`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|--------------------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--cloud` | | The path to the cloud’s definition file. The cloud name must be present in the file. |
| `--force` | false | Forces the cloud to be added to the controller |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju add-cloud mycontroller mycloud
juju add-cloud mycontroller mycloud --cloud=./cloud-definition.yaml
```
## Details
Adds the specified cloud to a specific controller on JIMM.
One can specify a cloud definition via a yaml file passed with the –cloud
flag. If the flag is missing, the command will assume the cloud definition
is already known and will error otherwise.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-----------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--file` | | Specify a file-path for the controller profile, use ‘-’ to read from stdin. |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju jaas add-controller-profile my-profile --file ./profile.yaml
cat profile.yaml | juju jaas add-controller-profile my-profile --file -
```
## Details
Adds a controller profile.
The controller profile definition is read from a YAML file or from stdin.
The command argument sets the saved profile name.
The YAML schema mirrors the saved controller profile payload:
description: Production AWS bootstrap defaults
juju-version: 3.6
cloud:
name: aws
region:
name: eu-west-1
bootstrap-options:
bootstrap-base: ubuntu@24.04
bootstrap-constraints:
mem: 8G
model-constraints:
arch: amd64
model-default:
logging-config: =INFO
storage-pool:
name: controller-pool
type: ebs
attributes:
volume-type: gp3
bootstrap-config:
controller-service-type: loadbalancer
controller-config:
audit-log-enabled: “true”
controller-model-config:
automatically-retry-hooks: “false”
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju add-group
```
## Details
Adds a group.
[cloud|region|(cloud/region)]`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------------------------------------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `-c`, `--controller` | | Controller to operate in |
| `--config` | | Specify the path to a YAML model configuration file or individual configuration options (`--config config.yaml [--config key=value ...]`) |
| `--credential` | | Specify the credential to be used by the model |
| `--no-switch` | false | Choose not to switch to the newly created model |
| `--owner` | | Specify the user who will own the model, if not the current user |
| `--target-controller` | | Target controller for the model |
## Examples
```none
juju [jaas] add-model mymodel mycloud --target-controller jaas-controller-1
juju [jaas] add-model mymodel us-east-1 --target-controller jaas-controller-1
juju [jaas] add-model mymodel aws/us-east-1 --target-controller jaas-controller-2 --credential mycred
juju [jaas] add-model mymodel --target-controller jaas-controller-3 --config key=value
```
## Details
Adds a model to a specific controller.
This command creates a new hosted model on the specified controller.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `-f` | | file location of JSON encoded tuples |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju add-permission user-alice@canonical.com member group-mygroup
juju add-permission group-MyTeam#member admin model-mymodel
juju add-permission -f /path/to/file.yaml
```
## Details
Grants access to a resource.
This command works at a low-level and commands like ‘juju grant’
should be preferred in most cases.
Permissions in JIMM consist of an object, a relation and a target object.
These are used to define access control between resources.
The object and target object must be of the form - or -
E.g. “user-Alice” or “controller-MyController”
Certain reserved tags exist to denote specific resource types:
- The user-everyone@external tag represents all users.
- The controller-jimm tag represents the JIMM controller itself.
-f Read from a file where filename is the location of a JSON encoded file of the form:
[
{
“object”:”user-mike”,
“relation”:”member”,
“target_object”:”group-yellow”
},
{
“object”:”user-alice”,
“relation”:”member”,
“target_object”:”group-yellow”
}
]
Certain constraints apply when creating/removing permissions, namely:
Resources may be one of:
```none
user tag = "user-"
group tag = "group-"
idp group tag = "idpgroup-<id>"
role tag = "role-<name>"
controller tag = "controller-"
model tag = "model-"
cloud tag = "cloud-<name>"
application-offer tag = "applicationoffer-"
```
If target_object is a group, the relation can only be:
```none
member
```
If target_object is a role, the relation can only be:
```none
assignee
```
If target_object is a controller, the relation can be one of:
```none
audit_log_viewer (only relevent for the JIMM controller)
can_addmodel
administrator
```
If target_object is a model, the relation can be one of:
```none
reader
writer
administrator
```
If target_object is a cloud, the relation can be one of:
```none
administrator
can_addmodel
```
If target_object is an application offer, the relation can be one of:
```none
reader
consumer
administrator
```
If the object is a group, a userset must be applied by adding #member as follows.
