

--additional-infra-security-group-ids <sec_group_id>

The identifier of one or more additional security groups to use along with the default security groups that are used with the infra nodes created alongside the cluster. For more information on additional security groups, see the requirements for Security groups under Additional resources.

--additional-control-plane-security-group-ids <sec_group_id>

The identifier of one or more additional security groups to use along with the default security groups that are used with the control plane nodes created alongside the cluster. For more information on additional security groups, see the requirements for Security groups under Additional resources.

--additional-allowed-principals <arn>

A comma-separated list of additional allowed principal ARNs to be added to the hosted control plane’s VPC endpoint service to enable additional VPC endpoint connection requests to be automatically accepted.

--cluster-name <cluster_name>

Required. The name of the cluster. When used with the create cluster command, this argument is used to set the cluster name and can hold up to 54 characters. The value for this argument must be unique within your organization.

--compute-machine-type <instance_type>

The instance type for compute nodes in the cluster. This determines the amount of memory and vCPU that is allocated to each compute node. For more information on valid instance types, see AWS Instance types in ROSA service definition.

--controlplane-iam-role <arn>

The ARN of the IAM role to attach to control plane instances.

--create-cluster-admin

Optional. As part of cluster creation, create a local administrator user (cluster-admin) for your cluster. This automatically configures an htpasswd identity provider for the cluster-admin user. Optionally, use the --cluster-admin-user and --cluster-admin-password options to specify the username and password for the administrator user. Omitting these options automatically generates the credentials and displays their values as terminal output.

--cluster-admin-user

Optional. Specifies the user name of the cluster administrator user created when used in conjunction with the --create-cluster-admin option.

--cluster-admin-password

Optional. Specifies the password of the cluster administrator user created when used in conjunction with the --create-cluster-admin option.

--disable-scp-checks

Indicates whether cloud permission checks are disabled when attempting to install a cluster.

--dry-run

Simulates creating the cluster.

--domain-prefix

Optional: When used with the create cluster command, this argument sets the subdomain for your cluster on *.openshiftapps.com. The value for this argument must be unique within your organization, cannot be longer than 15 characters, and cannot be changed after cluster creation. If the argument is not supplied, an autogenerated value is created that depends on the length of the cluster name. If the cluster name is fewer than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated to a 15 character string.

--ec2-metadata-http-tokens string

Configures the use of IMDSv2 for EC2 instances. Valid values are optional (default) or required.

--enable-autoscaling

Enables autoscaling of compute nodes. By default, autoscaling is set to 2 nodes. To set non-default node limits, use this argument with the --min-replicas and --max-replicas arguments.

--etcd-encryption

Enables encryption of ETCD key-values on Red Hat OpenShift Service on AWS (classical architecture) clusters.

--etcd-encryption-kms-arn

Enables encryption of ETCD storage using the customer-managed key managed in AWS Key Management Service.

--host-prefix <subnet>

The subnet prefix length to assign to each individual node, as an integer. For example, if host prefix is set to 23, then each node is assigned a /23 subnet out of the given CIDR.

--machine-cidr <address_block>

Block of IP addresses (ipNet) used by ROSA while installing the cluster, for example, 10.0.0.0/16.

--max-replicas <number_of_nodes>

Specifies the maximum number of compute nodes when enabling autoscaling. Default: 2

--min-replicas <number_of_nodes>

Specifies the minimum number of compute nodes when enabling autoscaling. Default: 2

--multi-az

Deploys to multiple data centers.

--no-cni

Creates a cluster without a Container Network Interface (CNI) plugin. Customers can then bring their own CNI plugin and install it after cluster creation.

--operator-roles-prefix <string>

Prefix that are used for all IAM roles used by the operators needed in the OpenShift installer. A prefix is generated automatically if you do not specify one.

--pod-cidr <address_block>

Block of IP addresses (ipNet) from which pod IP addresses are allocated, for example, 10.128.0.0/14.

--private

Restricts primary API endpoint and application routes to direct, private connectivity.

--private-link

Specifies to use AWS PrivateLink to provide private connectivity between VPCs and services. The --subnet-ids argument is required when using --private-link.

--region <region_name>

The name of the AWS region where your worker pool will be located, for example, us-east-1. This argument overrides the AWS_REGION environment variable.

--replicas n

The number of worker nodes to provision per availability zone. Single-zone clusters require at least 2 nodes. Multi-zone clusters require at least 3 nodes. Default: 2 for single-zone clusters; 3 for multi-zone clusters.

--role-arn <arn>

The ARN of the installer role that OpenShift Cluster Manager uses to create the cluster. This is required if you have not already created account roles.

