az aro hcp cluster external-auth

Note

This reference is part of the aro extension for the Azure CLI (version 2.75.0 or higher). The extension will automatically install the first time you run an az aro hcp cluster external-auth command. Learn more about extensions.

Command group 'aro' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Manage Azure Red Hat OpenShift with hosted control plane external authentication.

Commands

Name	Description	Type	Status
az aro hcp cluster external-auth create	Create an Azure Red Hat OpenShift with hosted control plane external authentication instance.	Extension	Preview
az aro hcp cluster external-auth delete	Delete an Azure Red Hat OpenShift with hosted control plane external authentication instance.	Extension	Preview
az aro hcp cluster external-auth list	List Azure Red Hat OpenShift with hosted control plane external authentication instances.	Extension	Preview
az aro hcp cluster external-auth show	Get an Azure Red Hat OpenShift with hosted control plane external authentication instance.	Extension	Preview
az aro hcp cluster external-auth update	Update an Azure Red Hat OpenShift with hosted control plane external authentication instance.	Extension	Preview
az aro hcp cluster external-auth wait	Place the CLI in a waiting state until a condition is met.	Extension	Preview

az aro hcp cluster external-auth create

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Create an Azure Red Hat OpenShift with hosted control plane external authentication instance.

az aro hcp cluster external-auth create --cluster-name
                                        --name
                                        --resource-group
                                        [--acquire-policy-token]
                                        [--change-reference]
                                        [--claim]
                                        [--client --clients]
                                        [--issuer-audience]
                                        [--issuer-ca]
                                        [--issuer-url]
                                        [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                        [--prefix]
                                        [--username-claim]
                                        [--username-prefix]
                                        [--username-prefix-policy {NoPrefix, None, Prefix}]
                                        [--validation-rules]

Examples

Create an external authentication provider

az aro hcp cluster external-auth create --resource-group MyResourceGroup --cluster-name MyCluster --name MyExternalAuth --issuer-url https://login.microsoftonline.com/<tenant-id>/v2.0 --issuer-audience <audience> --username-claim email --client client-id=<client-id> component-name=console auth-client-namespace=openshift-console type=Confidential

Required Parameters

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

--name -n

The name of the External Authentication.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--claim

Claim name of the external profile.

Property	Value
Parameter group:	Groups Arguments

--client --clients

External Auth OIDC clients. There must not be more than 20 entries and entries must have unique namespace/name pairs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more. Singular flags: --client.

Property	Value
Parameter group:	Properties Arguments

--issuer-audience

This configures the acceptable audiences for JWT tokens issued by the identity provider. At least one of the entries must match the 'aud' claim in the JWT token. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Issuer Arguments

--issuer-ca

The issuer of the token. Certificate bundle to use to validate server certificates for the configured URL. It must be PEM encoded and when not specified, the system trust is used.

Property	Value
Parameter group:	Issuer Arguments

--issuer-url

This configures the URL used to issue tokens by the identity provider. The Kubernetes API server determines how authentication tokens should be handled by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers. issuerURL must use the 'https' scheme.

Property	Value
Parameter group:	Issuer Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--prefix

Prefix for the claim external profile. If this is specified, prefixPolicy will be set to "Prefix" by default.

Property	Value
Parameter group:	Groups Arguments

--username-claim

Claim name of the external profile.

Property	Value
Parameter group:	Username Arguments

--username-prefix

Prefix for the claim external profile. Must be set when the prefixPolicy field is set to 'Prefix' and must be unset otherwise.

Property	Value
Parameter group:	Username Arguments

--username-prefix-policy

Prefix policy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field. Allowed values are 'Prefix', 'NoPrefix', and 'None'. If not specified, the default policy is 'None'. When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. The prefix field must be set when prefixPolicy is 'Prefix'. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. When set to 'None', this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends {issuerURL}# to the value of the JWT claim when the claim is not 'email'. As an example, consider the following scenario: prefix is unset, issuerURL is set to https://myoidc.tld, the JWT claims include "username":"userA" and "email":"userA.

Property	Value
Parameter group:	Username Arguments
Accepted values:	NoPrefix, None, Prefix

--validation-rules

The claim validation rules. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Claim Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aro hcp cluster external-auth delete

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Delete an Azure Red Hat OpenShift with hosted control plane external authentication instance.

az aro hcp cluster external-auth delete [--acquire-policy-token]
                                        [--change-reference]
                                        [--cluster-name]
                                        [--ids]
                                        [--name]
                                        [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                        [--resource-group]
                                        [--subscription]
                                        [--yes]

Examples

Delete an external authentication provider

az aro hcp cluster external-auth delete --resource-group MyResourceGroup --cluster-name MyCluster --name MyExternalAuth --yes

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

Property	Value
Parameter group:	Resource Id Arguments

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the External Authentication.

