gcloud: Wed Nov 19 10:58:36 UTC 2025

gcloud/container/clusters/create

@@ -43,7 +43,9 @@ SYNOPSIS
         [--enable-insecure-kubelet-readonly-port]
         [--enable-intra-node-visibility] [--enable-ip-access]
         [--enable-ip-alias] [--enable-k8s-certs-via-dns]
-        [--enable-k8s-tokens-via-dns] [--enable-kubernetes-alpha]
+        [--enable-k8s-tokens-via-dns]
+        [--enable-kernel-module-signature-enforcement]
+        [--enable-kubernetes-alpha]
         [--enable-kubernetes-unstable-apis=API,[API,...]]
         [--enable-l4-ilb-subsetting] [--enable-legacy-authorization]
         [--enable-legacy-lustre-port] [--enable-managed-prometheus]
@@ -684,6 +686,18 @@ FLAGS
         Enable K8s Service Account tokens Authentication to the cluster's
         control plane over DNS-based endpoint.
 
+     --enable-kernel-module-signature-enforcement
+        Enforces that kernel modules are signed on all new nodes in the cluster
+        unless explicitly overridden with
+        --no-enable-kernel-module-signature-enforcement when creating the
+        nodepool. Use --no-enable-kernel-module-signature-enforcement to
+        disable.
+
+        Examples:
+
+            $ gcloud container clusters create example-cluster \
+                --enable-kernel-module-signature-enforcement
+
      --enable-kubernetes-alpha
         Enable Kubernetes alpha features on this cluster. Selecting this option
         will result in the cluster having all Kubernetes alpha API groups and