imjasonh/gcloud-help
1
0
Fork 0
mirror of https://github.com/imjasonh/gcloud-help synced 2026-07-08 10:35:03 +00:00
Code Activity
gcloud-help/gcloud/container/clusters/create
Automated 82063cbb03
gcloud: Thu Jun 2 08:41:25 UTC 2022
2022-06-02 08:41:25 +00:00

1492 lines
66 KiB
Text
Raw Blame History

NAME
gcloud container clusters create - create a cluster for running containers
SYNOPSIS
gcloud container clusters create NAME
[--accelerator=[type=TYPE,[count=COUNT],...]]
[--additional-zones=ZONE,[ZONE,...]] [--addons=[ADDON,...]] [--async]
[--autoprovisioning-network-tags=TAGS,[TAGS,...]]
[--autoscaling-profile=AUTOSCALING_PROFILE]
[--boot-disk-kms-key=BOOT_DISK_KMS_KEY]
[--cloud-run-config=[load-balancer-type=EXTERNAL,...]]
[--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR]
[--cluster-secondary-range-name=NAME]
[--cluster-version=CLUSTER_VERSION]
[--create-subnetwork=[KEY=VALUE,...]]
[--database-encryption-key=DATABASE_ENCRYPTION_KEY]
[--default-max-pods-per-node=DEFAULT_MAX_PODS_PER_NODE]
[--disable-default-snat] [--disk-size=DISK_SIZE]
[--disk-type=DISK_TYPE] [--enable-autorepair] [--no-enable-autoupgrade]
[--enable-binauthz] [--enable-cloud-logging]
[--enable-cloud-monitoring] [--enable-cloud-run-alpha]
[--enable-dataplane-v2] [--enable-gvnic] [--enable-identity-service]
[--enable-image-streaming] [--enable-intra-node-visibility]
[--enable-ip-alias] [--enable-kubernetes-alpha]
[--enable-l4-ilb-subsetting] [--enable-legacy-authorization]
[--enable-master-global-access] [--enable-network-policy]
[--enable-service-externalips] [--enable-shielded-nodes]
[--enable-stackdriver-kubernetes] [--enable-vertical-pod-autoscaling]
[--image-type=IMAGE_TYPE] [--issue-client-certificate]
[--labels=[KEY=VALUE,...]] [--local-ssd-count=LOCAL_SSD_COUNT]
[--logging=[COMPONENT,...]]
[--machine-type=MACHINE_TYPE, -m MACHINE_TYPE]
[--max-nodes-per-pool=MAX_NODES_PER_POOL]
[--max-pods-per-node=MAX_PODS_PER_NODE]
[--max-surge-upgrade=MAX_SURGE_UPGRADE; default=1]
[--max-unavailable-upgrade=MAX_UNAVAILABLE_UPGRADE]
[--metadata=KEY=VALUE,[KEY=VALUE,...]]
[--metadata-from-file=KEY=LOCAL_FILE_PATH,[...]]
[--min-cpu-platform=PLATFORM] [--monitoring=[COMPONENT,...]]
[--network=NETWORK] [--node-labels=[NODE_LABEL,...]]
[--node-locations=ZONE,[ZONE,...]] [--node-taints=[NODE_TAINT,...]]
[--node-version=NODE_VERSION]
[--notification-config=[pubsub=ENABLED|DISABLED,
pubsub-topic=TOPIC,...]] [--num-nodes=NUM_NODES; default=3]
[--preemptible]
[--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
[--release-channel=CHANNEL] [--security-group=SECURITY_GROUP]
[--services-ipv4-cidr=CIDR] [--services-secondary-range-name=NAME]
[--shielded-integrity-monitoring] [--shielded-secure-boot] [--spot]
[--subnetwork=SUBNETWORK]
[--system-config-from-file=SYSTEM_CONFIG_FROM_FILE]
[--tags=TAG,[TAG,...]] [--threads-per-core=THREADS_PER_CORE]
[--workload-metadata=WORKLOAD_METADATA] [--workload-pool=WORKLOAD_POOL]
[--cluster-dns=CLUSTER_DNS --cluster-dns-domain=CLUSTER_DNS_DOMAIN
--cluster-dns-scope=CLUSTER_DNS_SCOPE]
[[--enable-autoprovisioning
: --autoprovisioning-config-file=AUTOPROVISIONING_CONFIG_FILE
| [--max-cpu=MAX_CPU --max-memory=MAX_MEMORY
: --autoprovisioning-image-type=AUTOPROVISIONING_IMAGE_TYPE
--autoprovisioning-locations=ZONE,[ZONE,...]
--autoprovisioning-min-cpu-platform=PLATFORM --min-cpu=MIN_CPU
--min-memory=MIN_MEMORY
--autoprovisioning-max-surge-upgrade=AUTOPROVISIONING_MAX_SURGE_UPGRADE --autoprovisioning-max-unavailable-upgrade=AUTOPROVISIONING_MAX_UNAVAILABLE_UPGRADE --autoprovisioning-scopes=[SCOPE,
...]
--autoprovisioning-service-account=AUTOPROVISIONING_SERVICE_ACCOUNT
--enable-autoprovisioning-autorepair
--enable-autoprovisioning-autoupgrade
[--max-accelerator=[type=TYPE,count=COUNT,...]
: --min-accelerator=[type=TYPE,count=COUNT,...]]]]]
[--enable-autoscaling --max-nodes=MAX_NODES --min-nodes=MIN_NODES]
[--enable-master-authorized-networks
--master-authorized-networks=NETWORK,[NETWORK,...]]
[--enable-network-egress-metering
--enable-resource-consumption-metering
--resource-usage-bigquery-dataset=RESOURCE_USAGE_BIGQUERY_DATASET]
[--enable-private-endpoint
--enable-private-nodes --master-ipv4-cidr=MASTER_IPV4_CIDR]
[--enable-tpu --tpu-ipv4-cidr=CIDR]
[--maintenance-window=START_TIME | --maintenance-window-end=TIME_STAMP
--maintenance-window-recurrence=RRULE
--maintenance-window-start=TIME_STAMP]
[--password=PASSWORD --enable-basic-auth
| --username=USERNAME, -u USERNAME]
[--region=REGION | --zone=ZONE, -z ZONE]
[--reservation=RESERVATION --reservation-affinity=RESERVATION_AFFINITY]
[--scopes=[SCOPE,...];
default="gke-default" --service-account=SERVICE_ACCOUNT]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
Create a cluster for running containers.
EXAMPLES
To create a cluster with the default configuration, run:
$ gcloud container clusters create sample-cluster
POSITIONAL ARGUMENTS
NAME
The name of the cluster to create.
The name may contain only lowercase alphanumerics and '-', must start
with a letter and end with an alphanumeric, and must be no longer than
40 characters.
