There is a command group 'az_iot_ops'. This group of commands could 'manage azure iot operations'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_iot_ops_init'.The syntax is: az iot ops init --cluster
                --resource-group
                [--ca-dir]
                [--ca-file]
                [--ca-key-file]
                [--ca-valid-days]
                [--cluster-namespace]
                [--context]
                [--custom-location]
                [--disable-rotation {false, true}]
                [--disable-rsync-rules {false, true}]
                [--dp-instance]
                [--ensure-latest {false, true}]
                [--kubernetes-distro {k3s, k8s, microk8s}]
                [--kv-id]
                [--kv-spc-secret-name]
                [--location]
                [--mq-authn]
                [--mq-backend-part]
                [--mq-backend-rf]
                [--mq-backend-workers]
                [--mq-broker]
                [--mq-frontend-replicas]
                [--mq-frontend-server]
                [--mq-frontend-workers]
                [--mq-insecure {false, true}]
                [--mq-instance]
                [--mq-listener]
                [--mq-mem-profile {high, low, medium, tiny}]
                [--mq-mode {auto, distributed}]
                [--mq-service-type {clusterip, loadbalancer, nodeport}]
                [--no-block {false, true}]
                [--no-deploy {false, true}]
                [--no-progress {false, true}]
                [--no-tls {false, true}]
                [--opcua-discovery-url]
                [--rotation-int]
                [--runtime-socket]
                [--show-template {false, true}]
                [--simulate-plc {false, true}]
                [--sp-app-id]
                [--sp-object-id]
                [--sp-secret]
                [--sp-secret-valid-days]
                [--target]. The 1th example of the child command would be to use it to 'minimum input for complete setup  this includes key vault configuration  csi driver deployment  tls config and deployment of iot operations', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --kv-id /subscriptions/2cb3a427-1abc-48d0-9d03-dd240819742a/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault. The 2th example of the child command would be to use it to 'same setup as prior example  except with the usage of an existing app id and a flag to include a simulated plc server as part of the deployment  including the app id will prevent  init  from creating an app registration', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --kv-id $KEYVAULT_ID --sp-app-id a14e216b-6802-4e9c-a6ac-844f9ffd230d --simulate-plc. The 3th example of the child command would be to use it to 'to skip deployment and focus only on the key vault csi driver and tls config workflows simple pass in    no deploy   this can be useful when desiring to deploy from a different tool such as portal', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --kv-id $KEYVAULT_ID --sp-app-id a14e216b-6802-4e9c-a6ac-844f9ffd230d --no-deploy. The 4th example of the child command would be to use it to 'to only deploy iot operations on a cluster that has already been prepped  simply omit    kv id  and include    no tls', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --no-tls. The 5th example of the child command would be to use it to 'use    no block  to do other work while the deployment is on going vs waiting for the deployment to finish before starting the other work', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --kv-id $KEYVAULT_ID --sp-app-id a14e216b-6802-4e9c-a6ac-844f9ffd230d --no-block. The 6th example of the child command would be to use it to 'to avoid calling ms graph such as for ci scenarios where the logged in to az cli service principal permissions are limited or an existing service principal should be re used  provide all of    sp app id      sp object id  and    sp secret   these values should reflect the desired service principal that will be used for the key vault csi driver setup', the syntax is: az iot ops init --cluster mycluster -g myresourcegroup --kv-id $KEYVAULT_ID --sp-app-id a14e216b-6802-4e9c-a6ac-844f9ffd230d --sp-object-id 224a7a3f-c63d-4923-8950-c4a85f0d2f29 --sp-secret $SP_SECRET. The parameter '--cluster' is required. It is used to target cluster name for iot operations deployment.. The parameter '--resource-group -g' is required. It is used to name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--ca-dir' is optional. the local directory the generated test ca and private key will be placed in. if no directory is provided no files will be written to disk. applicable when no --ca-file and --ca-key-file are provided.. The parameter '--ca-file' is optional. the path to the desired ca file in pem format.. The parameter '--ca-key-file' is optional. the path to the ca private key file in pem format. !required! when --ca-file is provided.. The parameter '--ca-valid-days' is optional. option to control the duration in days of the init generated x509 ca. applicable if --ca-file and --ca-key-file are not provided.. The parameter '--cluster-namespace' is optional. the cluster namespace iot operations infra will be deployed to. must be lowercase.. The parameter '--context' is