Create initial users after a management cluster bootstrap

Once you bootstrap your management cluster, create Keycloak users for access to the Container Cloud web UI.

Mirantis recommends creating at least two users, user and operator, that are required for a typical MOSK deployment.

To create the user for access to the Container Cloud web UI:

./container-cloud bootstrap user add \
    --username <userName> \
    --roles <roleName> \
    --kubeconfig <pathToMgmtKubeconfig>

Note

You will be asked for the user password interactively.

User creation parameters

Flag	Description
--username	Required. Name of the user to create.
--roles	Required. Comma-separated list of roles to assign to the user. If you run the command without the --namespace flag, you can assign the following roles: global-admin - read and write access for global role bindings writer - read and write access reader - view access operator - create and manage access to the BareMetalHost and BareMetalHostInventory (since Container Cloud 2.29.1, Cluster release 16.4.1) objects management-admin - full access to the management cluster, available since Container Cloud 2.25.0 (Cluster release 16.0.0) If you run the command for a specific project using the --namespace flag, you can assign the following roles: operator or writer - read and write access user or reader - view access member - read and write access (excluding IAM objects) bm-pool-operator - create and manage access to the BareMetalHost and BareMetalHostInventory (since Container Cloud 2.29.1, Cluster release 16.4.1) objects
--kubeconfig	Required. Path to the management cluster kubeconfig generated during the management cluster bootstrap.
--namespace	Optional. Name of the Container Cloud project where the user will be created. If not set, a global user will be created for all Container Cloud projects with the corresponding role access to view or manage all public objects.
--password-stdin	Optional. Flag to provide the user password through stdin: echo '$PASSWORD' | ./container-cloud bootstrap user add \ --username <userName> \ --roles <roleName> \ --kubeconfig <pathToMgmtKubeconfig> \ --password-stdin

To delete the user:

./container-cloud bootstrap user delete --username <userName> --kubeconfig <pathToMgmtKubeconfig>