This will grant/revoke access to all users within TeamA:
```none
group-TeamA#member administrator controller-MyController
```
IDP-owned groups use the idpgroup tag and also require the #member userset:
```none
idpgroup-external-team-id#member administrator controller-MyController
```
Similarly if the object is a role, a userset must be applied by adding #member as follows.
```none
role-Auditor#assignee audit_log_viewer controller-MyController
```
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju add-role myrole
```
## Details
Adds a role.
[/region] `
### Options
| Flag | Default | Usage |
|----------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--bootstrap-base` | | Specify the base of the bootstrap machine. |
| `--bootstrap-constraints` | [] | Specify bootstrap machine constraints. |
| `--config` | | Specify a configuration file, or one or more configuration options. (`--config config.yaml [--config key=value ...])` |
| `--constraints` | [] | Set model constraints |
| `--credential` | | The name of the cloud credential to use for bootstrapping. Only required if more than one credential is available for the cloud. |
| `--detach` | false | If set, the command will start the bootstrap job and return immediately with the job ID, without waiting for the job to complete. |
| `--format` | json | Specify output format (json|yaml) |
| `--model-default` | | Specify a configuration file, or one or more configuration options to be set for all models, unless otherwise specified. (`--model-default config.yaml [--model-default key=value ...])` |
| `-o`, `--output` | | Specify an output file |
| `--profile` | | Apply a saved controller profile before processing explicit bootstrap flags. Explicit command line values override the profile. |
| `--storage-pool` | | Specify options for an initial storage pool. ‘name’ and ‘type’ are required, plus any additional attributes. (`--storage-pool pool-config.yaml [--storage-pool key=value ...])` |
## Examples
```none
juju [jaas] bootstrap
juju [jaas] bootstrap mycloud/region mycontroller 3.6.8
juju [jaas] bootstrap mycloud/region mycontroller 3.6.8 --profile production-aws
juju [jaas] bootstrap mycloud/region mycontroller 3.6.8 --config controller-service-type=loadbalancer
juju [jaas] bootstrap mycloud/region mycontroller 3.6.8 --bootstrap-base ubuntu@24.04 --bootstrap-constraints mem=8G --constraints arch=amd64
juju [jaas] bootstrap mycloud/region mycontroller 3.6.8 --storage-pool name=controller-pool --storage-pool type=ebs --config audit-log-enabled=true
```
## Details
Requests the JIMM server to bootstrap a Juju controller.
The controller will be created asychronously on the specificed
cloud and region.
Saved controller profiles can be applied with –profile. The profile’s saved
cloud definition and bootstrap options are used as defaults, and any explicit
command line arguments or flags override those saved values.
By default the command will wait for the bootstrap job to complete
while printing the job logs. Note that the logs will not follow the
–output flag and will always be printed to stdout. This can allow
you to send the initial output with the job ID to a file, while the
logs are streamed to stdout.
Use the –detach flag to start the bootstrap job and return immediately,
printing only the job ID, without waiting for the job to complete.
The final argument, version, denotes the Juju controller to be bootstrapped.
Config options for the bootstrap process can be specified via one or more
–config options. Each –config option can either be a path to a YAML file
containing config options, or a key=value pair. If multiple –config options
are specified, they will be merged together, with later options taking
precedence over earlier ones. Key=value pairs will take precedence over
file contents.
These config options must match the config options supported by the Juju CLI
for the version of Juju being bootstrapped. See the Juju documentation for
the version specified for the full list of supported bootstrap config
options. Additional bootstrap settings can be supplied with –bootstrap-base,
–bootstrap-constraints, –constraints, –model-default, and –storage-pool,
these align with the corresponding Juju CLI options.
Note that some config options will be automatically set but can be overriden.
These are:
- login-token-refresh-url
Bootstrapping to a k8s cluster requires that the service set up to handle
requests to the controller be accessible outside the cluster. Typically this
means a service type of LoadBalancer is needed, and Juju does create such a
service if it knows it is supported by the cluster. This is performed by
interrogating the cluster for a well known managed deployment such as microk8s,
GKE or EKS.
