POSITIONAL ARGUMENTS

NAME

The name of the cluster to create.
The name may contain only lowercase alphanumerics and '-', must start with a letter and end with an alphanumeric, and must be no longer than 40 characters.

FLAGS

--accelerator=[type=TYPE,[count=COUNT],...]

Attaches accelerators (e.g. GPUs) to all nodes.

type

(Required) The specific type (e.g. nvidia-tesla-k80 for nVidia Tesla K80) of accelerator to attach to the instances. Use gcloud compute accelerator-types list to learn about all available accelerator types.

count

(Optional) The number of accelerators to attach to the instances. The default value is 1.

--additional-zones=ZONE,[ZONE,...]

(DEPRECATED) The set of additional zones in which the specified node footprint should be replicated. All zones must be in the same region as the cluster's primary zone. If additional-zones is not specified, all nodes will be in the cluster's primary zone.
Note that NUM_NODES nodes will be created in each zone, such that if you specify --num-nodes=4 and choose one additional zone, 8 nodes will be created.
Multiple locations can be specified, separated by commas. For example:

$ gcloud container clusters create example-cluster \
    --zone us-central1-a \
    --additional-zones us-central1-b,us-central1-c

This flag is deprecated. Use --node-locations=PRIMARY_ZONE,[ZONE,...] instead.

--addons=[ADDON,...]

Default set of addons includes HttpLoadBalancing, HorizontalPodAutoscaling. Addons (cloud.google.com/kubernetes-engine/reference/rest/v1/projects.zones.clusters#AddonsConfig are additional Kubernetes cluster components. Addons specified by this flag will be enabled. The others will be disabled. ADDON must be one of: HttpLoadBalancing, HorizontalPodAutoscaling, KubernetesDashboard, Istio, NetworkPolicy.

--async

Don't wait for the operation to complete.

--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR

The IP address range for the pods in this cluster in CIDR notation (e.g. 10.0.0.0/14). Prior to Kubernetes version 1.7.0 this must be a subset of 10.0.0.0/8; however, starting with version 1.7.0 can be any RFC 1918 IP range.

--cluster-secondary-range-name=NAME

Set the secondary range to be used as the source for pod IPs. Alias ranges will be allocated from this secondary range. NAME must be the name of an existing secondary range in the cluster subnetwork.
Must be used in conjunction with '--enable-ip-alias'. Cannot be used with --create-subnetwork.

--cluster-version=CLUSTER_VERSION

The Kubernetes version to use for the master and nodes. Defaults to server-specified.
The default Kubernetes version is available using the following command.

$ gcloud container get-server-config

--create-subnetwork=[KEY=VALUE,...]

Create a new subnetwork for the cluster. The name and range of the subnetwork can be customized via optional 'name' and 'range' key-value pairs.
'name' specifies the name of the subnetwork to be created.
'range' specifies the IP range for the new subnetwork. This can either be a netmask size (e.g. '/20') or a CIDR range (e.g. '10.0.0.0/20'). If a netmask size is specified, the IP is automatically taken from the free space in the cluster's network.
Examples:
Create a new subnetwork with a default name and size.

$ gcloud container clusters create --create-subnetwork ""

Create a new subnetwork named "my-subnet" with netmask of size 21.

$ gcloud container clusters create \ --create-subnetwork name=my-subnet,range=/21

Create a new subnetwork with a default name with the primary range of 10.100.0.0/16.

$ gcloud container clusters create \ --create-subnetwork range=10.100.0.0/16

Create a new subnetwork with the name "my-subnet" with a default range.

$ gcloud container clusters create --create-subnetwork name=my-subnet

Can not be specified unless '--enable-ip-alias' is also specified. Can not be used in conjunction with the '--subnetwork' option.

--disk-size=DISK_SIZE

Size for node VM boot disks. Defaults to 100GB.

--disk-type=DISK_TYPE

Type of the node VM boot disk. Defaults to pd-standard. DISK_TYPE must be one of: pd-standard, pd-ssd.

--enable-autorepair

Enable node autorepair feature for a cluster's default node-pool(s).

