/

Console

• English
• Deutsch
• Español – América Latina
• Français
• Português – Brasil
• 中文 – 简体
• 日本語
• 한국어

Sign in

• Google Cloud SDK

Start free

gcloud container clusters update

gcloud container clusters update sample-cluster --enable-autoscaling

ENABLED

'ENABLED' enables anonymous calls.

LIMITED

'LIMITED' restricts anonymous access to the cluster. Only calls to the health check endpoints are allowed anonymously, all other calls will be rejected.

The value is a comma-separated list of paths in the format:

• gke://<partner_name>/<app_name>/<allowlist_path> for Autopilot partner allowlists
• gs://<bucket_name>/<allowlist_path> for user allowlists

By default, all GKE-managed allowlists (gke://*) are authorized. See https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-partners for all supported Autopilot partner allowlists. When setting this flag, be careful to explicitly specify gke://* in addition to other entries if you rely on this default behavior.

Wildcards (*) are supported. For example, if gke://* is authorized, then AllowlistSynchronizers can be used to install gke://partner1/allowlist1.yaml and gke://partner2/allowlist2.yaml.

Note: Use of user allowlists (gs://) requires special permissions and is only available to a subset of high tier customers. Please contact your account team for more information.

Examples:

Allow all GKE-managed allowlists (default behavior):

gcloud container clusters update --autopilot-privileged-admission=gke://*

Authorize only allowlists from a GKE Autopilot partner:

gcloud container clusters update --autopilot-privileged-admission=gke://my-partner/*

Authorize only a singular user-owned allowlist

gcloud container clusters update --autopilot-privileged-admission=gs://my-bucket/allowlists/my-allowlist.yaml

Authorize all user-owned allowlists under a given path:

gcloud container clusters update --autopilot-privileged-admission=gs://my-bucket/*

Authorize all GKE-managed allowlists and a specific user-owned allowlist:

gcloud container clusters update --autopilot-privileged-admission=gke://*,gs://my-bucket/allowlists/my-allowlist.yaml

Disable allowlist installation entirely:

gcloud container clusters update --autopilot-privileged-admission=""

Exercise caution when using this flag on an existing cluster. Upon updates, existing AllowlistSynchronizers will uninstall allowlists that are no longer authorized.

Examples:

gcloud container clusters update example-cluster --autopilot-workload-policies=allow-net-admin

Updating this flag triggers an update using surge upgrades of all existing auto-provisioned nodes to apply the new value of cgroup mode.

For an Autopilot cluster, the specified cgroup mode will be set on all existing and new nodes in the cluster. For a Standard cluster, the specified cgroup mode will be set on all existing and new auto-provisioned node pools in the cluster.

If not set, GKE uses cgroupv2 for new nodes when the cluster was created running 1.26 or later, and cgroupv1 for clusters created running 1.25 or earlier. To check your initial cluster version, run gcloud container clusters describe [NAME] --format="value(initialClusterVersion)"

For clusters created running version 1.26 or later, you can't set the cgroup mode to v1.

To learn more, see: https://cloud.google.com/kubernetes-engine/docs/how-to/migrate-cgroupv2.

If not set, the value from nodePoolDefaults.nodeConfigDefaults will be used.

Examples:

gcloud container clusters update example-cluster --autoprovisioning-network-tags=tag1,tag2

For a Standard cluster, the specified comma-separated resource manager tags that has the GCE_FIREWALL purpose are applied to all nodes in the new newly created auto-provisioned node pools. Existing auto-provisioned node pools retain the tags that they had before the update. To update tags on an existing auto-provisioned node pool, use the node pool level flag '--resource-manager-tags'.

Examples:

gcloud container clusters update example-cluster --autoprovisioning-resource-manager-tags=tagKeys/1234=tagValues/2345
gcloud container clusters update example-cluster --autoprovisioning-resource-manager-tags=my-project/key1=value1
gcloud container clusters update example-cluster --autoprovisioning-resource-manager-tags=12345/key1=value1,23456/key2=value2
gcloud container clusters update example-cluster --autoprovisioning-resource-manager-tags=

gcloud container clusters update example-cluster --complete-credential-rotation

gcloud container clusters update example-cluster --complete-ip-rotation

For detailed information on the configuration usage, please refer to https://cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration.

Note: Updating the containerd configuration of an existing cluster or node pool requires recreation of the existing nodes, which might cause disruptions in running workloads.