See the Juju bootstrap documentation for more details and how to configure
bootstrap for a Kubernetes cluster Juju does not recognise.
Note that JIMM will internally do the following:
- download the juju CLI matching the desired controller version
- bootstrap a new controller
- register the controller with JIMM
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `-f` | false | follow the logs |
## Examples
```none
juju bootstrap-status
juju destroy-status
```
## Details
Displays logs for a bootstrap or destroy-controller job.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju bootstrap-stop
```
## Details
Stop a bootstrap job.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | smart | Specify output format (json|smart|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju check-permission user-alice@canonical.com administrator controller-aws-controller-1
```
## Details
Verifies access to a resource.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--detach` | false | If set, the command will start the destroy-controller job and return immediately with the job ID, without waiting for the job to complete. |
| `--format` | yaml | Specify output format (json|yaml) |
| `--no-prompt` | false | If set, the command will not prompt the user for the controller name before proceeding |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju [jaas] destroy-controller
juju [jaas] destroy-controller mycontroller
juju [jaas] destroy-controller mycontorller --no-prompt
```
## Details
Requests the JIMM server to destroy a Juju controller.
The controller will be destroyed asynchronously.
By default the command will wait for the destroy-controller job to complete
while printing the job logs. Note that the logs will not follow the
–output flag and will always be printed to stdout. This can allow
you to send the initial output with the job ID to a file, while the
logs are streamed to stdout.
Use the –detach flag to start the bootstrap job and return immediately,
printing only the job ID, without waiting for the job to complete.
The argument denotes the name of the Juju controller to be destroyed.
Note that JIMM will internally do the following:
- download the juju CLI matching the controller version
- destroy the controller
- unregister the controller from JIMM
Destroying controllers on k8s clouds will only work on uju 3.6.10 or newer.
As a workaround, you can first unregister the controller and then destroy
it separately.
--no-index --split --url --discourse-ids `
### Options
| Flag | Default | Usage |
|-------------------|-----------|------------------------------------------------------------------------------------------|
| `--discourse-ids` | | File containing a mapping of commands and their discourse ids |
| `--no-index` | false | Do not generate the commands index |
| `--out` | | Documentation output folder if not set the result is displayed using the standard output |
| `--split` | false | Generate a separate Markdown file for each command |
| `--url` | | Documentation host URL |
## Examples
```none
juju documentation
juju documentation --split
juju documentation --split --no-index --out /tmp/docs
```
To render markdown documentation using a list of existing
commands, you can use a file with the following syntax
```none
command1: id1
command2: id2
commandN: idN
```
For example:
```none
add-cloud: 1183
add-secret: 1284
remove-cloud: 4344
```
Then, the urls will be populated using the ids indicated
in the file above.
```none
juju documentation --split --no-index --out /tmp/docs --discourse-ids /tmp/docs/myids
```
## Details
This command generates a markdown formatted document with all the commands, their descriptions, arguments, and examples.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju grant-audit-log
```
## Details
Grants a user access to read audit logs.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|--------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--owner` | | switch the model owner to the desired user |
## Examples
```none
juju import-model mycontroller ac30d6ae-0bed-4398-bba7-75d49e39f189
juju import-model mycontroller ac30d6ae-0bed-4398-bba7-75d49e39f189 --owner user@canonical.com
```
## Details
Imports a model running on a controller into JIMM’s state.
When importing, it is necessary for JIMM to contain a set of cloud credentials
that represent a user’s access to the incoming model’s cloud.
The –owner command is necessary when importing a model created by a
local user and it will switch the model owner to the desired external user.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju list-migration-targets bb933db6-b151-417f-9a62-e3e80b4ebc9b
```
## Details
Requests a list of controllers connected to JIMM that are valid migration
targets for the specified model.
This is useful to obtain a filtered list of controllers that meets the following
criteria:
- The controller is not the current controller for the model.
- The controller can deploy to the the same cloud/region as the current controller.
- The controller is running a compatible Juju version i.e. newer than or equal to
the current controller.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--backing-controller` | | Specify the name of the controller that will host the model in JIMM. |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
| `--user-mapping` | | Specify a comma-separated user mapping of local users to external users |
## Examples
```none
juju migrate alice/my-model my-jaas --backing-controller=controller-1 --user-mapping=./user-mapping.yaml
```
## Details
The migrate command migrates a model to JIMM.