--service-cidr <address_block>

Block of IP addresses (ipNet) for services, for example, 172.30.0.0/16.

--sts | --non-sts

Specifies whether to use AWS Security Token Service (STS) or IAM credentials (non-STS) to deploy your cluster.

--subnet-ids <aws_subnet_id>

The AWS subnet IDs that are used when installing the cluster, for example, subnet-01abc234d5678ef9a. Subnet IDs must be in pairs with one private subnet ID and one public subnet ID per availability zone. Subnets are comma-delimited, for example, --subnet-ids=subnet-1,subnet-2. Leave the value empty for installer-provisioned subnet IDs.

When using --private-link, the --subnet-ids argument is required and only one private subnet is allowed per zone.

--support-role-arn string

The ARN of the role used by Red Hat Site Reliability Engineers (SREs) to enable access to the cluster account to provide support.

--tags

Tags that are used on resources created by Red Hat OpenShift Service on AWS in AWS. Tags can help you manage, identify, organize, search for, and filter resources within AWS. Tags are comma separated, for example: "key value, foo bar".

--version string

The version of ROSA that will be used to install the cluster or cluster resources. For cluster use an X.Y.Z format, for example, 4.17.0. For account-role use an X.Y format, for example, 4.17.

--worker-iam-role string

The ARN of the IAM role that will be attached to compute instances.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--claim-mapping-groups-claim <string>

Required. Describes rules on how to transform information from an ID token into a cluster identity.

--claim-validation-rule <strings>

Rules that are applied to validate token claims to authenticate users. The input will be in a <claim>:<required_value> format. To have multiple claim validation rules, you can separate the values by ,. For example, <claim>:<required_value>,<claim>:<required_value>.

--claim-mapping-username-claim <string>

The name of the claim that should be used to construct user names for the cluster identity.

--cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster to which the IDP will be added.

--console-client-id <string>

The identifier of the OIDC client from the OIDC provider for the OpenShift Cluster Manager web console.

--console-client-secret <string>

The secret that is associated with the console application registration.

--issuer-audiences <strings>

An array of audiences to check the incoming tokens against. Valid tokens must include at least one of these values in their audience claim.

--issuer-ca-file <string>

The path to the PEM-encoded certificate file to use when making requests to the server.

--issuer-url <string>

The serving URL of the token issuer.

--name <string>

A name that is used to refer to the external authentication provider.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile string from your credentials file.

--cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster to which the IDP will be added.

--ca <path_to_file>

The path to the PEM-encoded certificate file to use when making requests to the server, for example, /usr/share/cert.pem.

--client-id

The client ID (string) from the registered application.

--client-secret

The client secret (string) from the registered application.

--mapping-method

Specifies how new identities (string) are mapped to users when they log in. Default: claim

--name

The name (string) for the identity provider.

--type

The type (string) of identity provider. Options: github, gitlab, google, ldap, openid

--hostname

The optional domain (string) that are used with a hosted instance of GitHub Enterprise.

--organizations

Specifies the organizations for login access. Only users that are members of at least one of the listed organizations (string) are allowed to log in.

--teams

Specifies the teams for login access. Only users that are members of at least one of the listed teams (string) are allowed to log in. The format is <org>/<team>.

--host-url

The host URL (string) of a GitLab provider. Default: https://gitlab.com

--hosted-domain

Restricts users to a Google Apps domain (string).

--bind-dn

The domain name (string) to bind with during the search phase.

--bind-password

The password (string) to bind with during the search phase.

--email-attributes

The list (string) of attributes whose values should be used as the email address.

--id-attributes

The list (string) of attributes whose values should be used as the user ID. Default: dn

--insecure

Does not make TLS connections to the server.

--name-attributes

The list (string) of attributes whose values should be used as the display name. Default: cn

--url

An RFC 2255 URL (string) which specifies the LDAP search parameters that are used.

--username-attributes

The list (string) of attributes whose values should be used as the preferred username. Default: uid

--email-claims

The list (string) of claims that are used as the email address.

--extra-scopes

The list (string) of scopes to request, in addition to the openid scope, during the authorization token request.

--issuer-url

The URL (string) that the OpenID provider asserts as the issuer identifier. It must use the HTTPS scheme with no URL query parameters or fragment.

--name-claims

The list (string) of claims that are used as the display name.

--username-claims

The list (string) of claims that are used as the preferred username when provisioning a user.

--groups-claims

The list (string) of claims that are used as the groups names.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster <cluster_name>|<cluster_id>

Required: The name or ID of the cluster to which the ingress will be added.