$ gcloud container clusters create example-cluster \
    --enable-autorepair

Node autorepair is enabled by default for clusters using COS as a base image, use --no-enable-autorepair to disable.
See cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair for more info.

--enable-autoupgrade

Sets autoupgrade feature for a cluster's default node-pool(s).

$ gcloud container clusters create example-cluster \
    --enable-autoupgrade

See cloud.google.com/kubernetes-engine/docs/node-management for more info.

--enable-cloud-logging

Automatically send logs from the cluster to the Google Cloud Logging API. Enabled by default, use --no-enable-cloud-logging to disable.

--enable-cloud-monitoring

Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting. Enabled by default, use --no-enable-cloud-monitoring to disable.

--enable-ip-alias

Enable use of alias IPs (cloud.google.com/compute/docs/alias-ip for pod IPs. This will create two secondary ranges, one for the pod IPs and another to reserve space for the services range.

--enable-kubernetes-alpha

Enable Kubernetes alpha features on this cluster. Selecting this option will result in the cluster having all Kubernetes alpha API groups and features turned on. Cluster upgrades (both manual and automatic) will be disabled and the cluster will be automatically deleted after 30 days.
Alpha clusters are not covered by the Kubernetes Engine SLA and should not be used for production workloads.

--enable-legacy-authorization

Enables the legacy ABAC authentication for the cluster. User rights are granted through the use of policies which combine attributes together. For a detailed look at these properties and related formats, see kubernetes.io/docs/admin/authorization/abac To use RBAC permissions instead, create or update your cluster with the option --no-enable-legacy-authorization.

--enable-network-policy

Enable network policy enforcement for this cluster. If you are enabling network policy on an existing cluster the network policy addon must first be enabled on the master by using --update-addons=NetworkPolicy=ENABLED flag.

--image-type=IMAGE_TYPE

The image type to use for the cluster. Defaults to server-specified.
Image Type specifies the base OS that the nodes in the cluster will run on. If an image type is specified, that will be assigned to the cluster and all future upgrades will use the specified image type. If it is not specified the server will pick the default image type.
The default image type and the list of valid image types are available using the following command.

$ gcloud container get-server-config

--issue-client-certificate

Issue a TLS client certificate with admin permissions.
When enabled, the certificate and private key pair will be present in MasterAuth field of the Cluster object. For cluster versions before 1.12, a client certificate will be issued by default. As of 1.12, client certificates are disabled by default.

--labels=[KEY=VALUE,...]

Labels to apply to the Google Cloud resources in use by the Kubernetes Engine cluster. These are unrelated to Kubernetes labels. Example:

$ gcloud container clusters create example-cluster \
    --labels=label_a=value1,label_b=,label_c=value3

--local-ssd-count=LOCAL_SSD_COUNT

The number of local SSD disks to provision on each node.
Local SSDs have a fixed 375 GB capacity per device. The number of disks that can be attached to an instance is limited by the maximum number of disks available on a machine, which differs by compute zone. See cloud.google.com/compute/docs/disks/local-ssd for more information.

--machine-type=MACHINE_TYPE, -m MACHINE_TYPE

The type of machine to use for nodes. Defaults to n1-standard-1. The list of predefined machine types is available using the following command:

$ gcloud compute machine-types list

You can also specify custom machine types with the string "custom-CPUS-RAM" where CPUS is the number of virtual CPUs and RAM is the amount of RAM in MiB.
For example, to create a node pool using custom machines with 2 vCPUs and 12 GB of RAM:

$ gcloud container clusters create high-mem-pool \
    --machine-type=custom-2-12288

--maintenance-window=MAINTENANCE_WINDOW

Set a time of day when you prefer maintenance to start on this cluster. For example:

$ gcloud container clusters create example-cluster \
    --maintenance-window=12:43

The time corresponds to the UTC time zone, and must be in HH:MM format.

--max-nodes-per-pool=MAX_NODES_PER_POOL

The maximum number of nodes to allocate per default initial node pool. Kubernetes Engine will automatically create enough nodes pools such that each node pool contains less than --max-nodes-per-pool nodes. Defaults to 1000 nodes, but can be set as low as 100 nodes per pool on initial create.