FLAGS
--accelerator=[type=TYPE,[count=COUNT],...]
Attaches accelerators (e.g. GPUs) to all nodes.
type
(Required) The specific type (e.g. nvidia-tesla-k80 for nVidia
Tesla K80) of accelerator to attach to the instances. Use gcloud
compute accelerator-types list to learn about all available
accelerator types.
count
(Optional) The number of accelerators to attach to the instances.
The default value is 1.
--additional-zones=ZONE,[ZONE,...]
(DEPRECATED) The set of additional zones in which the specified node
footprint should be replicated. All zones must be in the same region as
the cluster's primary zone. If additional-zones is not specified, all
nodes will be in the cluster's primary zone.
Note that NUM_NODES nodes will be created in each zone, such that if
you specify --num-nodes=4 and choose one additional zone, 8 nodes will
be created.
Multiple locations can be specified, separated by commas. For example:
$ gcloud container clusters create example-cluster \
--zone us-central1-a \
--additional-zones us-central1-b,us-central1-c
This flag is deprecated. Use --node-locations=PRIMARY_ZONE,[ZONE,...]
instead.
--addons=[ADDON,...]
Addons
(https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.AddonsConfig)
are additional Kubernetes cluster components. Addons specified by this
flag will be enabled. The others will be disabled. Default addons:
HttpLoadBalancing, HorizontalPodAutoscaling. The Istio addon is
deprecated and will be removed in an upcoming release. For more
information and migration, see
https://cloud.google.com/istio/docs/istio-on-gke/migrate-to-anthos-service-mesh.
ADDON must be one of: HttpLoadBalancing, HorizontalPodAutoscaling,
KubernetesDashboard, NetworkPolicy, NodeLocalDNS, ConfigConnector,
GcePersistentDiskCsiDriver, GcpFilestoreCsiDriver, CloudRun.
--async
Return immediately, without waiting for the operation in progress to
complete.
--autoprovisioning-network-tags=TAGS,[TAGS,...]
Applies the given Compute Engine tags (comma separated) on all nodes in
the auto-provisioned node pools of the new Standard cluster or the new
Autopilot cluster.
Examples:
$ gcloud container clusters create example-cluster \
--autoprovisioning-network-tags=tag1,tag2
New nodes in auto-provisioned node pools, including ones created by
resize or recreate, will have these tags on the Compute Engine API
instance object and can be used in firewall rules. See
https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
for examples.
--autoscaling-profile=AUTOSCALING_PROFILE
Set autoscaling behaviour, choices are 'optimize-utilization' and
'balanced'. Default is 'balanced'.
--boot-disk-kms-key=BOOT_DISK_KMS_KEY
The Customer Managed Encryption Key used to encrypt the boot disk
attached to each node in the node pool. This should be of the form
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME].
For more information about protecting resources with Cloud KMS Keys
please see:
https://cloud.google.com/compute/docs/disks/customer-managed-encryption
--cloud-run-config=[load-balancer-type=EXTERNAL,...]
Configurations for Cloud Run addon, requires --addons=CloudRun for
create and --update-addons=CloudRun=ENABLED for update.
load-balancer-type
(Optional) Type of load-balancer-type EXTERNAL or INTERNAL.
Examples:
$ gcloud container clusters create example-cluster \
--cloud-run-config=load-balancer-type=INTERNAL
--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR
The IP address range for the pods in this cluster in CIDR notation
(e.g. 10.0.0.0/14). Prior to Kubernetes version 1.7.0 this must be a
subset of 10.0.0.0/8; however, starting with version 1.7.0 can be any
RFC 1918 IP range.
If you omit this option, a range is chosen automatically. The
automatically chosen range is randomly selected from 10.0.0.0/8 and
will not include IP address ranges allocated to VMs, existing routes,
or ranges allocated to other clusters. The automatically chosen range
might conflict with reserved IP addresses, dynamic routes, or routes
within VPCs that peer with this cluster. You should specify
--cluster-ipv4-cidr to prevent conflicts.
--cluster-secondary-range-name=NAME
Set the secondary range to be used as the source for pod IPs. Alias
ranges will be allocated from this secondary range. NAME must be the
name of an existing secondary range in the cluster subnetwork.
Must be used in conjunction with '--enable-ip-alias'. Cannot be used
with --create-subnetwork.
--cluster-version=CLUSTER_VERSION
The Kubernetes version to use for the master and nodes. Defaults to
server-specified.
The default Kubernetes version is available using the following
command.
$ gcloud container get-server-config
--create-subnetwork=[KEY=VALUE,...]
Create a new subnetwork for the cluster. The name and range of the
subnetwork can be customized via optional 'name' and 'range' key-value
pairs.
'name' specifies the name of the subnetwork to be created.
'range' specifies the IP range for the new subnetwork. This can either
be a netmask size (e.g. '/20') or a CIDR range (e.g. '10.0.0.0/20'). If
a netmask size is specified, the IP is automatically taken from the
free space in the cluster's network.
Examples:
Create a new subnetwork with a default name and size.
$ gcloud container clusters create --create-subnetwork ""
Create a new subnetwork named "my-subnet" with netmask of size 21.
$ gcloud container clusters create \
--create-subnetwork name=my-subnet,range=/21
Create a new subnetwork with a default name with the primary range of
10.100.0.0/16.
$ gcloud container clusters create \
--create-subnetwork range=10.100.0.0/16
Create a new subnetwork with the name "my-subnet" with a default range.
$ gcloud container clusters create --create-subnetwork name=my-subnet
Can not be specified unless '--enable-ip-alias' is also specified. Can
not be used in conjunction with the '--subnetwork' option.
--database-encryption-key=DATABASE_ENCRYPTION_KEY
Enable Database Encryption.
Enable database encryption that will be used to encrypt Kubernetes
Secrets at the application layer. The key provided should be the
resource ID in the format of
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME].
For more information, see
https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets.
--default-max-pods-per-node=DEFAULT_MAX_PODS_PER_NODE
The default max number of pods per node for node pools in the cluster.
This flag sets the default max-pods-per-node for node pools in the
cluster. If --max-pods-per-node is not specified explicitly for a node
pool, this flag value will be used.
Must be used in conjunction with '--enable-ip-alias'.
--disable-default-snat
Disable default source NAT rules applied in cluster nodes.
By default, cluster nodes perform source network address translation
(SNAT) for packets sent from Pod IP address sources to destination IP
addresses that are not in the non-masquerade CIDRs list. For more
details about SNAT and IP masquerading, see:
https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works
SNAT changes the packet's source IP address to the node's internal IP
address.
When this flag is set, GKE does not perform SNAT for packets sent to
any destination. You must set this flag if the cluster uses privately
reused public IPs.