Property	Value
Parameter group:	Resource Id Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aro hcp cluster external-auth list

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

List Azure Red Hat OpenShift with hosted control plane external authentication instances.

az aro hcp cluster external-auth list --cluster-name
                                      --resource-group
                                      [--max-items]
                                      [--next-token]

Examples

List external authentication providers of a cluster

az aro hcp cluster external-auth list --resource-group MyResourceGroup --cluster-name MyCluster

Required Parameters

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aro hcp cluster external-auth show

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get an Azure Red Hat OpenShift with hosted control plane external authentication instance.

az aro hcp cluster external-auth show [--cluster-name]
                                      [--ids]
                                      [--name]
                                      [--resource-group]
                                      [--subscription]

Examples

Show an external authentication provider

az aro hcp cluster external-auth show --resource-group MyResourceGroup --cluster-name MyCluster --name MyExternalAuth

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

Property	Value
Parameter group:	Resource Id Arguments

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the External Authentication.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aro hcp cluster external-auth update

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Update an Azure Red Hat OpenShift with hosted control plane external authentication instance.

az aro hcp cluster external-auth update [--acquire-policy-token]
                                        [--add]
                                        [--change-reference]
                                        [--claim]
                                        [--client --clients]
                                        [--cluster-name]
                                        [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                        [--ids]
                                        [--issuer-audience]
                                        [--issuer-ca]
                                        [--issuer-url]
                                        [--name]
                                        [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                        [--prefix]
                                        [--remove]
                                        [--resource-group]
                                        [--set]
                                        [--subscription]
                                        [--username-claim]
                                        [--username-prefix]
                                        [--username-prefix-policy {NoPrefix, None, Prefix}]
                                        [--validation-rules]

Examples

Update the username claim of an external authentication provider

az aro hcp cluster external-auth update --resource-group MyResourceGroup --cluster-name MyCluster --name MyExternalAuth --username-claim sub

Update an external authentication provider to remove any existing clients

az aro hcp cluster external-auth update --resource-group MyResourceGroup --cluster-name MyCluster --name MyExternalAuth --clients "[]"

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--claim

Claim name of the external profile.

Property	Value
Parameter group:	Groups Arguments

--client --clients

External Auth OIDC clients. There must not be more than 20 entries and entries must have unique namespace/name pairs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more. Singular flags: --client.

Property	Value
Parameter group:	Properties Arguments

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

Property	Value
Parameter group:	Resource Id Arguments

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--issuer-audience

This configures the acceptable audiences for JWT tokens issued by the identity provider. At least one of the entries must match the 'aud' claim in the JWT token. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Issuer Arguments

--issuer-ca

The issuer of the token. Certificate bundle to use to validate server certificates for the configured URL. It must be PEM encoded and when not specified, the system trust is used.

Property	Value
Parameter group:	Issuer Arguments

--issuer-url

This configures the URL used to issue tokens by the identity provider. The Kubernetes API server determines how authentication tokens should be handled by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers. issuerURL must use the 'https' scheme.

Property	Value
Parameter group:	Issuer Arguments

--name -n

The name of the External Authentication.

Property	Value
Parameter group:	Resource Id Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--prefix

Prefix for the claim external profile. If this is specified, prefixPolicy will be set to "Prefix" by default.

Property	Value
Parameter group:	Groups Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--username-claim

Claim name of the external profile.

Property	Value
Parameter group:	Username Arguments

--username-prefix

Prefix for the claim external profile. Must be set when the prefixPolicy field is set to 'Prefix' and must be unset otherwise.

Property	Value
Parameter group:	Username Arguments

--username-prefix-policy

Prefix policy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field. Allowed values are 'Prefix', 'NoPrefix', and 'None'. If not specified, the default policy is 'None'. When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. The prefix field must be set when prefixPolicy is 'Prefix'. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. When set to 'None', this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends {issuerURL}# to the value of the JWT claim when the claim is not 'email'. As an example, consider the following scenario: prefix is unset, issuerURL is set to https://myoidc.tld, the JWT claims include "username":"userA" and "email":"userA.

Property	Value
Parameter group:	Username Arguments
Accepted values:	NoPrefix, None, Prefix

--validation-rules

The claim validation rules. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Claim Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aro hcp cluster external-auth wait

Preview

Command group 'az aro hcp cluster external-auth' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Place the CLI in a waiting state until a condition is met.

az aro hcp cluster external-auth wait [--acquire-policy-token]
                                      [--change-reference]
                                      [--cluster-name]
                                      [--created]
                                      [--custom]
                                      [--deleted]
                                      [--exists]
                                      [--ids]
                                      [--interval]
                                      [--name]
                                      [--resource-group]
                                      [--subscription]
                                      [--timeout]
                                      [--updated]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--cluster-name -c

The name of the Azure Red Hat OpenShift with hosted control plane cluster.

Property	Value
Parameter group:	Resource Id Arguments

--created

Wait until created with 'provisioningState' at 'Succeeded'.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

Property	Value
Parameter group:	Wait Condition Arguments

--deleted

Wait until deleted.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--exists

Wait until the resource exists.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--interval

Polling interval in seconds.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	30

--name -n

The name of the External Authentication.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--timeout

Maximum wait in seconds.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	3600

--updated

Wait until updated with provisioningState at 'Succeeded'.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False