7.2. roxctl central
Commands related to the Central service.
Usage
$ roxctl central [command] [flags]| Command | Description |
|---|---|
|
| Create a backup of the Red Hat Advanced Cluster Security for Kubernetes (RHACS) database and the certificates. |
|
| Download the certificate chain for the Central service. |
|
| Generate a cluster registration secret (CRS) that allows communication between Central and secured clusters for the initial setup, to retrieve a list of CRSes, or to revoke a CRS. |
|
| Control the database operations. |
|
| Debug the Central service. |
|
| Generate the required YAML configuration files containing the orchestrator objects for the deployment of Central. |
|
| Initialize bundles for Central. |
|
| Log in to the Central instance to obtain a token. |
|
| Manage the user certificate authorization providers. |
|
| Display information about the current user and their authentication method. |
The roxctl central command supports the following options inherited from the parent roxctl command:
| Option | Description |
|---|---|
|
|
Specify a custom CA certificate file path for secure connections. Alternatively, you can specify the file path by using the |
|
|
Set |
|
|
Set the endpoint for the service to contact. Alternatively, you can set the endpoint by using the |
|
|
Force the use of HTTP/1 for all connections. Alternatively, by setting the |
|
|
Enable insecure connection options. Alternatively, by setting the |
|
|
Skip the TLS certificate validation. Alternatively, by setting the |
|
|
Disable the color output. Alternatively, by setting the |
|
|
Specify the password for basic authentication. Alternatively, you can set the password by using the |
|
|
Use an unencrypted connection. Alternatively, by setting the |
|
|
Set the TLS server name to use for SNI. Alternatively, you can set the server name by using the |
|
|
Use the API token provided in the specified file for authentication. Alternatively, you can set the token by using the |
These options are applicable to all the sub-commands of the roxctl central command.
7.2.2. roxctl central backup
Create a backup of the RHACS database and certificates.
Usage
$ roxctl central backup [flags]| Option | Description |
|---|---|
|
|
Specify to only back up the certificates. When using an external database, this option is used to generate a backup bundle with certificates. The default value is |
|
| Specify where you want to save the backup. The behavior depends on the specified path:
|
|
|
Specify the timeout for API requests. It represents the maximum duration of a request. The default value is |
7.2.3. roxctl central cert
Download the certificate chain for the Central service.
Usage
$ roxctl central cert [flags]| Option | Description |
|---|---|
|
|
Specify the file name to which you want to save the PEM certificate. Use |
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.4. roxctl central crs
Manage cluster registration secrets that allow communication between Central and secured clusters for the initial setup.
Cluster registration secrets is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.
Usage
$ roxctl central crs [command] [flags]For available flags, see "roxctl central command options inherited from the parent command".
7.2.4.1. roxctl central crs generate
Generate a cluster registration secret (CRS) that allows communication between Central and secured clusters for the initial setup.
Usage
$ roxctl central crs generate <crs name> [flags]For available flags, see "roxctl central command options inherited from the parent command".
7.2.4.2. roxctl central crs list
Generate a list of previously generated cluster registration secrets that allow communication between Central and secured clusters for the initial setup.
Usage
$ roxctl central crs list [flags]For available flags, see "roxctl central command options inherited from the parent command".
7.2.4.3. roxctl central crs revoke
Revoke a cluster registration secret (CRS) that allows communication between Central and secured clusters for the initial setup.
Usage
$ roxctl central crs revoke <CRS unique identifier or name> [flags]For available flags, see "roxctl central command options inherited from the parent command".
7.2.5. roxctl central login
Login to the Central instance to obtain a token.
Usage
$ roxctl central login [flags]| Option | Description |
|---|---|
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.6. roxctl central whoami
Display information about the current user and their authentication method.
Usage
$ roxctl central whoami [flags]| Option | Description |
|---|---|
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.7. roxctl central db
Control the database operations.
Usage
$ roxctl central db [flags]| Option | Description |
|---|---|
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.7.1. roxctl central db restore
Restore the RHACS database from a previous backup.
Usage
$ roxctl central db restore <file> [flags]where:
<file>- Specifies the database backup file that you want to restore.
| Option | Description |
|---|---|
|
|
If set to |
|
|
If set to |
7.2.7.2. roxctl central db generate
Generate a Central database bundle.