The --disable-default-snat flag is only applicable to private GKE
clusters, which are inherently VPC-native. Thus, --disable-default-snat
requires that you also set --enable-ip-alias and
--enable-private-nodes.
--disk-size=DISK_SIZE
Size for node VM boot disks in GB. Defaults to 100GB.
--disk-type=DISK_TYPE
Type of the node VM boot disk. Defaults to pd-standard. DISK_TYPE must
be one of: pd-standard, pd-ssd, pd-balanced.
--enable-autorepair
Enable node autorepair feature for a cluster's default node pool(s).
$ gcloud container clusters create example-cluster \
--enable-autorepair
Node autorepair is enabled by default for clusters using COS,
COS_CONTAINERD, UBUNTU or UBUNTU_CONTAINERD as a base image, use
--no-enable-autorepair to disable.
See
https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair
for more info.
--enable-autoupgrade
Sets autoupgrade feature for a cluster's default node pool(s).
$ gcloud container clusters create example-cluster \
--enable-autoupgrade
See https://cloud.google.com/kubernetes-engine/docs/node-auto-upgrades
for more info.
Enabled by default, use --no-enable-autoupgrade to disable.
--enable-binauthz
Enable Binary Authorization for this cluster.
--enable-cloud-logging
(DEPRECATED) Automatically send logs from the cluster to the Google
Cloud Logging API.
Legacy Logging and Monitoring is deprecated. Thus, flag
--enable-cloud-logging is also deprecated and will be removed in an
upcoming release. Please use --logging (optionally with --monitoring).
For more details, please read:
https://cloud.google.com/stackdriver/docs/solutions/gke/installing.
--enable-cloud-monitoring
(DEPRECATED) Automatically send metrics from pods in the cluster to the
Google Cloud Monitoring API. VM metrics will be collected by Google
Compute Engine regardless of this setting.
Legacy Logging and Monitoring is deprecated. Thus, flag
--enable-cloud-monitoring is also deprecated. Please use --monitoring
(optionally with --logging). For more details, please read:
https://cloud.google.com/stackdriver/docs/solutions/gke/installing.
--enable-cloud-run-alpha
Enable Cloud Run alpha features on this cluster. Selecting this option
will result in the cluster having all Cloud Run alpha API groups and
features turned on.
Cloud Run alpha clusters are not covered by the Cloud Run SLA and
should not be used for production workloads.
--enable-dataplane-v2
Enables the new eBPF dataplane for GKE clusters that is required for
network security, scalability and visibility features.
--enable-gvnic
Enable the use of GVNIC for this cluster. Requires re-creation of nodes
using either a node-pool upgrade or node-pool creation.
--enable-identity-service
Enable Identity Service component on the cluster.
When enabled, users can authenticate to Kubernetes cluster with
external identity providers.
Identity Service is by default disabled when creating a new cluster. To
disable Identity Service in an existing cluster, explicitly set flag
--no-enable-identity-service.
--enable-image-streaming
Specifies whether to enable image streaming on cluster.
--enable-intra-node-visibility
Enable Intra-node visibility for this cluster.
Enabling intra-node visibility makes your intra-node pod-to-pod traffic
visible to the networking fabric. With this feature, you can use VPC
flow logging or other VPC features for intra-node traffic.
Enabling it on an existing cluster causes the cluster master and the
cluster nodes to restart, which might cause a disruption.
--enable-ip-alias
Enable use of alias IPs
(https://cloud.google.com/compute/docs/alias-ip/) for Pod IPs. This
will require at least two secondary ranges in the subnetwork, one for
the pod IPs and another to reserve space for the services range.
--enable-kubernetes-alpha
Enable Kubernetes alpha features on this cluster. Selecting this option
will result in the cluster having all Kubernetes alpha API groups and
features turned on. Cluster upgrades (both manual and automatic) will
be disabled and the cluster will be automatically deleted after 30
days.
Alpha clusters are not covered by the Kubernetes Engine SLA and should
not be used for production workloads.
--enable-l4-ilb-subsetting
Enable Subsetting for L4 ILB services created on this cluster.
--enable-legacy-authorization
Enables the legacy ABAC authentication for the cluster. User rights are
granted through the use of policies which combine attributes together.
For a detailed look at these properties and related formats, see
https://kubernetes.io/docs/admin/authorization/abac/. To use RBAC
permissions instead, create or update your cluster with the option
--no-enable-legacy-authorization.
--enable-master-global-access
Use with private clusters to allow access to the master's private
endpoint from any Google Cloud region or on-premises environment
regardless of the private cluster's region.
Must be used in conjunction with '--enable-ip-alias' and
'--enable-private-nodes'.
--enable-network-policy
Enable network policy enforcement for this cluster. If you are enabling
network policy on an existing cluster the network policy addon must
first be enabled on the master by using
--update-addons=NetworkPolicy=ENABLED flag.
--enable-service-externalips
Enables use of services with externalIPs field.
--enable-shielded-nodes
Enable Shielded Nodes for this cluster. Enabling Shielded Nodes will
enable a more secure Node credential bootstrapping implementation.
Starting with version 1.18, clusters will have Shielded GKE nodes by
default.
--enable-stackdriver-kubernetes
(DEPRECATED) Enable Cloud Operations for GKE.
The --enable-stackdriver-kubernetes flag is deprecated and will be
removed in an upcoming release. Please use --logging and --monitoring
instead. For more information, please read:
https://cloud.google.com/stackdriver/docs/solutions/gke/installing.
Flags for vertical pod autoscaling:
--enable-vertical-pod-autoscaling
Enable vertical pod autoscaling for a cluster.
--image-type=IMAGE_TYPE
The image type to use for the cluster. Defaults to server-specified.
Image Type specifies the base OS that the nodes in the cluster will run
on. If an image type is specified, that will be assigned to the cluster
and all future upgrades will use the specified image type. If it is not
specified the server will pick the default image type.
The default image type and the list of valid image types are available
using the following command.
$ gcloud container get-server-config
--issue-client-certificate
Issue a TLS client certificate with admin permissions.
When enabled, the certificate and private key pair will be present in
MasterAuth field of the Cluster object. For cluster versions before
1.12, a client certificate will be issued by default. As of 1.12,
client certificates are disabled by default.
--labels=[KEY=VALUE,...]
Labels to apply to the Google Cloud resources in use by the Kubernetes
Engine cluster. These are unrelated to Kubernetes labels.
Examples:
$ gcloud container clusters create example-cluster \
--labels=label_a=value1,label_b=,label_c=value3
--local-ssd-count=LOCAL_SSD_COUNT
The number of local SSD disks to provision on each node, formatted and
mounted in the filesystem.
Local SSDs have a fixed 375 GB capacity per device. The number of disks
that can be attached to an instance is limited by the maximum number of
disks available on a machine, which differs by compute zone. See
https://cloud.google.com/compute/docs/disks/local-ssd for more
information.
