gcloud: Thu Oct 23 11:05:02 UTC 2025

gcloud/beta/container/clusters/create

@@ -13,6 +13,7 @@ SYNOPSIS
         [--alpha-cluster-feature-gates=[FEATURE=true|false,...]]
         [--anonymous-authentication-config=ANONYMOUS_AUTHENTICATION_CONFIG]
         [--async] [--auto-monitoring-scope=AUTO_MONITORING_SCOPE]
+        [--autopilot-workload-policies=WORKLOAD_POLICIES]
         [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
@@ -141,6 +142,8 @@ SYNOPSIS
           --master-ipv4-cidr=MASTER_IPV4_CIDR --private-cluster]
         [--enable-secret-manager --enable-secret-manager-rotation
           --secret-manager-rotation-interval=SECRET_MANAGER_ROTATION_INTERVAL]
+        [--enable-secret-sync --enable-secret-sync-rotation
+          --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL]
         [--ephemeral-storage[=[local-ssd-count=LOCAL-SSD-COUNT]]
           | --ephemeral-storage-local-ssd[=[count=COUNT]]
           | --local-nvme-ssd-block[=[count=COUNT]]
@@ -271,6 +274,16 @@ FLAGS
         NONE: Disables Auto-Monitoring. AUTO_MONITORING_SCOPE must be one of:
         ALL, NONE.
 
+     --autopilot-workload-policies=WORKLOAD_POLICIES
+        Add Autopilot workload policies to the cluster.
+
+        Examples:
+
+            $ gcloud beta container clusters create example-cluster \
+                --autopilot-workload-policies=allow-net-admin
+
+        The only supported workload policy is 'allow-net-admin'.
+
      --autoprovisioning-enable-insecure-kubelet-readonly-port
         Enables the Kubelet's insecure read only port for Autoprovisioned Node
         Pools.
@@ -2449,6 +2462,19 @@ FLAGS
           provider component. If you don't specify a time interval for the
           rotation, it will default to a rotation period of two minutes.
 
+     Flags for Secret Sync configuration:
+
+       --enable-secret-sync
+          Enables the Secret Sync component. See
+          https://cloud.google.com/secret-manager/docs/sync-k8-secrets
+
+       --enable-secret-sync-rotation
+          Enables the rotation of secrets in the Secret Sync component.
+          provider component.
+
+       --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL
+          Set the rotation period for secrets in the Secret Sync component.
+
      At most one of these can be specified:
 
        --ephemeral-storage[=[local-ssd-count=LOCAL-SSD-COUNT]]

gcloud/beta/container/clusters/create-auto

@@ -57,6 +57,8 @@ SYNOPSIS
           --enable-private-nodes --master-ipv4-cidr=MASTER_IPV4_CIDR]
         [--enable-secret-manager --enable-secret-manager-rotation
           --secret-manager-rotation-interval=SECRET_MANAGER_ROTATION_INTERVAL]
+        [--enable-secret-sync --enable-secret-sync-rotation
+          --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL]
         [--location=LOCATION | --region=REGION | --zone=ZONE, -z ZONE]
         [--scopes=[SCOPE,...];
           default="gke-default" --service-account=SERVICE_ACCOUNT]
@@ -719,6 +721,19 @@ FLAGS
           provider component. If you don't specify a time interval for the
           rotation, it will default to a rotation period of two minutes.
 