This command is useful to take a model that is already running on a Juju controller
and migrate it to JIMM. During this process JIMM will modify the details of the model
to remove any local users with access to the model and replace the model owner with
an external user i.e. from alice -> [alice@canonical.com](mailto:alice@canonical.com).
In order to determine the new model owner and to handle any existing application-offers
that have already been consumed with local users, you must specify a user mapping file
with the –user-mapping flag. This should point to a yaml file with a mapping of local
users to external users.
For example:
my-user-mapping.yaml:
‘’’
alice: [alice@canonical.com](mailto:alice@canonical.com)
bob: [bob@canonical.com](mailto:bob@canonical.com)
‘’’
The mapping must contain entries for all users that have access to the model and any offers
hosted within that model.
You can use the “juju show-model ” command to see the users that have access to
the model.
You can also use the “juju list-offers” command alongside “juju show-offer ”
to see the users that have access to each offer.
Any users that you do not wish to be mapped must still be included with a null value or empty
string in place of the external user. This indicates that you are intentionally skipping this
local user, for example:
‘’’
alice: [alice@canonical.com](mailto:alice@canonical.com)
bob: null # or “”
‘’’
The user mapping is consulted when relations are periodically validated. I.e. if an offer
was consumed by user “alice”, when JIMM validates the relation it will understand that user
“alice” has been mapped and checks that “alice@canonical” still has access to the offer.
Revoking access from “[alice@canonical.com](mailto:alice@canonical.com)” will result in the relation encountering an error.
It may not be possible to know all users that have have consumed offers from a model, but using
“juju show-offer –format yaml” you can see all users that have access to the
offer. This list should help determine which users to map in the user mapping file.
Any tools/scripts that refer to models by their full name (owner/name) will need to be
updated after migration to use the new external username or refer to models by their UUID.
[...]`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju migrate-internal mycontroller 2cb433a6-04eb-4ec4-9567-90426d20a004 fd469983-27c2-423b-bebf-84f616fb036b ...
juju migrate-internal mycontroller user@domain.com/model-a user@domain.com/model-b ...
juju migrate-internal mycontroller user@domain.com/model-a fd469983-27c2-423b-bebf-84f616fb036b ...
```
## Details
The migrate-internal command migrates a model(s) between two controllers
in your JAAS system. This performs a model migration, but is named
“migrate-internal” to avoid confusion with the “migrate” command which migrates
a model to JAAS.
You may specify a model name (of the form owner/name) or model UUID.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju model-status 2cb433a6-04eb-4ec4-9567-90426d20a004
juju model-status 2cb433a6-04eb-4ec4-9567-90426d20a004 --format yaml
```
## Details
Displays full model status.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju purge-audit-logs 2021-02-03
juju purge-audit-logs 2021-02-03T00
juju purge-audit-logs 2021-02-03T15:04:05Z
```
## Details
Purges logs from the database before the given date.
The provided date must be formatted as an ISO8601 date string.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | json | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju query-models '.applications | with_entries(select(.key=="nginx-ingress-integrator"))'
```
## Details
Queries all models available to the current user performing the
query against each model status individually, returning the
collated query responses for each model.
The query runs against the output of “juju status –format json”,
as such you can format your query against an output like this.
The queries expect a JQ query string.
//]`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-----------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--all` | false | recover every cloud credential known to JIMM |
| `--dry-run` | false | check that credentials can be fetched without writing them back |
## Examples
```none
jaas recover-model-credential aws/alice@canonical.com/default
jaas recover-model-credential cloudcred-aws_alice@canonical.com_default
jaas recover-model-credential --all
jaas recover-model-credential --all --dry-run
```
## Details
Recovers a lost cloud credential (for example after a Vault outage) by fetching
the credential’s secret contents from a controller that hosts a model using the
credential, and storing them back into JIMM’s credential store.
This is a disaster-recovery operation and requires JIMM admin access. For a
credential to be recoverable:
- its metadata must still exist in JIMM’s database,
- at least one model must still be using it, and
- the controller hosting that model must be reachable and must still return
the credential’s secrets (some providers, e.g. LXD ‘certificate’
credentials, never expose secrets over the API and cannot be recovered).