--label-match

The label match (string) for ingress. The format must be a comma-delimited list of key=value pairs. If no label is specified, all routes are exposed on both routers.

--private

Restricts application route to direct, private connectivity.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--pod-pids-limit <number>

Required. The maximum number of PIDs for each node in the machine pool associated with the KubeletConfig object.

-c, --cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster in which to create the KubeletConfig object.

--name

Required for Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters. Optional for Red Hat OpenShift Service on AWS, as there is only one KubeletConfig for the cluster. Specifies a name for the KubeletConfig object.

-i, --interactive

Enable interactive mode.

-h, --help

Shows help for this command.

--additional-security-group-ids <sec_group_id>

The identifier of one or more additional security groups to use along with the default security groups for this machine pool. For more information on additional security groups, see the requirements for Security groups under Additional resources.

--cluster <cluster_name>|<cluster_id>

Required: The name or ID of the cluster to which the machine pool will be added.

--disk-size

Set the disk volume size for the machine pool, in Gib or TiB. The default is 300 GiB.

For ROSA (classic architecture) clusters version 4.13 or earlier, the minimum disk size is 128 GiB, and the maximum is 1 TiB. For cluster version 4.14 and later, the minimum is 128 GiB, and the maximum is 16 TiB.

For ROSA with HCP clusters, the minimum disk size is 75 GiB, and the maximum is 16,384 GiB.

--enable-autoscaling

Enable or disable autoscaling of compute nodes. To enable autoscaling, use this argument with the --min-replicas and --max-replicas arguments. To disable autoscaling, use --enable-autoscaling=false with the --replicas argument.

--instance-type

The instance type (string) that should be used. Default: m5.xlarge

--kubelet-configs <kubeletconfig_name>

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the names of any KubeletConfig objects to apply to nodes in a machine pool.

--labels

The labels (string) for the machine pool. The format must be a comma-delimited list of key=value pairs. This list overwrites any modifications made to node labels on an ongoing basis.

--max-replicas

Specifies the maximum number of compute nodes when enabling autoscaling.

--min-replicas

Specifies the minimum number of compute nodes when enabling autoscaling.

--max-surge

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the max-surge parameter defines the number of new nodes that can be provisioned in excess of the desired number of replicas for the machine pool, as configured using the --replicas parameter, or as determined by the autoscaler when autoscaling is enabled. This can be an absolute number (for example, 2) or a percentage of the machine pool size (for example, 20%), but must use the same unit as the max-unavailable parameter.

The default value is 1, meaning that the maximum number of nodes in the machine pool during an upgrade is 1 plus the desired number of replicas for the machine pool. In this situation, one excess node can be provisioned before existing nodes need to be made unavailable. The number of nodes that can be provisioned simultaneously during an upgrade is max-surge plus max-unavailable.

--max-unavailable

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the max-unavailable parameter defines the number of nodes that can be made unavailable in a machine pool during an upgrade, before new nodes are provisioned. This can be an absolute number (for example, 2) or a percentage of the current replica count in the machine pool (for example, 20%), but must use the same unit as the max-surge parameter.

The default value is 0, meaning that no outdated nodes are removed before new nodes are provisioned. The valid range for this value is from 0 to the current machine pool size, or from 0% to 100%. The total number of nodes that can be upgraded simultaneously during an upgrade is max-surge plus max-unavailable.

--name

Required: The name (string) for the machine pool.

--replicas

Required when autoscaling is not configured. The number (integer) of machines for this machine pool.

--tags

Apply user defined tags to all resources created by ROSA in AWS. Tags are comma separated, for example: 'key value, foo bar'.

--taints

Taints for the machine pool. This string value should be formatted as a comma-separated list of key=value:ScheduleType. This list will overwrite any modifications made to Node taints on an ongoing basis.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

<template-name>

Allows you to use a custom template. Templates must be in the template folder, structured as templates/<template-name>/cloudformation.yaml. If no template name is provided, the command uses the default template. For binary builds, this template directory must be referenced manually after it is downloaded.

--template-dir

Allows you to specify the path to the template directory. Overrides the OCM_TEMPLATE_DIR environment variable. Required if not running the command inside the template directory.

--param Name

Define the name of your network. A required parameter when using a custom template file.

--param Region

Define the region of your network. A required parameter when using a custom template file.

--param <various>

Available parameters depend on the template. Use --help when in the template directory to find available parameters.

--mode=manual

Provides AWS commands to create the network stack.

--admin

Enable admin capabilities for the role.

--debug

Enable debug mode.

-i, --interactive

Enable interactive mode.

-m, --mode string

How to perform the operation. Valid options are:

--path string

The ARN path for the OCM role and policies.