--logging=[COMPONENT,...]
Set the components that have logging enabled. Valid component values
are: SYSTEM, WORKLOAD, NONE
For more information, look at
https://cloud.google.com/stackdriver/docs/solutions/gke/installing#available-logs
Examples:
$ gcloud container clusters create --logging=SYSTEM
$ gcloud container clusters create --logging=SYSTEM,WORKLOAD
$ gcloud container clusters create --logging=NONE
--machine-type=MACHINE_TYPE, -m MACHINE_TYPE
The type of machine to use for nodes. Defaults to e2-medium. The list
of predefined machine types is available using the following command:
$ gcloud compute machine-types list
You can also specify custom machine types with the string
"custom-CPUS-RAM" where "CPUS" is the number of virtual CPUs and "RAM"
is the amount of RAM in MiB.
For example, to create a node pool using custom machines with 2 vCPUs
and 12 GB of RAM:
$ gcloud container clusters create high-mem-pool \
--machine-type=custom-2-12288
--max-nodes-per-pool=MAX_NODES_PER_POOL
The maximum number of nodes to allocate per default initial node pool.
Kubernetes Engine will automatically create enough nodes pools such
that each node pool contains less than --max-nodes-per-pool nodes.
Defaults to 1000 nodes, but can be set as low as 100 nodes per pool on
initial create.
--max-pods-per-node=MAX_PODS_PER_NODE
The max number of pods per node for this node pool.
This flag sets the maximum number of pods that can be run at the same
time on a node. This will override the value given with
--default-max-pods-per-node flag set at the cluster level.
Must be used in conjunction with '--enable-ip-alias'.
--max-surge-upgrade=MAX_SURGE_UPGRADE; default=1
Number of extra (surge) nodes to be created on each upgrade of a node
pool.
Specifies the number of extra (surge) nodes to be created during this
node pool's upgrades. For example, running the following command will
result in creating an extra node each time the node pool is upgraded:
$ gcloud container clusters create example-cluster \
--max-surge-upgrade=1 --max-unavailable-upgrade=0
Must be used in conjunction with '--max-unavailable-upgrade'.
--max-unavailable-upgrade=MAX_UNAVAILABLE_UPGRADE
Number of nodes that can be unavailable at the same time on each
upgrade of a node pool.
Specifies the number of nodes that can be unavailable at the same time
while this node pool is being upgraded. For example, running the
following command will result in having 3 nodes being upgraded in
parallel (1 + 2), but keeping always at least 3 (5 - 2) available each
time the node pool is upgraded:
$ gcloud container clusters create example-cluster --num-nodes=5 \
--max-surge-upgrade=1 --max-unavailable-upgrade=2
Must be used in conjunction with '--max-surge-upgrade'.
--metadata=KEY=VALUE,[KEY=VALUE,...]
Compute Engine metadata to be made available to the guest operating
system running on nodes within the node pool.
Each metadata entry is a key/value pair separated by an equals sign.
Metadata keys must be unique and less than 128 bytes in length. Values
must be less than or equal to 32,768 bytes in length. The total size of
all keys and values must be less than 512 KB. Multiple arguments can be
passed to this flag. For example:
--metadata key-1=value-1,key-2=value-2,key-3=value-3
Additionally, the following keys are reserved for use by Kubernetes
Engine:
◆ cluster-location
◆ cluster-name
◆ cluster-uid
◆ configure-sh
◆ enable-os-login
◆ gci-update-strategy
◆ gci-ensure-gke-docker
◆ instance-template
◆ kube-env
◆ startup-script
◆ user-data
Google Kubernetes Engine sets the following keys by default:
◆ serial-port-logging-enable
See also Compute Engine's documentation
(https://cloud.google.com/compute/docs/storing-retrieving-metadata) on
storing and retrieving instance metadata.
--metadata-from-file=KEY=LOCAL_FILE_PATH,[...]
Same as --metadata except that the value for the entry will be read
from a local file.
--min-cpu-platform=PLATFORM
When specified, the nodes for the new cluster's default node pool will
be scheduled on host with specified CPU architecture or a newer one.
Examples:
$ gcloud container clusters create example-cluster \
--min-cpu-platform=PLATFORM
To list available CPU platforms in given zone, run:
$ gcloud beta compute zones describe ZONE \
--format="value(availableCpuPlatforms)"
CPU platform selection is available only in selected zones.
--monitoring=[COMPONENT,...]
Set the components that have monitoring enabled. Valid component values
are: SYSTEM, WORKLOAD (Deprecated), NONE
For more information, look at
https://cloud.google.com/stackdriver/docs/solutions/gke/installing#available-metrics
Examples:
$ gcloud container clusters create --monitoring=SYSTEM
$ gcloud container clusters create --monitoring=NONE
--network=NETWORK
The Compute Engine Network that the cluster will connect to. Google
Kubernetes Engine will use this network when creating routes and
firewalls for the clusters. Defaults to the 'default' network.
--node-labels=[NODE_LABEL,...]
Applies the given Kubernetes labels on all nodes in the new node pool.
Examples:
$ gcloud container clusters create example-cluster \
--node-labels=label-a=value1,label-2=value2
New nodes, including ones created by resize or recreate, will have
these labels on the Kubernetes API node object and can be used in
nodeSelectors. See http://kubernetes.io/docs/user-guide/node-selection/
for examples.
Note that Kubernetes labels, intended to associate cluster components
and resources with one another and manage resource lifecycles, are
different from Google Kubernetes Engine labels that are used for the
purpose of tracking billing and usage information.
--node-locations=ZONE,[ZONE,...]
The set of zones in which the specified node footprint should be
replicated. All zones must be in the same region as the cluster's
master(s), specified by the --zone or --region flag. Additionally, for
zonal clusters, --node-locations must contain the cluster's primary
zone. If not specified, all nodes will be in the cluster's primary zone
(for zonal clusters) or spread across three randomly chosen zones
within the cluster's region (for regional clusters).
Note that NUM_NODES nodes will be created in each zone, such that if
you specify --num-nodes=4 and choose two locations, 8 nodes will be
created.
Multiple locations can be specified, separated by commas. For example:
$ gcloud container clusters create example-cluster \
--zone us-central1-a \
--node-locations us-central1-a,us-central1-b
--node-taints=[NODE_TAINT,...]
Applies the given kubernetes taints on all nodes in default node
pool(s) in new cluster, which can be used with tolerations for pod
scheduling.
Examples:
$ gcloud container clusters create example-cluster \
--node-taints=key1=val1:NoSchedule,key2=val2:PreferNoSchedule
To read more about node-taints, see
https://cloud.google.com/kubernetes-engine/docs/node-taints.