Only cloud credentials can be recovered this way. Controller credentials (the
login JIMM uses to reach a Juju controller) cannot be read back from the
controller and must be reset separately.
The credential is identified either by its short form “//”
or by its full tag “cloudcred- **”.
Use –all to recover every cloud credential known to JIMM in one pass.
Use –dry-run to verify that credentials can be fetched from their controllers
without actually writing anything back to JIMM’s credential store. The output
shows which credentials would be recovered.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|------------------------------------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--dry-run` | false | Dry-run enabled will only print the controller details. |
| `--file` | | Specify a file-path for controller details, use ‘-’ to read from stdin. |
| `--format` | yaml | Specify output format (json|yaml) |
| `--local` | false | If local flag is specified, then the local API addresses and CA cert of the controller will be used. |
| `-o`, `--output` | | Specify an output file |
| `--public-address` | | Specify a custom public address to use for dialing the controller. |
| `--tls-hostname` | | Specify the hostname for TLS verification. |
## Examples
```none
juju register-controller mycontroller
juju register-controller mycontroller --local
```
## Details
Registers a controller with JIMM.
Using the controller name provided, this command will inspect your
Juju client store for details on the specified controller.
Note that by default, this command assumes the controller has the public-hostname
field set, which will define the preferred address JIMM will use to contact the
controller. Use of a public address will also ignore any custom CA cert in your
local client store and assumes the server is secured with a public certificate.
Use the –local flag if the server is not configured with a public address or to
ignore the controller’s public-hostname and use the custom CA of the controller.
A yaml formatted file can also be used as input for cases where the controller
is not available on the client. Using the –file will validate that the provided
controller name matches the name in the yaml file.
Using –file will ignore other flags like –public-address and –local.
Use the –dry-run flag to generate a sample file without registering the controller.
This can be used later as input to register-controller.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju remove-cloud mycontroller mycloud
```
## Details
Removes the specified cloud from the specified controller in JIMM.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--force` | false | delete controller profile without prompt |
## Examples
```none
juju jaas remove-controller-profile my-profile
juju jaas remove-controller-profile my-profile --force
```
## Details
Removes a saved controller profile.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--force` | false | delete group without prompt |
| `--format` | smart | Specify output format (smart) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju remove-group mygroup
```
## Details
Removes a group.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `-f` | | file location of JSON encoded tuples |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju remove-permission user-alice@canonical.com member group-mygroup
juju remove-permission group-MyTeam#member admin model-mymodel
juju remove-permission -f /path/to/file.yaml
```
## Details
Revokes access to a resource.
This command works at a low-level and commands like ‘juju grant’
should be preferred in most cases.
Permissions in JIMM consist of an object, a relation and a target object.
These are used to define access control between resources.
The object and target object must be of the form - or -
E.g. “user-Alice” or “controller-MyController”
Certain reserved tags exist to denote specific resource types:
- The user-everyone@external tag represents all users.
- The controller-jimm tag represents the JIMM controller itself.
-f Read from a file where filename is the location of a JSON encoded file of the form:
[
{
“object”:”user-mike”,
“relation”:”member”,
“target_object”:”group-yellow”
},
{
“object”:”user-alice”,
“relation”:”member”,
“target_object”:”group-yellow”
}
]
Certain constraints apply when creating/removing permissions, namely:
Resources may be one of:
```none
user tag = "user-"
group tag = "group-"
idp group tag = "idpgroup-<id>"
role tag = "role-<name>"
controller tag = "controller-"
model tag = "model-"
cloud tag = "cloud-<name>"
application-offer tag = "applicationoffer-"
```
If target_object is a group, the relation can only be:
```none
member
```
If target_object is a role, the relation can only be:
```none
assignee
```
If target_object is a controller, the relation can be one of:
```none
audit_log_viewer (only relevent for the JIMM controller)
can_addmodel
administrator
```
If target_object is a model, the relation can be one of:
```none
reader
writer
administrator
```
If target_object is a cloud, the relation can be one of:
```none
administrator
can_addmodel
```
If target_object is an application offer, the relation can be one of:
```none
reader
consumer
administrator
```
If the object is a group, a userset must be applied by adding #member as follows.