--permissions-boundary string

The ARN of the policy that is used to set the permissions boundary for the OCM role.

--prefix string

User-defined prefix for all generated AWS resources. The default is ManagedOpenShift.

--profile string

Use a specific AWS profile from your credential file.

-y, --yes

Automatically answer yes to confirm operation.

--debug

Enable debug mode.

-i, --interactive

Enable interactive mode.

-m, --mode string

How to perform the operation. Valid options are:

--path string

The ARN path for the user role and policies.

--permissions-boundary string

The ARN of the policy that is used to set the permissions boundary for the user role.

--prefix string

User-defined prefix for all generated AWS resources The default is ManagedOpenShift.

--profile string

Use a specific AWS profile from your credential file.

-y, --yes

Automatically answer yes to confirm operation.

--additional-allowed-principals <arn>

A comma-separated list of additional allowed principal ARNs to be added to the Hosted Control Plane’s VPC endpoint service to enable additional VPC endpoint connection requests to be automatically accepted.

--cluster

Required: The name or ID (string) of the cluster to edit.

--private

Restricts a primary API endpoint to direct, private connectivity.

--enable-delete-protection=true

Enables the delete protection feature.

--enable-delete-protection=false

Disables the delete protection feature.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster to which the ingress will be added.

--cluster-routes-hostname

Components route hostname for OAuth, console, and download.

--cluster-routes-tls-secret-ref

Components route TLS secret reference for OAuth, console, and download.

--excluded-namespaces

Excluded namespaces for ingress. Format is a comma-separated list value1, value2…​. If no values are specified, all namespaces will be exposed.

--label-match

The label match (string) for ingress. The format must be a comma-delimited list of key=value pairs. If no label is specified, all routes are exposed on both routers.

--lb-type

Type of Load Balancer. Options are classic, nlb.

--namespace-ownership-policy

Namespace Ownership Policy for ingress. Options are Strict and InterNamespaceAllowed. Default is Strict.

--private

Restricts the application route to direct, private connectivity.

--route-selector

Route Selector for ingress. Format is a comma-separated list of key=value. If no label is specified, all routes will be exposed on both routers. For legacy ingress support these are inclusion labels, otherwise they are treated as exclusion label.

--wildcard-policy

Wildcard Policy for ingress. Options are WildcardsDisallowed and WildcardsAllowed. Default is WildcardsDisallowed.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

-c, --cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster for which the KubeletConfig object will be edited.

-i, --interactive

Enable interactive mode.

--pod-pids-limit <number>

Required. The maximum number of PIDs for each node in the machine pool associated with the KubeletConfig object.

--name

Required for Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters. Optional for Red Hat OpenShift Service on AWS, as there is only one KubeletConfig for the cluster. Specifies a name for the KubeletConfig object.

-h, --help

Shows help for this command.

--cluster

Required: The name or ID (string) of the cluster to edit on which the additional machine pool will be edited.

--enable-autoscaling

Enable or disable autoscaling of compute nodes. To enable autoscaling, use this argument with the --min-replicas and --max-replicas arguments. To disable autoscaling, use --enable-autoscaling=false with the --replicas argument.

--labels

The labels (string) for the machine pool. The format must be a comma-delimited list of key=value pairs. Editing this value only affects newly created nodes of the machine pool, which are created by increasing the node number, and does not affect the existing nodes. This list overwrites any modifications made to node labels on an ongoing basis.

--kubelet-configs <kubeletconfig_name>

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the names of any KubeletConfig objects to apply to nodes in a machine pool.

--max-replicas

Specifies the maximum number of compute nodes when enabling autoscaling.

--min-replicas

Specifies the minimum number of compute nodes when enabling autoscaling.

--max-surge

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the max-surge parameter defines the number of new nodes that can be provisioned in excess of the desired number of replicas for the machine pool, as configured using the --replicas parameter, or as determined by the autoscaler when autoscaling is enabled. This can be an absolute number (for example, 2) or a percentage of the machine pool size (for example, 20%), but must use the same unit as the max-unavailable parameter.

The default value is 1, meaning that the maximum number of nodes in the machine pool during an upgrade is 1 plus the desired number of replicas for the machine pool. In this situation, one excess node can be provisioned before existing nodes need to be made unavailable. The number of nodes that can be provisioned simultaneously during an upgrade is max-surge plus max-unavailable.

--max-unavailable

For Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, the max-unavailable parameter defines the number of nodes that can be made unavailable in a machine pool during an upgrade, before new nodes are provisioned. This can be an absolute number (for example, 2) or a percentage of the current replica count in the machine pool (for example, 20%), but must use the same unit as the max-surge parameter.