--node-version=NODE_VERSION
The Kubernetes version to use for nodes. Defaults to server-specified.
The default Kubernetes version is available using the following
command.
$ gcloud container get-server-config
--notification-config=[pubsub=ENABLED|DISABLED,pubsub-topic=TOPIC,...]
The notification configuration of the cluster. GKE supports publishing
cluster upgrade notifications to any Pub/Sub topic you created in the
same project. Create a subscription for the topic specified to receive
notification messages. See https://cloud.google.com/pubsub/docs/admin
on how to manage Pub/Sub topics and subscriptions. You can also use the
filter option to specify which event types you'd like to receive from
the following options: SecurityBulletinEvent, UpgradeEvent,
UpgradeAvailableEvent.
Examples:
$ gcloud container clusters create example-cluster \
--notification-config=pubsub=ENABLED,pubsub-topic=projects/\
{project}/topics/{topic-name}
$ gcloud container clusters create example-cluster \
--notification-config=pubsub=ENABLED,pubsub-topic=projects/\
{project}/topics/{topic-name},\
filter="SecurityBulletinEvent|UpgradeEvent"
The project of the Pub/Sub topic must be the same one as the cluster.
It can be either the project ID or the project number.
--num-nodes=NUM_NODES; default=3
The number of nodes to be created in each of the cluster's zones.
--preemptible
Create nodes using preemptible VM instances in the new cluster.
$ gcloud container clusters create example-cluster --preemptible
New nodes, including ones created by resize or recreate, will use
preemptible VM instances. See
https://cloud.google.com/kubernetes-engine/docs/preemptible-vm for more
information on how to use Preemptible VMs with Kubernetes Engine.
--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
Sets the type of private access to Google services over IPv6.
PRIVATE_IPV6_GOOGLE_ACCESS_TYPE must be one of:
bidirectional
Allows Google services to initiate connections to GKE pods in this
cluster. This is not intended for common use, and requires previous
integration with Google services.
disabled
Default value. Disables private access to Google services over IPv6.
outbound-only
Allows GKE pods to make fast, secure requests to Google services
over IPv6. This is the most common use of private IPv6 access.
$ gcloud alpha container clusters create \
--private-ipv6-google-access-type=disabled
$ gcloud alpha container clusters create \
--private-ipv6-google-access-type=outbound-only
$ gcloud alpha container clusters create \
--private-ipv6-google-access-type=bidirectional
PRIVATE_IPV6_GOOGLE_ACCESS_TYPE must be one of: bidirectional,
disabled, outbound-only.
--release-channel=CHANNEL
Release channel a cluster is subscribed to.
When a cluster is subscribed to a release channel, Google maintains
both the master version and the node version. Node auto-upgrade
defaults to true and cannot be disabled.
CHANNEL must be one of:
None
Use 'None' to opt-out of any release channel.
rapid
'rapid' channel is offered on an early access basis for customers
who want to test new releases.
WARNING: Versions available in the 'rapid' channel may be subject
to unresolved issues with no known workaround and are not subject
to any SLAs.
regular
Clusters subscribed to 'regular' receive versions that are
considered GA quality. 'regular' is intended for production users
who want to take advantage of new features.
stable
Clusters subscribed to 'stable' receive versions that are known to
be stable and reliable in production.
--security-group=SECURITY_GROUP
The name of the RBAC security group for use with Google security groups
in Kubernetes RBAC
(https://kubernetes.io/docs/reference/access-authn-authz/rbac/).
To include group membership as part of the claims issued by Google
during authentication, a group must be designated as a security group
by including it as a direct member of this group.
If unspecified, no groups will be returned for use with RBAC.
--services-ipv4-cidr=CIDR
Set the IP range for the services IPs.
Can be specified as a netmask size (e.g. '/20') or as in CIDR notion
(e.g. '10.100.0.0/20'). If given as a netmask size, the IP range will
be chosen automatically from the available space in the network.
If unspecified, the services CIDR range will be chosen with a default
mask size.
Can not be specified unless '--enable-ip-alias' is also specified.
--services-secondary-range-name=NAME
Set the secondary range to be used for services (e.g. ClusterIPs). NAME
must be the name of an existing secondary range in the cluster
subnetwork.
Must be used in conjunction with '--enable-ip-alias'. Cannot be used
with --create-subnetwork.
--shielded-integrity-monitoring
Enables monitoring and attestation of the boot integrity of the
instance. The attestation is performed against the integrity policy
baseline. This baseline is initially derived from the implicitly
trusted boot image when the instance is created.
--shielded-secure-boot
The instance will boot with secure boot enabled.
--spot
Create nodes using spot VM instances in the new cluster.
$ gcloud container clusters create example-cluster --spot
New nodes, including ones created by resize or recreate, will use spot
VM instances.
--subnetwork=SUBNETWORK
The Google Compute Engine subnetwork
(https://cloud.google.com/compute/docs/subnetworks) to which the
cluster is connected. The subnetwork must belong to the network
specified by --network.
Cannot be used with the "--create-subnetwork" option.
--system-config-from-file=SYSTEM_CONFIG_FROM_FILE
Path of the YAML/JSON file that contains the node configuration,
including Linux kernel parameters (sysctls) and kubelet configs.
Examples:
kubeletConfig:
cpuManagerPolicy: static
linuxConfig:
sysctl:
net.core.somaxconn: '2048'
net.ipv4.tcp_rmem: '4096 87380 6291456'
List of supported kubelet configs in 'kubeletConfig'.
KEY VALUE
cpuManagerPolicy either 'static' or 'none'
cpuCFSQuota true or false (enabled by default)
cpuCFSQuotaPeriod interval (e.g., '100ms')
podPidsLimit integer (The value must be greater than or equal to
1024 and less than 4194304.)
List of supported sysctls in 'linuxConfig'.
KEY VALUE
net.core.netdev_max_backlog Any positive integer, less
than 2147483647
net.core.rmem_max Any positive integer, less
than 2147483647
net.core.wmem_default Any positive integer, less
than 2147483647
net.core.wmem_max Any positive integer, less
than 2147483647
net.core.optmem_max Any positive integer, less
than 2147483647
net.core.somaxconn Must be [128, 2147483647]
net.ipv4.tcp_rmem Any positive integer tuple
net.ipv4.tcp_wmem Any positive integer tuple
net.ipv4.tcp_tw_reuse Must be {0, 1}
Note, updating the system configuration of an existing node pool
requires recreation of the nodes which which might cause a disruption.
--tags=TAG,[TAG,...]
Applies the given Compute Engine tags (comma separated) on all nodes in
the new node-pool.
Examples:
$ gcloud container clusters create example-cluster --tags=tag1,tag2
New nodes, including ones created by resize or recreate, will have
these tags on the Compute Engine API instance object and can be used in
firewall rules. See
https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
for examples.