optional. kubeconfig context name to use for k8s cluster communication. if no context is provided current_context is used.. The parameter '--custom-location' is optional. the custom location name corresponding to the iot operations deployment. the default is in the form '{cluster_name}-ops-init-cl'.. The parameter '--disable-rotation' is optional. flag to disable secret rotation.. The parameter '--disable-rsync-rules' is optional. resource sync rules will not be included in the deployment.. The parameter '--dp-instance' is optional. instance name for data processor. the default is in the form '{cluster_name}-ops-init-processor'.. The parameter '--ensure-latest' is optional. ensure the latest iot ops cli is installed, raising an error if an upgrade is available.. The parameter '--kubernetes-distro' is optional. the kubernetes distro to use for akri configuration. the selected distro implies the default container runtime socket path when no --runtime-socket value is provided.. The parameter '--kv-id' is optional. key vault arm resource id. providing this resource id will enable the client to setup all necessary resources and cluster side configuration to enable the key vault csi driver for iot operations.. The parameter '--kv-spc-secret-name' is optional. the key vault secret **name** to use as the default spc secret. if the secret does not exist, it will be created with a cryptographically secure placeholder value.. The parameter '--location' is optional. the arm location that will be used for provisioned rpsaas collateral. if not provided the connected cluster location will be used.. The parameter '--mq-authn' is optional. the mq authn name. the default is 'authn'.. The parameter '--mq-backend-part' is optional. mq backend partitions.. The parameter '--mq-backend-rf' is optional. mq backend redundancy factor.. The parameter '--mq-backend-workers' is optional. mq backend workers.. The parameter '--mq-broker' is optional. the mq broker name. the default is 'broker'.. The parameter '--mq-frontend-replicas' is optional. mq frontend replicas.. The parameter '--mq-frontend-server' is optional. the mq frontend server name. the default is 'mq-dmqtt-frontend'.. The parameter '--mq-frontend-workers' is optional. mq frontend workers.. The parameter '--mq-insecure' is optional. when enabled the mq deployment will include a listener bound to port 1883 with no authn or authz. the broker encryptinternaltraffic setting will be set to false. for non-production workloads only.. The parameter '--mq-instance' is optional. the mq instance name. the default is in the form 'init-{hash}-mq-instance'.. The parameter '--mq-listener' is optional. the mq listener name. the default is 'listener'.. The parameter '--mq-mem-profile' is optional. mq memory profile.. The parameter '--mq-mode' is optional. mq mode of operation.. The parameter '--mq-service-type' is optional. mq service type.. The parameter '--no-block' is optional. return immediately after the iot operations deployment has started.. The parameter '--no-deploy' is optional. the iot operations deployment workflow will be skipped.. The parameter '--no-progress' is optional. disable init progress bar.. The parameter '--no-tls' is optional. the tls configuration workflow will be skipped.. The parameter '--opcua-discovery-url' is optional. configures an opc-ua server endpoint for akri discovery handlers. if not provided and --simulate-plc is set, this value becomes 'opc.tcp://opcplc-000000.{cluster_namespace}:50000'.. The parameter '--rotation-int' is optional. rotation poll interval.. The parameter '--runtime-socket' is optional. the default node path of the container runtime socket. if not provided (default), the socket path is determined by --kubernetes-distro.. The parameter '--show-template' is optional. flag when set, will output the template intended for deployment.. The parameter '--simulate-plc' is optional. flag when set, will configure the opc-ua broker installer to spin-up a plc server.. The parameter '--sp-app-id' is optional. service principal app id. if provided will be used for csi driver setup. otherwise an app registration will be created. **required** if the logged in principal does not have permissions to query graph.. The parameter '--sp-object-id' is optional. service principal (sp) object id. if provided will be used for csi driver setup. otherwise the object id will be queried from the app id - creating the sp if one does not exist. **required** if the logged in principal does not have permissions to query graph. use `az ad sp show --id <app id> --query id -o tsv` to produce the proper object id. alternatively using portal you can navigate to enterprise applications in your entra id tenant.. The parameter '--sp-secret' is optional. the secret corresponding to the provided service principal app id. if provided will be used for csi driver setup. otherwise a new secret will be created. **required** if the logged in principal does not have permissions to query graph.. The parameter '--sp-secret-valid-days' is optional. option to control the duration in days of the init generated service principal secret. applicable if --sp-secret is not provided.. The parameter '--target' is optional. target name for ops orchestrator. the default is in the form '{cluster_name}-ops-init-target'.. 