This will grant/revoke access to all users within TeamA:
```none
group-TeamA#member administrator controller-MyController
```
IDP-owned groups use the idpgroup tag and also require the #member userset:
```none
idpgroup-external-team-id#member administrator controller-MyController
```
Similarly if the object is a role, a userset must be applied by adding #member as follows.
```none
role-Auditor#assignee audit_log_viewer controller-MyController
```
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | smart | Specify output format (smart) |
| `-o`, `--output` | | Specify an output file |
| `-y` | false | delete role without prompt |
## Examples
```none
juju remove-role remove myrole
```
## Details
Removes a role.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju rename-group mygroup newgroup
```
## Details
Renames a group.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju rename-role myrole newrolename
```
## Details
Renames a role.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju revoke-audit-log user@canonical.com
```
## Details
Revokes user access to audit logs.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju set-controller-deprecated mycontroller
```
## Details
Sets the deprecated status of a controller.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju jaas show-controller my-controller
juju jaas show-controller my-controller --format json
```
## Details
Displays information about a controller known to JIMM.
For controllers with an active bootstrap status, some fields will be empty/missing.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju jaas show-controller-profile my-profile
juju jaas show-controller-profile my-profile --format json
```
## Details
Shows a saved controller profile.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | tabular | Specify output format (json|tabular|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
jaas show-model 2cb433a6-04eb-4ec4-9567-90426d20a004
jaas show-model alice@canonical.com/my-model
jaas show-model alice@canonical.com/my-model --format json
jaas show-model alice@canonical.com/my-model --format yaml
```
## Details
Displays information about which controller the specified model is running on.
The model can be specified using either:
- Model UUID (e.g., “2cb433a6-04eb-4ec4-9567-90426d20a004”)
- Owner and model name (e.g., “[alice@canonical.com](mailto:alice@canonical.com)/my-model”)
The output includes the model name, model UUID, controller name, and controller UUID.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--force` | false | force unregister a controller |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju unregister-controller mycontroller
juju unregister-controller mycontroller --force
```
## Details
Deregisters a controller from JIMM.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-----------------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--file` | | Specify a file-path for the controller profile, use ‘-’ to read from stdin. |
| `--format` | yaml | Specify output format (json|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju jaas update-controller-profile my-profile --file ./profile.yaml
cat profile.yaml | juju jaas update-controller-profile my-profile --file -
```
## Details
Updates a saved controller profile.
The controller profile definition is read from a YAML file or from stdin.
The same YAML schema accepted by add-controller-profile is used here.
The command argument sets the profile name.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
## Examples
```none
juju update-migrated-model mycontroller e0bf3abf-7029-4e48-9c26-68a7b6e02947
```
## Details
Updates a model known to JIMM that has been migrated
externally to a different JAAS controller.
`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|--------------------------------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--agent-stream` | | Check this agent stream for upgrades |
| `--dry-run` | false | Don’t change anything, just report what version would be chosen |
| `--ignore-agent-versions` | false | Don’t check if all agents have already reached the current version |
| `--target-version` | | Upgrade to this specific version |
## Examples
```none
jaas upgrade-controller mycontroller
jaas upgrade-controller mycontroller --target-version 3.6.8
jaas upgrade-controller mycontroller --dry-run
```
## Details
Upgrades the Juju agent running on the named backing controller to the next
available patch release. If –target-version is specified, upgrades to that
exact version instead.
The command requires the caller to be a JIMM admin.
[...]`
### Options
| Flag | Default | Usage |
|----------------------------|-----------|-------------------------------------------|
| `-B`, `--no-browser-login` | false | Do not use web browser for authentication |
| `--format` | tabular | Specify output format (json|tabular|yaml) |
| `-o`, `--output` | | Specify an output file |
## Examples
```none
juju upgrade-to myController 2cb433a6-04eb-4ec4-9567-90426d20a004
juju upgrade-to myController 2cb433a6-04eb-4ec4-9567-90426d20a004 83cf3d62-ab16-4cb2-8e2f-df111fca1a32
```
## Details
Upgrades models by migrating them to a specific controller
and upgrades the models to the controller’s version.