Usage
$ roxctl central db generate [flags]| Option | Description |
|---|---|
|
|
If set to |
|
|
Specify the path to the Helm templates in your local file system. For more details, run the |
|
|
If set to |
7.2.7.3. roxctl central db generate k8s
Generate Kubernetes YAML files for deploying Central’s database components.
Usage
$ roxctl central db generate k8s [flags]| Option | Description |
|---|---|
|
|
Specify the Central database image that you want to use. If not specified, a default value corresponding to the |
|
|
Specify the default settings for container images. It controls the repositories from which the images are downloaded, the image names and the format of the tags. The default value is |
|
|
Specify the directory to which you want to save the deployment bundle. The default value is |
7.2.7.4. roxctl central db restore cancel
Cancel the ongoing Central database restore process.
Usage
$ roxctl central db restore cancel [flags]| Option | Description |
|---|---|
|
|
If set to |
7.2.7.5. roxctl central db restore status
Display information about the ongoing database restore process.
Usage
$ roxctl central db restore status [flags]7.2.7.6. roxctl central db generate k8s pvc
Generate Kubernetes YAML files for persistent volume claims (PVCs) in Central.
Usage
$ roxctl central db generate k8s pvc [flags]| Option | Description |
|---|---|
|
|
Specify the external volume name for the Central database. The default value is |
|
|
Specify the external volume size in gigabytes for the Central database. The default value is |
|
| Specify the storage class name for the Central database. This is optional if you have a default storage class configured. |
7.2.7.7. roxctl central db generate openshift
Generate an OpenShift YAML manifest for deploying a Central database instance on a Red Hat OpenShift cluster.
Usage
$ roxctl central db generate openshift [flags]| Option | Description |
|---|---|
|
|
Specify the Central database image that you want to use. If not specified, a default value corresponding to the |
|
|
Specify the default settings for container images. It controls the repositories from which the images are downloaded, the image names and the format of the tags. The default value is |
|
|
Specify the Red Hat OpenShift major version 3 or 4 for the deployment. The default value is |
|
|
Specify the directory to which you want to save the deployment bundle. The default value is |
7.2.7.8. roxctl central db generate k8s hostpath
Generate a Kubernetes YAML manifest for a database deployment with a hostpath volume type in Central.
Usage
$ roxctl central db generate k8s hostpath [flags]| Option | Description |
|---|---|
|
|
Specify the path on the host. The default value is |
|
|
Specify the node selector key. Valid values include |
|
| Specify the node selector value. |
7.2.7.9. roxctl central db generate openshift pvc
Generate an OpenShift YAML manifest for a database deployment with a persistent volume claim (PVC) in Central.
Usage
$ roxctl central db generate openshift pvc [flags]| Option | Description |
|---|---|
| --name string |
Specify the external volume name for the Central database. The default value is |
| --size uint32 |
Specify the external volume size in gigabytes for the Central database. The default value is |
| --storage-class string | Specify the storage class name for the Central database. This is optional if you have a default storage class configured. |
7.2.7.10. roxctl central db generate openshift hostpath
Add a hostpath external volume to the Central database.
Usage
$ roxctl central db generate openshift hostpath [flags]| Option | Description |
|---|---|
|
|
Specify the path on the host. The default value is |
|
|
Specify the node selector key. Valid values include |
|
| Specify the node selector value. |
7.2.8. roxctl central debug
Debug the Central service.
Usage
$ roxctl central debug [flags]7.2.8.1. roxctl central debug db
Control the debugging of the database.
Usage
$ roxctl central debug db [flags]| Option | Description |
|---|---|
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.8.2. roxctl central debug log
Retrieve the current log level.
Usage
$ roxctl central debug log [flags]| Option | Description |
|---|---|
|
|
Specify the log level to which you want to set the modules. Valid values include |
|
| Specify the modules to which you want to apply the command. |
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
|
Specify the timeout for API requests, which is the maximum duration of a request. The default value is |
7.2.8.3. roxctl central debug dump
Download a bundle containing the debug information for Central.
Usage
$ roxctl central debug dump [flags]| Option | Description |
|---|---|
|
|
If set to |
|
| Specify the output directory for the bundle content. The default value is an automatically generated directory name within the current directory. |
|
|
Specify the timeout for API requests, which is the maximum duration of a request. The default value is |
7.2.8.4. roxctl central debug db stats
Control the statistics of the Central database.
Usage
$ roxctl central debug db stats [flags]7.2.8.5. roxctl central debug authz-trace
Enable or disable authorization tracing in Central for debugging purposes.
