gcloud: Wed Dec 11 10:18:23 UTC 2024

gcloud/beta/container/clusters/create

@@ -83,6 +83,11 @@ SYNOPSIS
         [--workload-pool=WORKLOAD_POOL]
         [--workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [--additional-zones=ZONE,[ZONE,...] | --node-locations=ZONE,[ZONE,...]]
+        [--aggregation-ca=CA_POOL_PATH --cluster-ca=CA_POOL_PATH
+          --control-plane-disk-encryption-key=KEY --etcd-api-ca=CA_POOL_PATH
+          --etcd-peer-ca=CA_POOL_PATH --gkeops-etcd-backup-encryption-key=KEY
+          --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]]
         [--binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
           | --enable-binauthz]
@@ -1469,6 +1474,40 @@ FLAGS
                   --location us-central1-a \
                   --node-locations us-central1-a,us-central1-b
 
+     Control Plane Keys
+
+       --aggregation-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the
+          aggregation CA
+
+       --cluster-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the cluster
+          CA
+
+       --control-plane-disk-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the control plane disks
+
+       --etcd-api-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd API
+          CA
+
+       --etcd-peer-ca=CA_POOL_PATH
+          The Certificate Authority Service caPool that will back the etcd peer
+          CA
+
+       --gkeops-etcd-backup-encryption-key=KEY
+          The Cloud KMS symmetric encryption cryptoKey that will be used to
+          encrypt the disaster recovery etcd backups for the cluster
+
+       --service-account-signing-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          sign service account tokens
+
+       --service-account-verification-keys=KEY_VERSION,[KEY_VERSION,...]
+          A Cloud KMS asymmetric signing cryptoKeyVersion that will be used to
+          verify service account tokens. Maybe specified multiple times.
+
      Flags for Binary Authorization:
 
        --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
@@ -1519,8 +1558,6 @@ FLAGS
            vpc
               Configures the Cloud DNS zone to be private to the VPC Network.
 
-       ClusterDNS_AdditiveVPCScope_EnabledDisable
-
        At most one of these can be specified:
 
          --additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN