roxctl declarative-config

--access-scope string

By providing the name, you can specify the referenced access scope.

--description string

Set a description for the role.

--name string

Specify the name of the role.

--permission-set string

By providing the name, you can specify the referenced permission set.

--name string

Specify the name of the notifier.

--cluster-label-selector requirement

Specify the criteria for creating a label selector based on the cluster’s labels. The key-value pairs represent requirements, and you can use this flag multiple times to create a combination of requirements. The default value is [ [ ] ]. For more details, run the roxctl declarative-config create access-scope --help command.

--description string

Set a description for the access scope.

--included included-object

Specify a list of clusters and their namespaces that you want to include in the access scope. The default value is [null].

--name string

Specify the name of the access scope.

--namespace-label-selector requirement

Specify the criteria for creating a label selector based on the namespace’s labels. Similar to the cluster-label-selector, you can use this flag multiple times for the combination of requirements. For more details, run the roxctl declarative-config create access-scope --help command.

--extra-ui-endpoints strings

Specify additional user interface (UI) endpoints from which the authentication provider is used. The expected format is <endpoint>:<port>.

--groups-key strings

Set the keys of the groups that you want to add within the authentication provider. The tuples of key, value and role should have the same length. For more details, run the roxctl declarative-config create auth-provider --help command.

--groups-role strings

Set the role of the groups that you want to add within the authentication provider. The tuples of key, value and role should have the same length. For more details, run the roxctl declarative-config create auth-provider --help command.

--groups-value strings

Set the values of the groups that you want to add within the authentication provider. The tuples of key, value and role should have the same length. For more details, run the roxctl declarative-config create auth-provider --help command.

--minimum-access-role string

Set the minimum access role of the authentication provider. You can leave this field empty if you do not want to configure the minimum access role by using the declarative configuration.

--name string

Specify the name of the authentication provider.

--required-attributes stringToString

Set a list of attributes that the authentication provider must return during authentication. The default value is [].

--ui-endpoint string

Set the UI endpoint from which the authentication provider is used. This is usually the public endpoint where RHACS is available. The expected format is <endpoint>:<port>.

--description string

Set the description of the permission set.

--name string

Specify the name of the permission set.

--resource-with-access stringToString

Set a list of resources with their respective access levels. The default value is []. For more details, run the roxctl declarative-config create permission-set --help command.

--audit-logging

Enable audit logging. The default value is false.

--source-types stringToString

Specify Splunk source types as comma-separated key=value pairs. The default value is [].

--splunk-endpoint string

Specify the Splunk HTTP endpoint. This is a mandatory option.

--splunk-skip-tls-verify

Use an insecure connection to Splunk. The default value is false.

--splunk-token string

Specify the Splunk HTTP token. This is a mandatory option.

--truncate int

Specify the Splunk truncate limit. The default value is 10000.

--audit-logging

Enable audit logging. The default value is false.

--extra-fields stringToString

Specify additional fields as comma-separated key=value pairs. The default value is [].

--headers stringToString

Specify headers as comma-separated key=value pairs. The default value is [].

--webhook-cacert-file string

Specify the file name of the endpoint CA certificate in PEM format.

--webhook-endpoint string

Specify the URL of the webhook endpoint.

--webhook-password string

Specify the password for basic authentication of the webhook endpoint. No authentication if not specified. Requires --webhook-username.

--webhook-skip-tls-verify

Skip webhook TLS verification. The default value is false.

--webhook-username string

Specify the username for basic authentication of the webhook endpoint. No authentication occurs if not specified. Requires --webhook-password.

--audience string

Specify the target group that you want to validate.

--claim-mappings stringToString

Specify a list of non-standard claims from the identity provider (IdP) token that you want to include in the authentication provider’s rules. The default value is [].

--client-id string

Specify the client ID of the OIDC client.

--client-secret string

Specify the client secret of the OIDC client.

--disable-offline-access

Disable the request for the offline_access from the OIDC IdP. You need to use this option if the OIDC IdP limits the number of sessions with the offline_access scope. The default value is false.

--issuer string

Specify the issuer of the OIDC client.

--mode string

Specify the callback mode that you want to use. Valid values include auto, post, query and fragment. The default value is auto.

--idp-cert string

Specify the file containing the SAML identity provider (IdP) certificate in PEM format.

--idp-issuer string

Specify the issuer of the IdP.

--metadata-url string

Specify the metadata URL of the service provider.

--name-id-format string

Specify the format of the name ID.

--sp-issuer string

Specify the issuer of the service provider.

--sso-url string

Specify the URL of the IdP for single sign-on (SSO).

--ca-file string

Specify the file containing the certification authorities in PEM format.