Usage
$ roxctl central debug authz-trace [flags]| Option | Description |
|---|---|
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.8.6. roxctl central debug db stats reset
Reset the statistics of the Central database.
Usage
$ roxctl central debug db stats reset [flags]7.2.8.7. roxctl central debug download-diagnostics
Download a bundle containing a snapshot of diagnostic information about the platform.
Usage
$ roxctl central debug download-diagnostics [flags]| Option | Description |
|---|---|
|
| Specify a comma-separated list of the Sensor clusters from which you want to collect the logs. |
|
| Specify the output directory in which you want to save the diagnostic bundle. |
|
| Specify the timestamp from which you want to collect the logs from the Sensor clusters. |
|
|
Specify the timeout for API requests, which specifies the maximum duration of a request. The default value is |
7.2.9. roxctl central generate
Generate the required YAML configuration files that contain the orchestrator objects to deploy Central.
Usage
$ roxctl central generate [flags]| Option | Description |
|---|---|
|
| Specify the path to the backup bundle from which you want to restore the keys and certificates. |
|
|
If set to |
|
|
Specify the path to Helm templates on your local file system. For more details, run the |
|
| Specify the PEM certificate bundle file that you want to use as the default. |
|
| Specify the PEM private key file that you want to use as the default. |
|
|
If set to |
|
| Specify the administrator password. The default value is automatically generated. |
|
| Specify the ports or endpoints you want to use for unencrypted exposure as a comma-separated list. |
7.2.9.1. roxctl central generate k8s
Generate the required YAML configuration files to deploy Central into a Kubernetes cluster.
Usage
$ roxctl central generate k8s [flags]| Option | Description |
|---|---|
|
|
Specify the Central database image you want to use. If not specified, a default value corresponding to the |
|
| Specify a list of configuration maps that you want to add as declarative configuration mounts in Central. |
|
| Specify a list of secrets that you want to add as declarative configuration mounts in Central. |
|
|
Specify whether you want to enable telemetry. The default value is |
|
|
Specify the default settings for container images. The specified settings control the repositories from which the images are downloaded, the image names and the format of the tags. The default value is |
|
|
Generate deployment files that support the specified Istio version. Valid values include |
|
|
Specify the method in which you want to suspend Central. Valid values include |
|
|
Specify the main image that you want to use. If not specified, a default value corresponding to the |
|
|
Specify whether you want to run RHACS in offline mode, avoiding a connection to the Internet. The default value is |
|
|
Specify the directory to which you want to save the deployment bundle. The default value is |
|
|
Specify the deployment tool that you want to use. Valid values include |
|
|
Specify the Scanner database image that you want to use. If not specified, a default value corresponding to the |
|
| Specify the Scanner image that you want to use. If not specified, a default value corresponding to the `--image-defaults" is used. |
7.2.9.2. roxctl central generate k8s pvc
Generate Kubernetes YAML files for persistent volume claims (PVCs) in Central.
Usage
$ roxctl central generate k8s pvc [flags]| Option | Description |
|---|---|
|
|
Specify the external volume name for the Central database. The default value is |
|
|
Specify the external volume size in gigabytes for the Central database. The default value is |
|
| Specify the storage class name for the Central database. This is optional if you have a default storage class configured. |
7.2.9.3. roxctl central generate openshift
Generate the required YAML configuration files to deploy Central in a Red Hat OpenShift cluster.
Usage
$ roxctl central generate openshift [flags]| Option | Description |
|---|---|
|
|
Specify the Central database image that you want to use. If not specified, a default value is created corresponding to the |
|
| Specify a list of configuration maps that you want to add as declarative configuration mounts in Central. |
|
| Specify a list of secrets that you want to add as declarative configuration mounts in Central. |
|
|
Specify whether you want to enable telemetry. The default value is |
|
|
Specify the default settings for container images. It controls the repositories from which the images are downloaded, the image names and the format of the tags. The default value is |
|
|
Generate deployment files that support the specified Istio version. Valid values include |
|
|
Specify the method of exposing Central. Valid values include |
|
|
Specify the main image that you want to use. If not specified, a default value corresponding to |
|
|
Specify whether you want to run RHACS in offline mode, avoiding a connection to the Internet. The default value is |
|
|
Specify integration with Red Hat OpenShift 4 monitoring. The default value is |
|
| Specify the Red Hat OpenShift major version 3 or 4 for the deployment. |
|
|
Specify the directory to which you want to save the deployment bundle. The default value is |
|
|
Specify the deployment tool that you want to use. Valid values include |
|
|
Specify the Scanner database image that you want to use. If not specified, a default value corresponding to the |
|
|
Specify the Scanner image that you want to use. If not specified, a default value corresponding to |
7.2.9.4. roxctl central generate interactive
Generate interactive resources in Central.