--threads-per-core=THREADS_PER_CORE
The number of visible threads per physical core for each node. To
disable simultaneous multithreading (SMT) set this to 1.
--workload-metadata=WORKLOAD_METADATA
Type of metadata server available to pods running in the node pool.
WORKLOAD_METADATA must be one of:
GCE_METADATA
Pods running in this node pool have access to the node's underlying
Compute Engine Metadata Server.
GKE_METADATA
Run the Kubernetes Engine Metadata Server on this node. The
Kubernetes Engine Metadata Server exposes a metadata API to
workloads that is compatible with the V1 Compute Metadata APIs
exposed by the Compute Engine and App Engine Metadata Servers. This
feature can only be enabled if Workload Identity is enabled at the
cluster level.
--workload-pool=WORKLOAD_POOL
Enable Workload Identity on the cluster.
When enabled, Kubernetes service accounts will be able to act as Cloud
IAM Service Accounts, through the provided workload pool.
Currently, the only accepted workload pool is the workload pool of the
Cloud project containing the cluster, PROJECT_ID.svc.id.goog.
For more information on Workload Identity, see
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
ClusterDNS
--cluster-dns=CLUSTER_DNS
DNS provider to use for this cluster. CLUSTER_DNS must be one of:
clouddns
Selects Cloud DNS as the DNS provider for the cluster.
default
Selects the default DNS provider (kube-dns) for the cluster.
--cluster-dns-domain=CLUSTER_DNS_DOMAIN
DNS domain for this cluster. The default value is cluster.local. This
is configurable when --cluster-dns=clouddns and
--cluster-dns-scope=vpc are set. The value must be a valid DNS
subdomain as defined in RFC 1123.
--cluster-dns-scope=CLUSTER_DNS_SCOPE
DNS scope for the Cloud DNS zone created - valid only with
--cluster-dns=clouddns
CLUSTER_DNS_SCOPE must be one of:
cluster
Configures the Cloud DNS zone to be private to the cluster.
vpc
Configures the Cloud DNS zone to be private to the VPC Network.
Node autoprovisioning
--enable-autoprovisioning
Enables node autoprovisioning for a cluster.
Cluster Autoscaler will be able to create new node pools. Requires
maximum CPU and memory limits to be specified.
This flag must be specified if any of the other arguments in this
group are specified.
At most one of these can be specified:
--autoprovisioning-config-file=AUTOPROVISIONING_CONFIG_FILE
Path of the JSON/YAML file which contains information about the
cluster's node autoprovisioning configuration. Currently it
contains a list of resource limits, identity defaults for
autoprovisioning, node upgrade settings, node management settings,
minimum cpu platform, image type, node locations for
autoprovisioning, disk type and size configuration, Shielded
instance settings, and customer-managed encryption keys settings.
Resource limits are specified in the field 'resourceLimits'. Each
resource limits definition contains three fields: resourceType,
maximum and minimum. Resource type can be "cpu", "memory" or an
accelerator (e.g. "nvidia-tesla-k80" for nVidia Tesla K80). Use
gcloud compute accelerator-types list to learn about available
accelerator types. Maximum is the maximum allowed amount with the
unit of the resource. Minimum is the minimum allowed amount with
the unit of the resource.
Identity default contains at most one of the below fields:
serviceAccount: The Google Cloud Platform Service Account to be
used by node VMs in autoprovisioned node pools. If not specified,
the project's default service account is used. scopes: A list of
scopes to be used by node instances in autoprovisioned node pools.
Multiple scopes can be specified, separated by commas. For
information on defaults, look at:
https://cloud.google.com/sdk/gcloud/reference/container/clusters/create#--scopes
Node Upgrade settings are specified under the field
'upgradeSettings', which has the following fields: maxSurgeUpgrade:
Number of extra (surge) nodes to be created on each upgrade of an
autoprovisioned node pool. maxUnavailableUpgrade: Number of nodes
that can be unavailable at the same time on each upgrade of an
autoprovisioned node pool.
Node Management settings are specified under the field
'nodeManagement', which has the following fields:
enableAutoUpgrade: A boolean field that indicates if node
autoupgrade is enabled for autoprovisioned node pools.
enableAutoRepair: A boolean field that indicates if node autorepair
is enabled for autoprovisioned node pools.
minCpuPlatform (deprecated): If specified, new autoprovisioned
nodes will be scheduled on host with specified CPU architecture or
a newer one. Note: Min CPU platform can only be specified in Beta
and Alpha.
Autoprovisioned node image is specified under the 'imageType'
field. If not specified the default value will be applied.
Autoprovisioning locations is a set of zones where new node pools
can be created by Autoprovisioning. Autoprovisioning locations are
specified in the field 'autoprovisioningLocations'. All zones must
be in the same region as the cluster's master(s).
Disk type and size are specified under the 'diskType' and
'diskSizeGb' fields, respectively. If specified, new
autoprovisioned nodes will be created with custom boot disks
configured by these settings.
Shielded instance settings are specified under the
'shieldedInstanceConfig' field, which has the following fields:
enableSecureBoot: A boolean field that indicates if secure boot is
enabled for autoprovisioned nodes. enableIntegrityMonitoring: A
boolean field that indicates if integrity monitoring is enabled for
autoprovisioned nodes.
Customer Managed Encryption Keys (CMEK) used by new
auto-provisioned node pools can be specified in the
'bootDiskKmsKey' field.
Flags to configure autoprovisioned nodes
--max-cpu=MAX_CPU
Maximum number of cores in the cluster.
Maximum number of cores to which the cluster can scale.
This flag must be specified if any of the other arguments in this
group are specified.
--max-memory=MAX_MEMORY
Maximum memory in the cluster.
Maximum number of gigabytes of memory to which the cluster can
scale.
This flag must be specified if any of the other arguments in this
group are specified.
--autoprovisioning-image-type=AUTOPROVISIONING_IMAGE_TYPE
Node Autoprovisioning will create new nodes with the specified
image type
--autoprovisioning-locations=ZONE,[ZONE,...]
Set of zones where new node pools can be created by
autoprovisioning. All zones must be in the same region as the
cluster's master(s). Multiple locations can be specified,
separated by commas.
--autoprovisioning-min-cpu-platform=PLATFORM
(DEPRECATED) If specified, new autoprovisioned nodes will be
scheduled on host with specified CPU architecture or a newer one.
The --autoprovisioning-min-cpu-platform flag is deprecated and
will be removed in an upcoming release. More info:
https://cloud.google.com/kubernetes-engine/docs/release-notes#March_08_2022
--min-cpu=MIN_CPU
Minimum number of cores in the cluster.
Minimum number of cores to which the cluster can scale.
--min-memory=MIN_MEMORY
Minimum memory in the cluster.
