1OC ADM POLICY(1) June 2016 OC ADM POLICY(1)
2
6 oc adm policy reconcile-sccs - Replace cluster SCCs to match the recom‐
7 mended bootstrap policy
8
12 oc adm policy reconcile-sccs [OPTIONS]
13
17 Replace cluster SCCs to match the recommended bootstrap policy
18 This command will inspect the cluster SCCs against the recommended
21 bootstrap SCCs. Any cluster SCC that does not match will be replaced by
22 the recommended SCC. This command will not remove any additional clus‐
23 ter SCCs. By default, this command will not remove additional users
24 and groups that have been granted access to the SCC and will preserve
25 existing priorities (but will always reconcile unset priorities and the
26 policy definition), labels, and annotations.
27 You can see which cluster SCCs have recommended changes by choosing an
30 output type.
31
35 --additive-only=true
36 If true, preserves extra users, groups, labels and annotations in
37 the SCC as well as existing priorities.
38 --allow-missing-template-keys=true
41 If true, ignore any errors in templates when a field or map key is
42 missing in the template. Only applies to golang and jsonpath output
43 formats.
44 --confirm=false
47 If true, specify that cluster SCCs should be modified. Defaults to
48 false, displaying what would be replaced but not actually replacing
49 anything.
50 --infrastructure-namespace="openshift-infra"
53 Name of the infrastructure namespace.
54 --no-headers=false
57 When using the default or custom-column output format, don't print
58 headers (default print headers).
59 -o, --output="yaml"
62 Output format. One of: json|yaml|wide|name|custom-columns=...|cus‐
63 tom-columns-file=...|go-template=...|go-template-file=...|json‐
64 path=...|jsonpath-file=... See custom columns [ ⟨http://kuber‐
65 netes.io/docs/user-guide/kubectl-overview/#custom-columns⟩], golang
66 template [ ⟨http://golang.org/pkg/text/template/#pkg-overview⟩] and
67 jsonpath template [ ⟨http://kubernetes.io/docs/user-guide/jsonpath⟩].
68 --show-labels=false
71 When printing, show all labels as the last column (default hide
72 labels column)
73 --sort-by=""
76 If non-empty, sort list types using this field specification. The
77 field specification is expressed as a JSONPath expression (e.g.
78 '{.metadata.name}'). The field in the API resource specified by this
79 JSONPath expression must be an integer or a string.
80 --template=""
83 Template string or path to template file to use when -o=go-tem‐
84 plate, -o=go-template-file. The template format is golang templates [
85 ⟨http://golang.org/pkg/text/template/#pkg-overview⟩].
86
90 --allow_verification_with_non_compliant_keys=false
91 Allow a SignatureVerifier to use keys which are technically
92 non-compliant with RFC6962.
93 --alsologtostderr=false
96 log to standard error as well as files
97 --application_metrics_count_limit=100
100 Max number of application metrics to store (per container)
101 --as=""
104 Username to impersonate for the operation
105 --as-group=[]
108 Group to impersonate for the operation, this flag can be repeated
109 to specify multiple groups.
110 --azure-container-registry-config=""
113 Path to the file containing Azure container registry configuration
114 information.
115 --boot_id_file="/proc/sys/kernel/random/boot_id"
118 Comma-separated list of files to check for boot-id. Use the first
119 one that exists.
120 --cache-dir="/builddir/.kube/http-cache"
123 Default HTTP cache directory
124 --certificate-authority=""
127 Path to a cert file for the certificate authority
128 --client-certificate=""
131 Path to a client certificate file for TLS
132 --client-key=""
135 Path to a client key file for TLS
136 --cloud-provider-gce-lb-src-cidrs=130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
139 CIDRs opened in GCE firewall for LB traffic proxy health checks
140 --cluster=""
143 The name of the kubeconfig cluster to use
144 --container_hints="/etc/cadvisor/container_hints.json"
147 location of the container hints file
148 --containerd="unix:///var/run/containerd.sock"
151 containerd endpoint
152 --context=""
155 The name of the kubeconfig context to use
156 --default-not-ready-toleration-seconds=300
159 Indicates the tolerationSeconds of the toleration for
160 notReady:NoExecute that is added by default to every pod that does not
161 already have such a toleration.