--metadata=KEY=VALUE,[KEY=VALUE,...]

Compute Engine metadata to be made available to the guest operating system running on nodes within the node pool.
Each metadata entry is a key/value pair separated by an equals sign. Metadata keys must be unique and less than 128 bytes in length. Values must be less than or equal to 32,768 bytes in length. The total size of all keys and values must be less than 512 KB. Multiple arguments can be passed to this flag. For example:
--metadata key-1=value-1,key-2=value-2,key-3=value-3
Additionally, the following keys are reserved for use by Kubernetes Engine:

---

cluster-location

---

cluster-name

---

cluster-uid

---

configure-sh

---

enable-os-login

---

gci-update-strategy

---

gci-ensure-gke-docker

---

instance-template

---

kube-env

---

startup-script

---

user-data

See also Compute Engine's documentation (cloud.google.com/compute/docs/storing-retrieving-metadata on storing and retrieving instance metadata.

--metadata-from-file=KEY=LOCAL_FILE_PATH,[...]

Same as --metadata except that the value for the entry will be read from a local file.

--min-cpu-platform=PLATFORM

When specified, the nodes for the new cluster's default node pool will be scheduled on host with specified CPU architecture or a newer one.
Examples:

$ gcloud container clusters create example-cluster \
    --min-cpu-platform=PLATFORM

To list available CPU platforms in given zone, run:

$ gcloud beta compute zones describe ZONE \
    --format="value(availableCpuPlatforms)"

CPU platform selection is available only in selected zones.

--network=NETWORK

The Compute Engine Network that the cluster will connect to. Google Kubernetes Engine will use this network when creating routes and firewalls for the clusters. Defaults to the 'default' network.

--node-labels=[NODE_LABEL,...]

Applies the given kubernetes labels on all nodes in the new node-pool. Example:

$ gcloud container clusters create example-cluster \
    --node-labels=label-a=value1,label-2=value2

New nodes, including ones created by resize or recreate, will have these labels on the kubernetes API node object and can be used in nodeSelectors. See kubernetes.io/docs/user-guide/node-selection for examples.
Note that kubernetes labels, intended to associate cluster components and resources with one another and manage resource lifecycles, are different from Kubernetes Engine labels that are used for the purpose of tracking billing and usage information.

--node-locations=ZONE,[ZONE,...]

The set of zones in which the specified node footprint should be replicated. All zones must be in the same region as the cluster's master(s), specified by the --zone or --region flag. Additionally, for zonal clusters, --node-locations must contain the cluster's primary zone. If not specified, all nodes will be in the cluster's primary zone (for zonal clusters) or spread across three randomly chosen zones within the cluster's region (for regional clusters).
Note that NUM_NODES nodes will be created in each zone, such that if you specify --num-nodes=4 and choose two locations, 8 nodes will be created.
Multiple locations can be specified, separated by commas. For example:

$ gcloud container clusters create example-cluster \
    --zone us-central1-a \
    --node-locations us-central1-a,us-central1-b

--node-taints=[NODE_TAINT,...]

Applies the given kubernetes taints on all nodes in default node-pool(s) in new cluster, which can be used with tolerations for pod scheduling. Example:

$ gcloud container clusters create example-cluster \
    --node-taints=key1=val1:NoSchedule,key2=val2:PreferNoSchedule

Note, this feature uses gcloud beta commands. To use gcloud beta commands, you must configure gcloud to use the v1beta1 API as described here: cloud.google.com/kubernetes-engine/docs/reference/api-organization#beta To read more about node-taints, see cloud.google.com/kubernetes-engine/docs/node-taints

--node-version=NODE_VERSION

The Kubernetes version to use for nodes. Defaults to server-specified.
The default Kubernetes version is available using the following command.

$ gcloud container get-server-config

--num-nodes=NUM_NODES; default=3

The number of nodes to be created in each of the cluster's zones.

--preemptible

Create nodes using preemptible VM instances in the new cluster.

