OC-ADM-GROUPS-PRUNE(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💅 oc adm groups prune — bestie edition

okay so real talk, this page is from the OC ADM GROUPS(1) corner of the OpenShift CLI user manuals, and it's all about cleaning up your group list so it doesn't look like a messy group chat with people who literally left the server months ago. 🧹✨

✨ NAME ✨

oc adm groups prune — remove those crusty old OpenShift groups that are still referencing records which no longer exist in an external provider. it's giving "spring cleaning but make it kubernetes" 🧚

🦋 SYNOPSIS 🦋

oc adm groups prune [OPTIONS]

💖 DESCRIPTION 💖

So the whole vibe here: prune OpenShift groups that reference missing records from an external provider. 🫶

To actually prune OpenShift group records using the ones from an external provider, first figure out which groups you wanna prune. Like, for instance, all or some groups may be selected from the current groups stored in OpenShift that have been synced previously. Any combination of a literal whitelist, a whitelist file and a blacklist file is supported — mix and match, you do you. 💅

You need the path to a sync configuration file that was used for syncing the groups in question, because that's how the tool knows how data is requested from the external record store. no config, no clue, iykyk.

Default behavior is to just indicate all OpenShift groups for which the external record does not exist. To actually run the pruning process and commit the results, use the --confirm flag. ⚠️ like, that's the "actually press send" button. no cap.

🎀 OPTIONS 🎀

  • --blacklist="" — path to the group blacklist file 🚫
  • --confirm=false — if true, modify OpenShift groups; if false, display groups. (so false = window shopping, true = actually buying 👛)
  • --sync-config="" — path to the sync config 🔄
  • --whitelist="" — path to the group whitelist file ✅

🌈 OPTIONS INHERITED FROM PARENT COMMANDS 🌈

these are the heirlooms bestie, inherited from the parent commands, and they're all still iconic:

  • --as="" — Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
  • --as-group=[] — Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
  • --as-uid="" — UID to impersonate for the operation.
  • --as-user-extra=[] — User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
  • --cache-dir="/homeless-shelter/.kube/cache" — Default cache directory
  • --certificate-authority="" — Path to a cert file for the certificate authority
  • --client-certificate="" — Path to a client certificate file for TLS
  • --client-key="" — Path to a client key file for TLS
  • --cluster="" — The name of the kubeconfig cluster to use
  • --context="" — The name of the kubeconfig context to use
  • --disable-compression=false — If true, opt-out of response compression for all requests to the server
  • --insecure-skip-tls-verify=false — If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
  • --kubeconfig="" — Path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
  • --match-server-version=false — Require server version to match client version
  • -n, --namespace="" — If present, the namespace scope for this CLI request
  • --profile="none" — Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
  • --profile-output="profile.pprof" — Name of the file to write the profile to
  • --request-timeout="0" — The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
  • -s, --server="" — The address and port of the Kubernetes API server
  • --tls-server-name="" — Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
  • --token="" — Bearer token for authentication to the API server
  • --user="" — The name of the kubeconfig user to use
  • --warnings-as-errors=false — Treat warnings received from the server as errors and exit with a non-zero exit code
💀 heads up bestie: --insecure-skip-tls-verify literally says it will make your HTTPS connections insecure. that's not me being dramatic, that's the manpage being dramatic. use with intention.

🔥 EXAMPLE 🔥

here's the group-chat receipts, all four of them:

# Prune all orphaned groups
oc adm groups prune --sync-config=/path/to/ldap-sync-config.yaml --confirm

# Prune all orphaned groups except the ones from the denylist file
oc adm groups prune --blacklist=/path/to/denylist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm

# Prune all orphaned groups from a list of specific groups specified in an allowlist file
oc adm groups prune --whitelist=/path/to/allowlist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm

# Prune all orphaned groups from a list of specific groups specified in a list
oc adm groups prune groups/group_name groups/other_name --sync-config=/path/to/ldap-sync-config.yaml --confirm

👑 SEE ALSO 👑

🌸 HISTORY 🌸

June 2016, Ported from the Kubernetes man-doc generator. vintage. 🕰️

🎀 and that's the whole page!! this one came straight out of the Openshift CLI User Manuals, version vibes dated June 2016 — shoutout to the Openshift source for keeping it iconic all these years. bye bestie, go prune responsibly 💖✨
📦 where this page comes from