162 --default-unreachable-toleration-seconds=300
165 Indicates the tolerationSeconds of the toleration for unreach‐
166 able:NoExecute that is added by default to every pod that does not
167 already have such a toleration.
168 --docker="unix:///var/run/docker.sock"
171 docker endpoint
172 --docker-tls=false
175 use TLS to connect to docker
176 --docker-tls-ca="ca.pem"
179 path to trusted CA
180 --docker-tls-cert="cert.pem"
183 path to client certificate
184 --docker-tls-key="key.pem"
187 path to private key
188 --docker_env_metadata_whitelist=""
191 a comma-separated list of environment variable keys that needs to
192 be collected for docker containers
193 --docker_only=false
196 Only report docker containers in addition to root stats
197 --docker_root="/var/lib/docker"
200 DEPRECATED: docker root is read from docker info (this is a fall‐
201 back, default: /var/lib/docker)
202 --enable_load_reader=false
205 Whether to enable cpu load reader
206 --event_storage_age_limit="default=24h"
209 Max length of time for which to store events (per type). Value is a
210 comma separated list of key values, where the keys are event types
211 (e.g.: creation, oom) or "default" and the value is a duration. Default
212 is applied to all non-specified event types
213 --event_storage_event_limit="default=100000"
216 Max number of events to store (per type). Value is a comma sepa‐
217 rated list of key values, where the keys are event types (e.g.: cre‐
218 ation, oom) or "default" and the value is an integer. Default is
219 applied to all non-specified event types
220 --global_housekeeping_interval=0
223 Interval between global housekeepings
224 --housekeeping_interval=0
227 Interval between container housekeepings
228 --insecure-skip-tls-verify=false
231 If true, the server's certificate will not be checked for validity.
232 This will make your HTTPS connections insecure
233 --kubeconfig=""
236 Path to the kubeconfig file to use for CLI requests.
237 --log-flush-frequency=0
240 Maximum number of seconds between log flushes
241 --log_backtrace_at=:0
244 when logging hits line file:N, emit a stack trace
245 --log_cadvisor_usage=false
248 Whether to log the usage of the cAdvisor container
249 --log_dir=""
252 If non-empty, write log files in this directory
253 --logtostderr=true
256 log to standard error instead of files
257 --machine_id_file="/etc/machine-id,/var/lib/dbus/machine-id"
260 Comma-separated list of files to check for machine-id. Use the
261 first one that exists.
262 --match-server-version=false
265 Require server version to match client version
266 -n, --namespace=""
269 If present, the namespace scope for this CLI request
270 --request-timeout="0"
273 The length of time to wait before giving up on a single server
274 request. Non-zero values should contain a corresponding time unit (e.g.
275 1s, 2m, 3h). A value of zero means don't timeout requests.
276 -s, --server=""
279 The address and port of the Kubernetes API server
280 --stderrthreshold=2
283 logs at or above this threshold go to stderr
284 --storage_driver_buffer_duration=0
287 Writes in the storage driver will be buffered for this duration,
288 and committed to the non memory backends as a single transaction
289 --storage_driver_db="cadvisor"
292 database name
293 --storage_driver_host="localhost:8086"
296 database host:port
297 --storage_driver_password="root"
300 database password
301 --storage_driver_secure=false
304 use secure connection with database
305 --storage_driver_table="stats"
308 table name
309 --storage_driver_user="root"
312 database username
313 --token=""
316 Bearer token for authentication to the API server
317 --user=""
320 The name of the kubeconfig user to use
321 -v, --v=0
324 log level for V logs
325 --version=false
328 Print version information and quit
329 --vmodule=
332 comma-separated list of pattern=N settings for file-filtered log‐
333 ging
334
338 # Display the cluster SCCs that would be modified
339 oc adm policy reconcile-sccs
340 # Update cluster SCCs that don't match the current defaults preserving additional grants
342 # for users, groups, labels, annotations and keeping any priorities that are already set
343 oc adm policy reconcile-sccs --confirm
344 # Replace existing users, groups, labels, annotations, and priorities that do not match defaults
346 oc adm policy reconcile-sccs --additive-only=false --confirm
347
352 oc-adm-policy(1),
353
357 June 2016, Ported from the Kubernetes man-doc generator
358Openshift Openshift CLI User Manuals OC ADM POLICY(1)