$ gcloud container clusters create example-cluster --preemptible

New nodes, including ones created by resize or recreate, will use preemptible VM instances. See cloud.google.com/kubernetes-engine/docs/preemptible-vm for more information on how to use Preemptible VMs with Kubernetes Engine.

--services-ipv4-cidr=CIDR

Set the IP range for the services IPs.
Can be specified as a netmask size (e.g. '/20') or as in CIDR notion (e.g. '10.100.0.0/20'). If given as a netmask size, the IP range will be chosen automatically from the available space in the network.
If unspecified, the services CIDR range will be chosen with a default mask size.
Can not be specified unless '--enable-ip-alias' is also specified.

--services-secondary-range-name=NAME

Set the secondary range to be used for services (e.g. ClusterIPs). NAME must be the name of an existing secondary range in the cluster subnetwork.
Must be used in conjunction with '--enable-ip-alias'. Cannot be used with --create-subnetwork.

--subnetwork=SUBNETWORK

The Google Compute Engine subnetwork (cloud.google.com/compute/docs/subnetworks to which the cluster is connected. The subnetwork must belong to the network specified by --network.
Cannot be used with the "--create-subnetwork" option.

--tags=TAG,[TAG,...]

Applies the given Compute Engine tags (comma separated) on all nodes in the new node-pool. Example:

$ gcloud container clusters create example-cluster --tags=tag1,tag2

New nodes, including ones created by resize or recreate, will have these tags on the Compute Engine API instance object and can be used in firewall rules. See cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create for examples.

Cluster autoscaling

--enable-autoscaling

Enables autoscaling for a node pool.
Enables autoscaling in the node pool specified by --node-pool or the default node pool if --node-pool is not provided.

--max-nodes=MAX_NODES

Maximum number of nodes in the node pool.
Maximum number of nodes to which the node pool specified by --node-pool (or default node pool if unspecified) can scale. Ignored unless --enable-autoscaling is also specified.

--min-nodes=MIN_NODES

Minimum number of nodes in the node pool.
Minimum number of nodes to which the node pool specified by --node-pool (or default node pool if unspecified) can scale. Ignored unless --enable-autoscaling is also specified.

Master Authorized Networks

--enable-master-authorized-networks

Allow only specified set of CIDR blocks (specified by the --master-authorized-networks flag) to connect to Kubernetes master through HTTPS. Besides these blocks, the following have access as well:

1) The private network the cluster connects to if `--enable-private-nodes` is specified. 2) Google Compute Engine Public IPs if `--enable-private-nodes` is not specified.

Use --no-enable-master-authorized-networks to disable. When disabled, public internet (0.0.0.0/0) is allowed to connect to Kubernetes master through HTTPS.

--master-authorized-networks=NETWORK,[NETWORK,...]

The list of CIDR blocks (up to 20) that are allowed to connect to Kubernetes master through HTTPS. Specified in CIDR notation (e.g. 1.2.3.4/30). Can not be specified unless --enable-master-authorized-networks is also specified.

Private Clusters

--enable-private-endpoint

Cluster is managed using the private IP address of the master API endpoint.

--enable-private-nodes

Cluster is created with no public IP addresses on the cluster nodes.

--master-ipv4-cidr=MASTER_IPV4_CIDR

IPv4 CIDR range to use for the master network. This should have a netmask of size /28 and should be used in conjunction with the --enable-private-nodes flag.

Basic auth

--password=PASSWORD

The password to use for cluster auth. Defaults to a server-specified randomly-generated string.

Options to specify the username. At most one of these may be specified:

--enable-basic-auth

Enable basic (username/password) auth for the cluster. --enable-basic-auth is an alias for --username=admin; --no-enable-basic-auth is an alias for --username="". Use --password to specify a password; if not, the server will randomly generate one. For cluster versions before 1.12, if neither --enable-basic-auth nor --username is specified, --enable-basic-auth will default to true. After 1.12, --enable-basic-auth will default to false.

--username=USERNAME, -u USERNAME

The user name to use for basic auth for the cluster. Use --password to specify a password; if not, the server will randomly generate one.

At most one of these may be specified:

--region=REGION

Compute region (e.g. us-central1) for the cluster.

