gcloud: Wed Dec 11 10:18:23 UTC 2024

gcloud/beta/container/clusters/create

@@ -83,6 +83,11 @@ SYNOPSIS
         [--workload-pool=WORKLOAD_POOL]
         [--workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [--additional-zones=ZONE,[ZONE,...] | --node-locations=ZONE,[ZONE,...]]
+        [--aggregation-ca=CA_POOL_PATH --cluster-ca=CA_POOL_PATH
+          --control-plane-disk-encryption-key=KEY --etcd-api-ca=CA_POOL_PATH
+          --etcd-peer-ca=CA_POOL_PATH --gkeops-etcd-backup-encryption-key=KEY
+          --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]]
         [--binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
           | --enable-binauthz]
@@ -1469,6 +1474,40 @@ FLAGS
                   --location us-central1-a \
                   --node-locations us-central1-a,us-central1-b
 
+     Control Plane Keys
+
+       --aggregation-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the
+          aggregation CA
+
+       --cluster-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the cluster
+          CA
+
+       --control-plane-disk-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the control plane disks
+
+       --etcd-api-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd API
+          CA
+
+       --etcd-peer-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd peer
+          CA
+
+       --gkeops-etcd-backup-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the disaster recovery etcd backups for the cluster
+
+       --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          sign service account tokens
+
+       --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          verify service account tokens. Maybe specified multiple times.
+
      Flags for Binary Authorization:
 
        --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
@@ -1519,8 +1558,6 @@ FLAGS
            vpc
               Configures the Cloud DNS zone to be private to the VPC Network.
 
-       ClusterDNS_AdditiveVPCScope_EnabledDisable
-
        At most one of these can be specified:
 
          --additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN

gcloud/beta/container/clusters/create-auto

@@ -33,6 +33,11 @@ SYNOPSIS
         [--workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [--additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN
           | --disable-additive-vpc-scope]
+        [--aggregation-ca=CA_POOL_PATH --cluster-ca=CA_POOL_PATH
+          --control-plane-disk-encryption-key=KEY --etcd-api-ca=CA_POOL_PATH
+          --etcd-peer-ca=CA_POOL_PATH --gkeops-etcd-backup-encryption-key=KEY
+          --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
           --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]]
         [--dataplane-v2-observability-mode=DATAPLANE_V2_OBSERVABILITY_MODE
@@ -487,8 +492,6 @@ FLAGS
         WORKLOAD_VULNERABILITY_SCANNING must be one of: disabled, standard,
         enterprise.
 
-     ClusterDNS_AdditiveVPCScope_EnabledDisable
-
      At most one of these can be specified:
 
        --additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN
@@ -497,6 +500,40 @@ FLAGS
        --disable-additive-vpc-scope
           Disables Additive VPC Scope.
 
+     Control Plane Keys
+
+       --aggregation-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the
+          aggregation CA
+
+       --cluster-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the cluster
+          CA
+
+       --control-plane-disk-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the control plane disks
+
+       --etcd-api-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd API
+          CA
+
+       --etcd-peer-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd peer
+          CA
+
+       --gkeops-etcd-backup-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the disaster recovery etcd backups for the cluster
+
+       --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          sign service account tokens
+
+       --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          verify service account tokens. Maybe specified multiple times.
+
      Flags for Binary Authorization:
 
        --binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE

gcloud/beta/container/clusters/update

@@ -1108,8 +1108,6 @@ REQUIRED FLAGS
              vpc
                 Configures the Cloud DNS zone to be private to the VPC Network.
 
-         ClusterDNS_AdditiveVPCScope_EnabledDisable
-
          At most one of these can be specified:
 
            --additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN

gcloud/beta/container/vmware/admin-clusters/update

@@ -56,13 +56,14 @@ FLAGS
         complete.
 
      --required-platform-version=REQUIRED_PLATFORM_VERSION
-        Platform version required for upgrading a user cluster. If the current
-        platform version is lower than the required version, the platform
-        version will be updated to the required version. If it is not installed
-        in the platform, download the required version bundle.
+        Platform version required for upgrading an admin cluster or a user
+        cluster. If the current platform version is lower than the required
+        version, the platform version will be updated to the required version.
+        If it is not installed in the platform, download the required version
+        bundle.
 
      --version=VERSION
-        Anthos Cluster on VMware version for the user cluster resource
+        Anthos Cluster on VMware version for the cluster resource
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,

gcloud/beta/container/vmware/clusters/create

@@ -85,7 +85,7 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --version=VERSION
-        Anthos Cluster on VMware version for the user cluster resource
+        Anthos Cluster on VMware version for the cluster resource
 
      Admin cluster membership resource - membership of the admin cluster.
      Membership name is the same as the admin cluster name.

gcloud/beta/container/vmware/clusters/update

@@ -174,7 +174,7 @@ FLAGS
         operation.
 
      --version=VERSION
-        Anthos Cluster on VMware version for the user cluster resource
+        Anthos Cluster on VMware version for the cluster resource
 
      At most one of these can be specified:
 

gcloud/beta/container/vmware/clusters/upgrade

@@ -50,7 +50,7 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --version=VERSION
-        Anthos Cluster on VMware version for the user cluster resource
+        Anthos Cluster on VMware version for the cluster resource
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,