+     Flags for Secret Sync configuration:
+
+       --enable-secret-sync
+          Enables the Secret Sync component. See
+          https://cloud.google.com/secret-manager/docs/sync-k8-secrets
+
+       --enable-secret-sync-rotation
+          Enables the rotation of secrets in the Secret Sync component.
+          provider component.
+
+       --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL
+          Set the rotation period for secrets in the Secret Sync component.
+
      At most one of these can be specified:
 
        --location=LOCATION

gcloud/beta/container/clusters/update

@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud beta container clusters update NAME
         (--anonymous-authentication-config=ANONYMOUS_AUTHENTICATION_CONFIG
+          | --autopilot-workload-policies=WORKLOAD_POLICIES
           | --autoprovisioning-cgroup-mode=AUTOPROVISIONING_CGROUP_MODE
           | --autoprovisioning-enable-insecure-kubelet-readonly-port
           | --autoprovisioning-network-tags=[TAGS,...]
@@ -40,7 +41,9 @@ SYNOPSIS
           | --notification-config=[pubsub=ENABLED|DISABLED,
           pubsub-topic=TOPIC,...] | --patch-update=[PATCH_UPDATE]
           | --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
-          | --release-channel=CHANNEL | --remove-labels=[KEY,...]
+          | --release-channel=CHANNEL
+          | --remove-autopilot-workload-policies=REMOVE_WORKLOAD_POLICIES
+          | --remove-labels=[KEY,...]
           | --remove-workload-policies=REMOVE_WORKLOAD_POLICIES
           | --security-group=SECURITY_GROUP
           | --security-posture=SECURITY_POSTURE | --set-password
@@ -118,6 +121,8 @@ SYNOPSIS
           --monitoring-service=MONITORING_SERVICE
           | --[no-]enable-secret-manager --[no-]enable-secret-manager-rotation
           --secret-manager-rotation-interval=SECRET_MANAGER_ROTATION_INTERVAL
+          | --[no-]enable-secret-sync --[no-]enable-secret-sync-rotation
+          --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL
           | --password=PASSWORD --enable-basic-auth
           | --username=USERNAME, -u USERNAME) [--async]
         [--cloud-run-config=[load-balancer-type=EXTERNAL,...]]
@@ -160,6 +165,16 @@ REQUIRED FLAGS
               to the health check endpoints are allowed anonymously, all other
               calls will be rejected.
 
+       --autopilot-workload-policies=WORKLOAD_POLICIES
+          Add Autopilot workload policies to the cluster.
+
+          Examples:
+
+              $ gcloud beta container clusters update example-cluster \
+                  --autopilot-workload-policies=allow-net-admin
+
+          The only supported workload policy is 'allow-net-admin'.
+
        --autoprovisioning-cgroup-mode=AUTOPROVISIONING_CGROUP_MODE
           Sets the cgroup mode for auto-provisioned nodes.
 
@@ -693,6 +708,16 @@ REQUIRED FLAGS
               Clusters subscribed to 'stable' receive versions that are known
               to be stable and reliable in production.
 
+       --remove-autopilot-workload-policies=REMOVE_WORKLOAD_POLICIES
+          Remove Autopilot workload policies from the cluster.
+
+          Examples:
+
+              $ gcloud beta container clusters update example-cluster \
+                  --remove-autopilot-workload-policies=allow-net-admin
+
+          The only supported workload policy is 'allow-net-admin'.
+
        --remove-labels=[KEY,...]
           Labels to remove from the Google Cloud resources in use by the
           Kubernetes Engine cluster. These are unrelated to Kubernetes labels.
@@ -1641,6 +1666,22 @@ REQUIRED FLAGS
             driver provider component. If you don't specify a time interval for
             the rotation, it will default to a rotation period of two minutes.
 
+       Flags for Secret Sync configuration:
+
+         --[no-]enable-secret-sync
+            Enables the Secret Sync component. See
+            https://cloud.google.com/secret-manager/docs/sync-k8-secrets. Use
+            --enable-secret-sync to enable and --no-enable-secret-sync to
+            disable.
+
+         --[no-]enable-secret-sync-rotation
+            Enables the rotation of secrets in the Secret Sync component.
+            provider component. Use --enable-secret-sync-rotation to enable and
+            --no-enable-secret-sync-rotation to disable.
+
+         --secret-sync-rotation-interval=SECRET_SYNC_ROTATION_INTERVAL
+            Set the rotation period for secrets in the Secret Sync component.
+
        Basic auth
 
          --password=PASSWORD