Minimum number of gigabytes of memory to which the cluster can
scale.
Flags to specify upgrade settings for autoprovisioned nodes:
--autoprovisioning-max-surge-upgrade=AUTOPROVISIONING_MAX_SURGE_UPGRADE
Number of extra (surge) nodes to be created on each upgrade of
an autoprovisioned node pool.
--autoprovisioning-max-unavailable-upgrade=AUTOPROVISIONING_MAX_UNAVAILABLE_UPGRADE
Number of nodes that can be unavailable at the same time on
each upgrade of an autoprovisioned node pool.
Flags to specify identity for autoprovisioned nodes:
--autoprovisioning-scopes=[SCOPE,...]
The scopes to be used by node instances in autoprovisioned node
pools. Multiple scopes can be specified, separated by commas.
For information on defaults, look at:
https://cloud.google.com/sdk/gcloud/reference/container/clusters/create#--scopes
--autoprovisioning-service-account=AUTOPROVISIONING_SERVICE_ACCOUNT
The Google Cloud Platform Service Account to be used by node
VMs in autoprovisioned node pools. If not specified, the
project default service account is used.
Flags to specify node management settings for autoprovisioned nodes:
--enable-autoprovisioning-autorepair
Enable node autorepair for autoprovisioned node pools. Use
--no-enable-autoprovisioning-autorepair to disable.
This flag must be specified if any of the other arguments in
this group are specified.
--enable-autoprovisioning-autoupgrade
Enable node autoupgrade for autoprovisioned node pools. Use
--no-enable-autoprovisioning-autoupgrade to disable.
This flag must be specified if any of the other arguments in
this group are specified.
Arguments to set limits on accelerators:
--max-accelerator=[type=TYPE,count=COUNT,...]
Sets maximum limit for a single type of accelerators (e.g.
GPUs) in cluster.
type
(Required) The specific type (e.g. nvidia-tesla-k80 for
nVidia Tesla K80) of accelerator for which the limit is
set. Use gcloud compute accelerator-types list to learn
about all available accelerator types.
count
(Required) The maximum number of accelerators to which the
cluster can be scaled.
This flag must be specified if any of the other arguments
in this group are specified.
--min-accelerator=[type=TYPE,count=COUNT,...]
Sets minimum limit for a single type of accelerators (e.g.
GPUs) in cluster. Defaults to 0 for all accelerator types if it
isn't set.
type
(Required) The specific type (e.g. nvidia-tesla-k80 for
nVidia Tesla K80) of accelerator for which the limit is
set. Use gcloud compute accelerator-types list to learn
about all available accelerator types.
count
(Required) The minimum number of accelerators to which the
cluster can be scaled.
Cluster autoscaling
--enable-autoscaling
Enables autoscaling for a node pool.
Enables autoscaling in the node pool specified by --node-pool or the
default node pool if --node-pool is not provided.
--max-nodes=MAX_NODES
Maximum number of nodes per zone in the node pool.
Maximum number of nodes per zone to which the node pool specified by
--node-pool (or default node pool if unspecified) can scale. Ignored
unless --enable-autoscaling is also specified.
--min-nodes=MIN_NODES
Minimum number of nodes per zone in the node pool.
Minimum number of nodes per zone to which the node pool specified by
--node-pool (or default node pool if unspecified) can scale. Ignored
unless --enable-autoscaling is also specified.
Master Authorized Networks
--enable-master-authorized-networks
Allow only specified set of CIDR blocks (specified by the
--master-authorized-networks flag) to connect to Kubernetes master
through HTTPS. Besides these blocks, the following have access as
well:
1) The private network the cluster connects to if
`--enable-private-nodes` is specified.
2) Google Compute Engine Public IPs if `--enable-private-nodes` is not
specified.
Use --no-enable-master-authorized-networks to disable. When disabled,
public internet (0.0.0.0/0) is allowed to connect to Kubernetes
master through HTTPS.
--master-authorized-networks=NETWORK,[NETWORK,...]
The list of CIDR blocks (up to 100 for private cluster, 50 for public
cluster) that are allowed to connect to Kubernetes master through
HTTPS. Specified in CIDR notation (e.g. 1.2.3.4/30). Cannot be
specified unless --enable-master-authorized-networks is also
specified.
Exports cluster's usage of cloud resources
--enable-network-egress-metering
Enable network egress metering on this cluster.
When enabled, a DaemonSet is deployed into the cluster. Each
DaemonSet pod meters network egress traffic by collecting data from
the conntrack table, and exports the metered metrics to the specified
destination.
Network egress metering is disabled if this flag is omitted, or when
--no-enable-network-egress-metering is set.
--enable-resource-consumption-metering
Enable resource consumption metering on this cluster.
When enabled, a table will be created in the specified BigQuery
dataset to store resource consumption data. The resulting table can
be joined with the resource usage table or with BigQuery billing
export.
Resource consumption metering is enabled unless --no-enable-resource-
consumption-metering is set.
--resource-usage-bigquery-dataset=RESOURCE_USAGE_BIGQUERY_DATASET
The name of the BigQuery dataset to which the cluster's usage of
cloud resources is exported. A table will be created in the specified
dataset to store cluster resource usage. The resulting table can be
joined with BigQuery Billing Export to produce a fine-grained cost
breakdown.
Examples:
$ gcloud container clusters create example-cluster \
--resource-usage-bigquery-dataset=example_bigquery_dataset_name
Private Clusters
--enable-private-endpoint
Cluster is managed using the private IP address of the master API
endpoint.
--enable-private-nodes
Cluster is created with no public IP addresses on the cluster nodes.
--master-ipv4-cidr=MASTER_IPV4_CIDR
IPv4 CIDR range to use for the master network. This should have a
netmask of size /28 and should be used in conjunction with the
--enable-private-nodes flag.
Flags relating to Cloud TPUs:
--enable-tpu
Enable Cloud TPUs for this cluster.
Can not be specified unless --enable-ip-alias is also specified.
--tpu-ipv4-cidr=CIDR
Set the IP range for the Cloud TPUs.
Can be specified as a netmask size (e.g. '/20') or as in CIDR notion
(e.g. '10.100.0.0/20'). If given as a netmask size, the IP range will
be chosen automatically from the available space in the network.
If unspecified, the TPU CIDR range will use automatic default '/20'.
Can not be specified unless '--enable-tpu' and '--enable-ip-alias'
are also specified.
One of either maintenance-window or the group of maintenance-window flags
can be set.
At most one of these can be specified:
--maintenance-window=START_TIME
Set a time of day when you prefer maintenance to start on this
cluster. For example:
$ gcloud container clusters create example-cluster \
--maintenance-window=12:43
The time corresponds to the UTC time zone, and must be in HH:MM
format.
Non-emergency maintenance will occur in the 4 hour block starting
at the specified time.