The default value is 0, meaning that no outdated nodes are removed before new nodes are provisioned. The valid range for this value is from 0 to the current machine pool size, or from 0% to 100%. The total number of nodes that can be upgraded simultaneously during an upgrade is max-surge plus max-unavailable.

--node-drain-grace-period

Specifies the node drain grace period when upgrading or replacing the machine pool. (This is for ROSA with HCP clusters only.)

--replicas

Required when autoscaling is not configured. The number (integer) of machines for this machine pool.

--taints

Taints for the machine pool. This string value should be formatted as a comma-separated list of key=value:ScheduleType. Editing this value only affect newly created nodes of the machine pool, which are created by increasing the node number, and does not affect the existing nodes. This list overwrites any modifications made to Node taints on an ongoing basis.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster to add to the identity provider (IDP).

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster to delete.

--watch

Watches the cluster uninstallation logs.

--best-effort

Skips steps in the cluster destruction chain that are known to cause the cluster deletion process to fail. You should use this option with care and it is recommended that you manually check your AWS account for any resources that might be left over after using --best-effort.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required. The name or ID string of the cluster the external auth provider will be deleted from.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile string from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster from which the IDP will be deleted.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster from which the ingress will be deleted.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

-c, --cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster for which you want to delete the KubeletConfig object.

-h, --help

Shows help for this command.

--name

Required for Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters. Optional for Red Hat OpenShift Service on AWS, as there is only one KubeletConfig for the cluster. Specifies a name for the KubeletConfig object.

-y, --yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster that the machine pool will be deleted from.

--help

Shows help for this command.

--debug

Enables debug mode.

--interactive

Enables interactive mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster where the add-on will be installed.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Uses a specific AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster that the add-on will be uninstalled from.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Uses a specific AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster to list the add-ons for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster to which the break glass credentials have been added.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--count

The number (integer) of clusters to display. Default: 100

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID string of the cluster that the external authentication provider will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile string from your credentials file.

--cluster

Required: The name or ID (string) of the cluster that the IDPs will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster that the IDPs will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--output

The output format. Allowed formats are json or yaml.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster that the machine pools will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--cluster

Required: The name or ID (string) of the cluster that the machine pools will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--multi-az

Lists regions that provide support for multiple availability zones.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster that the available upgrades will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster that the cluster administrators will be listed for.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster to which the cluster-admin belongs.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster.

--id

Required: The ID (string) of the break glass credential.

--kubeconfig

Optional: Retrieves the kubeconfig from the break glass credential.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--get-role-policy-bindings

Lists the policies that are attached to the STS roles assigned to the cluster.

-c, --cluster <cluster_name>|<cluster_id>

Required. The name or ID of the cluster for which you want to view the KubeletConfig object.

-h, --help

Shows help for this command.

--name

Optional. Specifies the name of the KubeletConfig object to describe.

-o, --output string

-o, --output string

--cluster

Required: The name or ID (string) of the cluster.

--machinepool

Required: The name or ID (string) of the machinepool.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster from which the break glass credentials will be deleted.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster that the upgrade will be scheduled for.

--interactive

Enables interactive mode.

--version

The version (string) of OpenShift Container Platform that the cluster will be upgraded to.

--schedule-date

The next date (string) when the upgrade will run at the specified time in Coordinated Universal Time (UTC). Format: yyyy-mm-dd

--schedule-time

The next time the upgrade will run on the specified date in Coordinated Universal Time (UTC). Format: HH:mm

--node-drain-grace-period ^[1]

Sets a grace period (string) for how long the pod disruption budget-protected workloads are respected during upgrades. After this grace period, any workloads protected by pod disruption budgets that have not been successfully drained from a node will be forcibly evicted. Default: 1 hour

--control-plane ^[2]

Upgrades the cluster’s hosted control plane.

--help

Shows help for this command.

--cluster

Required: The name or ID (string) of the cluster that the upgrade will be cancelled for.

--help

Shows help for this command.

--debug

Enables debug mode.

--yes

Automatically answers yes to confirm the operation.

--cluster

Required: The name or ID (string) of the cluster.

--schedule-date

The next date (string) when the upgrade will run at the specified time in Coordinated Universal Time (UTC). Format: yyyy-mm-dd

--schedule-time

The next time the upgrade will run on the specified date in Coordinated Universal Time (UTC). Format: HH:mm

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.

--cluster

Required: The name or ID (string) of the cluster.

--help

Shows help for this command.

--debug

Enables debug mode.

--profile

Specifies an AWS profile (string) from your credentials file.