--zone=ZONE, -z ZONE

Compute zone (e.g. us-central1-a) for the cluster. Overrides the default compute/zone property value for this command invocation.

Options to specify the node identity. At most one of these may be specified:

--service-account=SERVICE_ACCOUNT

The Google Cloud Platform Service Account to be used by the node VMs. If a service account is specified, the cloud-platform and userinfo.email scopes are used. If no Service Account is specified, the project default service account is used.

Scopes options.

--enable-cloud-endpoints

(DEPRECATED) Automatically enable Google Cloud Endpoints to take advantage of API management features by adding service-control and service-management scopes.
If --no-enable-cloud-endpoints is set, remove service-control and service-management scopes, even if they are implicitly (via default) or explicitly set via --scopes.
--[no-]enable-cloud-endpoints is not allowed if container/new_scopes_behavior property is set to true.
Flag --[no-]enable-cloud-endpoints is deprecated and will be removed in a future release. Scopes necessary for Google Cloud Endpoints are now included in the default set and may be excluded using --scopes.
Enabled by default, use --no-enable-cloud-endpoints to disable.

--scopes=[SCOPE,...]; default="gke-default"

Specifies scopes for the node instances. Examples:

$ gcloud container clusters create example-cluster \
    --scopes=www.googleapis.com/auth/devstorage.read_only

$ gcloud container clusters create example-cluster \
    --scopes=bigquery,storage-rw,compute-ro

Multiple SCOPEs can be specified, separated by commas. logging-write and/or monitoring are added unless Cloud Logging and/or Cloud Monitoring are disabled (see --enable-cloud-logging and --enable-cloud-monitoring for more information).
SCOPE can be either the full URI of the scope or an alias. default scopes are assigned to all instances. Available aliases are:

Alias	URI
bigquery	www.googleapis.com/auth/bigquery
cloud-platform	www.googleapis.com/auth/cloud-platform
cloud-source-repos	www.googleapis.com/auth/source.full_control
cloud-source-repos-ro	www.googleapis.com/auth/source.read_only
compute-ro	www.googleapis.com/auth/compute.readonly
compute-rw	www.googleapis.com/auth/compute
datastore	www.googleapis.com/auth/datastore
default	www.googleapis.com/auth/devstorage.read_only
	www.googleapis.com/auth/logging.write
	www.googleapis.com/auth/monitoring.write
	www.googleapis.com/auth/pubsub
	www.googleapis.com/auth/service.management.readonly
	www.googleapis.com/auth/servicecontrol
	www.googleapis.com/auth/trace.append
gke-default	www.googleapis.com/auth/devstorage.read_only
	www.googleapis.com/auth/logging.write
	www.googleapis.com/auth/monitoring
	www.googleapis.com/auth/service.management.readonly
	www.googleapis.com/auth/servicecontrol
	www.googleapis.com/auth/trace.append
logging-write	www.googleapis.com/auth/logging.write
monitoring	www.googleapis.com/auth/monitoring
monitoring-write	www.googleapis.com/auth/monitoring.write
pubsub	www.googleapis.com/auth/pubsub
service-control	www.googleapis.com/auth/servicecontrol
service-management	www.googleapis.com/auth/service.management.readonly
sql (deprecated)	www.googleapis.com/auth/sqlservice
sql-admin	www.googleapis.com/auth/sqlservice.admin
storage-full	www.googleapis.com/auth/devstorage.full_control
storage-ro	www.googleapis.com/auth/devstorage.read_only
storage-rw	www.googleapis.com/auth/devstorage.read_write
taskqueue	www.googleapis.com/auth/taskqueue
trace	www.googleapis.com/auth/trace.append
userinfo-email	www.googleapis.com/auth/userinfo.email

DEPRECATION WARNING: www.googleapis.com/auth/sqlservice account scope and sql alias do not provide SQL instance management capabilities and have been deprecated. Please, use www.googleapis.com/auth/sqlservice.admin or sql-admin to manage your Google SQL Service instances.

GCLOUD WIDE FLAGS

NOTES

$ gcloud alpha container clusters create $ gcloud beta container clusters create