This is mutually exclusive with the recurring maintenance windows
and will overwrite any existing window. Compatible with maintenance
exclusions.
Set a flexible maintenance window by specifying a window that recurs
per an RFC 5545 RRULE. Non-emergency maintenance will occur in the
recurring windows.
Examples:
For a 9-5 Mon-Wed UTC-4 maintenance window:
$ gcloud container clusters create example-cluster \
--maintenance-window-start=2000-01-01T09:00:00-04:00 \
--maintenance-window-end=2000-01-01T17:00:00-04:00 \
--maintenance-window-recurrence='FREQ=WEEKLY;BYDAY=MO,TU,WE'
For a daily window from 22:00 - 04:00 UTC:
$ gcloud container clusters create example-cluster \
--maintenance-window-start=2000-01-01T22:00:00Z \
--maintenance-window-end=2000-01-02T04:00:00Z \
--maintenance-window-recurrence=FREQ=DAILY
--maintenance-window-end=TIME_STAMP
End time of the first window (can occur in the past). Must take
place after the start time. The difference in start and end time
specifies the length of each recurrence. See $ gcloud topic
datetimes for information on time formats.
This flag must be specified if any of the other arguments in this
group are specified.
--maintenance-window-recurrence=RRULE
An RFC 5545 RRULE, specifying how the window will recur. Note
that minimum requirements for maintenance periods will be
enforced. Note that FREQ=SECONDLY, MINUTELY, and HOURLY are not
supported.
This flag must be specified if any of the other arguments in this
group are specified.
--maintenance-window-start=TIME_STAMP
Start time of the first window (can occur in the past). The start
time influences when the window will start for recurrences. See $
gcloud topic datetimes for information on time formats.
This flag must be specified if any of the other arguments in this
group are specified.
Basic auth
--password=PASSWORD
The password to use for cluster auth. Defaults to a server-specified
randomly-generated string.
Options to specify the username.
At most one of these can be specified:
--enable-basic-auth
Enable basic (username/password) auth for the cluster.
--enable-basic-auth is an alias for --username=admin;
--no-enable-basic-auth is an alias for --username="". Use
--password to specify a password; if not, the server will randomly
generate one. For cluster versions before 1.12, if neither
--enable-basic-auth nor --username is specified,
--enable-basic-auth will default to true. After 1.12,
--enable-basic-auth will default to false.
--username=USERNAME, -u USERNAME
The user name to use for basic auth for the cluster. Use --password
to specify a password; if not, the server will randomly generate
one.
At most one of these can be specified:
--region=REGION
Compute region (e.g. us-central1) for the cluster.
--zone=ZONE, -z ZONE
Compute zone (e.g. us-central1-a) for the cluster. Overrides the
default compute/zone property value for this command invocation.
Specifies the reservation for the default initial node pool.
--reservation=RESERVATION
The name of the reservation, required when
--reservation-affinity=specific.
--reservation-affinity=RESERVATION_AFFINITY
The type of the reservation for the default initial node pool.
RESERVATION_AFFINITY must be one of: any, none, specific.
Options to specify the node identity.
Scopes options.
--scopes=[SCOPE,...]; default="gke-default"
Specifies scopes for the node instances.
Examples:
$ gcloud container clusters create example-cluster \
--scopes=https://www.googleapis.com/auth/devstorage.read_only
$ gcloud container clusters create example-cluster \
--scopes=bigquery,storage-rw,compute-ro
Multiple scopes can be specified, separated by commas. Various
scopes are automatically added based on feature usage. Such scopes
are not added if an equivalent scope already exists.
▫ monitoring-write: always added to ensure metrics can be written
▫ logging-write: added if Cloud Logging is enabled
(--enable-cloud-logging/--logging)
▫ monitoring: added if Cloud Monitoring is enabled
(--enable-cloud-monitoring/--monitoring)
▫ gke-default: added for Autopilot clusters that use the default
service account
▫ cloud-platform: added for Autopilot clusters that use any other
service account
SCOPE can be either the full URI of the scope or an alias. Default
scopes are assigned to all instances. Available aliases are:
Alias URI
bigquery https://www.googleapis.com/auth/bigquery
cloud-platform https://www.googleapis.com/auth/cloud-platform
cloud-source-repos https://www.googleapis.com/auth/source.full_control
cloud-source-repos-ro https://www.googleapis.com/auth/source.read_only
compute-ro https://www.googleapis.com/auth/compute.readonly
compute-rw https://www.googleapis.com/auth/compute
datastore https://www.googleapis.com/auth/datastore
default https://www.googleapis.com/auth/devstorage.read_only
https://www.googleapis.com/auth/logging.write
https://www.googleapis.com/auth/monitoring.write
https://www.googleapis.com/auth/pubsub
https://www.googleapis.com/auth/service.management.readonly
https://www.googleapis.com/auth/servicecontrol
https://www.googleapis.com/auth/trace.append
gke-default https://www.googleapis.com/auth/devstorage.read_only
https://www.googleapis.com/auth/logging.write
https://www.googleapis.com/auth/monitoring
https://www.googleapis.com/auth/service.management.readonly
https://www.googleapis.com/auth/servicecontrol
https://www.googleapis.com/auth/trace.append
logging-write https://www.googleapis.com/auth/logging.write
monitoring https://www.googleapis.com/auth/monitoring
monitoring-read https://www.googleapis.com/auth/monitoring.read
monitoring-write https://www.googleapis.com/auth/monitoring.write
pubsub https://www.googleapis.com/auth/pubsub
service-control https://www.googleapis.com/auth/servicecontrol
service-management https://www.googleapis.com/auth/service.management.readonly
sql (deprecated) https://www.googleapis.com/auth/sqlservice
sql-admin https://www.googleapis.com/auth/sqlservice.admin
storage-full https://www.googleapis.com/auth/devstorage.full_control
storage-ro https://www.googleapis.com/auth/devstorage.read_only
storage-rw https://www.googleapis.com/auth/devstorage.read_write
taskqueue https://www.googleapis.com/auth/taskqueue
trace https://www.googleapis.com/auth/trace.append
userinfo-email https://www.googleapis.com/auth/userinfo.email
DEPRECATION WARNING: https://www.googleapis.com/auth/sqlservice
account scope and sql alias do not provide SQL instance management
capabilities and have been deprecated. Please, use
https://www.googleapis.com/auth/sqlservice.admin or sql-admin to
manage your Google SQL Service instances.
--service-account=SERVICE_ACCOUNT
The Google Cloud Platform Service Account to be used by the node VMs.
If a service account is specified, the cloud-platform and
userinfo.email scopes are used. If no Service Account is specified,
the project default service account is used.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
These variants are also available:
$ gcloud alpha container clusters create
$ gcloud beta container clusters create
View git blame Copy permalink