Usage
$ roxctl central generate interactive [flags]7.2.9.5. roxctl central generate k8s hostpath
Generate a Kubernetes YAML manifest for deploying a Central instance by using the hostpath volume type.
Usage
$ roxctl central generate k8s hostpath [flags]| Option | Description |
|---|---|
|
|
Specify the path on the host for the Central database. The default value is |
|
|
Specify the node selector key for the Central database. Valid values include |
|
| Specify the node selector value for the Central database. |
7.2.9.6. roxctl central generate openshift pvc
Generate a OpenShift YAML manifest for deploying a persistent volume claim (PVC) in Central.
Usage
$ roxctl central generate openshift pvc [flags]| Option | Description |
|---|---|
|
|
Specify the external volume name for the Central database. The default value is |
|
|
Specify the external volume size in gigabytes for the Central database. The default value is |
|
| Specify the storage class name for the Central database. This is optional if you have a default storage class configured. |
7.2.9.7. roxctl central generate openshift hostpath
Add a hostpath external volume to the deployment definition in Red Hat OpenShift.
Usage
$ roxctl central generate openshift hostpath [flags]| Option | Description |
|---|---|
|
|
Specify the path on the host for the Central database. The default value is |
|
|
Specify the node selector key. Valid values include |
|
| Specify the node selector value for the Central database. |
7.2.10. roxctl central init-bundles
Initialize bundles in Central.
Usage
$ roxctl central init-bundles [flag]| Option | Description |
|---|---|
|
|
Specify the timeout after which API requests are retried. A value of |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.10.1. roxctl central init-bundles list
List the available initialization bundles in Central.
Usage
$ roxctl central init-bundles list [flags]7.2.10.2. roxctl central init-bundles revoke
Revoke one or more cluster initialization bundles in Central.
Usage
$ roxctl central init-bundles revoke <init_bundle_ID or name> [<init_bundle_ID or name> ...] [flags]where:
<init_bundle_ID or name>- Specifies the ID or the name of the initialization bundle that you want to revoke. You can provide multiple IDs or names separated by using spaces.
7.2.10.3. roxctl central init-bundles fetch-ca
Fetch the certificate authority (CA) bundle from Central.
Usage
$ roxctl central init-bundles fetch-ca [flags]| Option | Description |
|---|---|
|
| Specify the file that you want to use for storing the CA configuration. |
7.2.10.4. roxctl central init-bundles generate
Generate a new cluster initialization bundle.
Usage
$ roxctl central init-bundles generate <init_bundle_name> [flags]where:
<init_bundle_name>- Specifies the name for the initialization bundle you want to generate.
| Option | Description |
|---|---|
|
|
Specify the file you want to use for storing the newly generated initialization bundle in the Helm configuration form. Use |
|
|
Specify the file that you want to use for storing the newly generated initialization bundle in Kubernetes secret form. Use |
7.2.11. roxctl central userpki
Manage the user certificate authorization providers.
Usage
$ roxctl central userpki [flags]7.2.11.1. roxctl central userpki list
Display all the user certificate authentication providers.
Usage
$ roxctl central userpki list [flags]| Option | Description |
|---|---|
|
|
Enable the JSON output. The default value is |
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.11.2. roxctl central userpki create
Create a new user certificate authentication provider.
Usage
$ roxctl central userpki create name [flags]| Option | Description |
|---|---|
|
| Specify the PEM files of the root CA certificates. You can specify several certificate files. |
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
| Specify the minimum access role for users of this provider. |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
7.2.11.3. roxctl central userpki delete
Delete a user certificate authentication provider.
Usage
$ roxctl central userpki delete id|name [flags]| Option | Description |
|---|---|
|
|
If set to |
|
|
Specify the timeout after which API requests are retried. A value of zero means that the entire request duration is waited for without retrying. The default value is |
|
|
Specify the timeout for API requests representing the maximum duration of a request. The default value is |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}