/opt/chainguard/openstack-barbican-2026.1/bin/barbican

WARNING:barbicanclient.barbican:This Barbican CLI interface has been deprecated and will be removed in the O release. Please use the openstack unified client instead.
/opt/chainguard/openstack-barbican-2026.1/lib/python3.13/site-packages/jsonpath_rw_ext/_string.py:19: SyntaxWarning: invalid escape sequence '\('
  SUB = re.compile("sub\(/(.*)/,\s+(.*)\)")
/opt/chainguard/openstack-barbican-2026.1/lib/python3.13/site-packages/jsonpath_rw_ext/_string.py:20: SyntaxWarning: invalid escape sequence '\('
  SPLIT = re.compile("split\((.),\s+(\d+),\s+(\d+|-1)\)")
usage: barbican [--version] [-v | -q] [--log-file LOG_FILE] [-h] [--debug] [--no-auth]
                [--os-identity-api-version <identity-api-version>] [--os-auth-url <auth-url>]
                [--os-username <auth-user-name>] [--os-user-id <auth-user-id>]
                [--os-password <auth-password>] [--os-user-domain-id <auth-user-domain-id>]
                [--os-user-domain-name <auth-user-domain-name>]
                [--os-tenant-name <auth-tenant-name>] [--os-tenant-id <tenant-id>]
                [--os-project-id <auth-project-id>] [--os-project-name <auth-project-name>]
                [--os-project-domain-id <auth-project-domain-id>]
                [--os-project-domain-name <auth-project-domain-name>]
                [--os-auth-token <auth-token>] [--endpoint <barbican-url>]
                [--interface <barbican-interface>] [--service-type <barbican-service-type>]
                [--service-name <barbican-service-name>] [--region-name <barbican-region-name>]
                [--barbican-api-version <barbican-api-version>] [--insecure]
                [--os-cacert <ca-certificate>] [--os-cert <certificate>] [--os-key <key>]
                [--timeout <seconds>] [--collect-timing]

Command-line interface to the Barbican API.

options:
  --version             show program's version number and exit
  -v, --verbose         Increase verbosity of output. Can be repeated.
  -q, --quiet           Suppress output except warnings and errors.
  --log-file LOG_FILE   Specify a file to log output. Disabled by default.
  -h, --help            Show help message and exit.
  --debug               Show tracebacks on errors.
  --no-auth, -N         Do not use authentication.
  --os-identity-api-version <identity-api-version>
                        Specify Identity API version to use. Defaults to
                        env[OS_IDENTITY_API_VERSION] or 3.
  --os-auth-url, -A <auth-url>
                        Defaults to env[OS_AUTH_URL].
  --os-username, -U <auth-user-name>
                        Defaults to env[OS_USERNAME].
  --os-user-id <auth-user-id>
                        Defaults to env[OS_USER_ID].
  --os-password, -P <auth-password>
                        Defaults to env[OS_PASSWORD].
  --os-user-domain-id <auth-user-domain-id>
                        Defaults to env[OS_USER_DOMAIN_ID].
  --os-user-domain-name <auth-user-domain-name>
                        Defaults to env[OS_USER_DOMAIN_NAME].
  --os-tenant-name, -T <auth-tenant-name>
                        Defaults to env[OS_TENANT_NAME].
  --os-tenant-id, -I <tenant-id>
                        Defaults to env[OS_TENANT_ID].
  --os-project-id <auth-project-id>
                        Another way to specify tenant ID. This option is mutually exclusive with
                        --os-tenant-id. Defaults to env[OS_PROJECT_ID].
  --os-project-name <auth-project-name>
                        Another way to specify tenant name. This option is mutually exclusive with
                        --os-tenant-name. Defaults to env[OS_PROJECT_NAME].
  --os-project-domain-id <auth-project-domain-id>
                        Defaults to env[OS_PROJECT_DOMAIN_ID].
  --os-project-domain-name <auth-project-domain-name>
                        Defaults to env[OS_PROJECT_DOMAIN_NAME].
  --os-auth-token <auth-token>
                        Defaults to env[OS_AUTH_TOKEN].
  --endpoint, -E <barbican-url>
                        Defaults to env[BARBICAN_ENDPOINT].
  --interface <barbican-interface>
                        Defaults to env[BARBICAN_INTERFACE].
  --service-type <barbican-service-type>
                        Defaults to env[BARBICAN_SERVICE_TYPE].
  --service-name <barbican-service-name>
                        Defaults to env[BARBICAN_SERVICE_NAME].
  --region-name <barbican-region-name>
                        Defaults to env[BARBICAN_REGION_NAME].
  --barbican-api-version <barbican-api-version>
                        Defaults to env[BARBICAN_API_VERSION].

API Connection Options:
  Options controlling the HTTP API Connections

  --insecure            Explicitly allow client to perform "insecure" TLS (https) requests. The
                        server's certificate will not be verified against any certificate
                        authorities. This option should be used with caution.
  --os-cacert <ca-certificate>
                        Specify a CA bundle file to use in verifying a TLS (https) server
                        certificate. Defaults to env[OS_CACERT].
  --os-cert <certificate>
                        The location for the keystore (PEM formatted) containing the public key of
                        this client. Defaults to env[OS_CERT].
  --os-key <key>        The location for the keystore (PEM formatted) containing the private key
                        of this client. Defaults to env[OS_KEY].
  --timeout <seconds>   Set request timeout (in seconds).
  --collect-timing      Collect per-API call timing information.

See "barbican help COMMAND" for help on a specific command.

Commands:
  acl delete     Delete ACLs for a secret or container as identified by its href
  acl get        Retrieve ACLs for a secret or container by providing its href
  acl submit     Submit ACL on a secret or container as identified by its href
  acl user add   Add ACL users to a secret or container as identified by its href
  acl user remove  Remove ACL users from a secret or container as identified by its href
  ca get         Retrieve a CA by providing its URI
  ca list        List CAs
  complete       print bash completion command (cliff)
  help           print detailed help for another command (cliff)
  secret consumer create  Create a consumer for a secret
  secret consumer delete  Delete a consumer from a secret
  secret consumer list  List consumers of a secret
  secret container create  Store a container in Barbican
  secret container delete  Delete a container by providing its href
  secret container get  Retrieve a container by providing its URI
  secret container list  List containers
  secret delete  Delete a secret by providing its URI
  secret get     Retrieve a secret by providing its URI
  secret list    List secrets
  secret order create  Create a new order
  secret order delete  Delete an order by providing its href
  secret order get  Retrieve an order by providing its URI
  secret order list  List orders
  secret store   Store a secret in Barbican
  secret update  Update a secret with no payload in Barbican