By default, cluster nodes perform source network address translation (SNAT) for packets sent from Pod IP address sources to destination IP addresses that are not in the non-masquerade CIDRs list. For more details about SNAT and IP masquerading, see: https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works SNAT changes the packet's source IP address to the node's internal IP address.

When this flag is set, GKE does not perform SNAT for packets sent to any destination. You must set this flag if the cluster uses privately reused public IPs.

https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

Note: This flag causes a control plane restart.

When enabled, you can get informational GKE cost breakdowns by cluster, namespace and label in your billing data exported to BigQuery (https://cloud.google.com/billing/docs/how-to/export-data-bigquery).

When enabled, users can authenticate to Kubernetes cluster with external identity providers.

Enabling intra-node visibility makes your intra-node pod-to-pod traffic visible to the networking fabric. With this feature, you can use VPC flow logging or other VPC features for intra-node traffic.

gcloud container clusters update example-cluster --enable-kernel-module-signature-enforcement

Modifications to this flag do not affect `--enable-private-nodes` state of the
existing node pools.

Modifications to this flag trigger a re-schedule operation on all existng
workloads to run on different node VMs.

gcloud container clusters update example-cluster --maintenance-window=12:43

The time corresponds to the UTC time zone, and must be in HH:MM format.

Non-emergency maintenance will occur in the 4 hour block starting at the specified time.

This is mutually exclusive with the recurring maintenance windows and will overwrite any existing window. Compatible with maintenance exclusions.

gcloud container clusters update example-cluster --location us-central1-a --node-locations us-central1-a,us-central1-b

Examples:

gcloud container clusters update example-cluster --notification-config=pubsub=ENABLED,pubsub-topic=projects/{project}/topics/{topic-name}
gcloud container clusters update example-cluster --notification-config=pubsub=ENABLED,pubsub-topic=projects/{project}/topics/{topic-name},filter="SecurityBulletinEvent|UpgradeEvent"

Setting to 'accelerated' automatically upgrades the cluster to the latest patch available within the cluster's current minor version and release channel. Setting to 'default' automatically upgrades the cluster to the default patch upgrade targetversion available within the cluster's current minor version and release channel.

PRIVATE_IPV6_GOOGLE_ACCESS_TYPE must be one of:

bidirectional
  Allows Google services to initiate connections to GKE pods in this
  cluster. This is not intended for common use, and requires previous
  integration with Google services.

disabled
  Default value. Disables private access to Google services over IPv6.

outbound-only
  Allows GKE pods to make fast, secure requests to Google services
  over IPv6. This is the most common use of private IPv6 access.

gcloud alpha container clusters create       --private-ipv6-google-access-type=disabled
gcloud alpha container clusters create       --private-ipv6-google-access-type=outbound-only
gcloud alpha container clusters create       --private-ipv6-google-access-type=bidirectional

When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade is enabled by default for release channel clusters and can be controlled via upgrade-scope exclusions.

Examples:

gcloud container clusters update example-cluster --remove-autopilot-workload-policies=allow-net-admin

gcloud container clusters update example-cluster --remove-labels=label_a,label_b

Examples:

gcloud container clusters update example-cluster --remove-workload-policies=allow-net-admin

To include group membership as part of the claims issued by Google during authentication, a group must be designated as a security group by including it as a direct member of this group.

To enable advanced mode explicitly set the flag to --security-posture=enterprise.

To enable in standard mode explicitly set the flag to --security-posture=standard

To disable in an existing cluster, explicitly set the flag to --security-posture=disabled.

For more information on enablement, see https://cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard#feature-enablement.

gcloud container clusters update example-cluster --start-credential-rotation

gcloud container clusters update example-cluster --start-ip-rotation

gcloud container clusters update example-cluster --update-labels=label_a=value1,label_b=value2

Examples:

gcloud container clusters update example-cluster --workload-policies=allow-net-admin

https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

To enable Advanced vulnerability insights mode explicitly set the flag to --workload-vulnerability-scanning=enterprise.

To enable in standard mode explicitly set the flag to --workload-vulnerability-scanning=standard.

To disable in an existing cluster, explicitly set the flag to --workload-vulnerability-scanning=disabled.

For more information on enablement, see https://cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard#feature-enablement.

--additional-ip-ranges=[subnetwork=NAME,pod-ipv4-range=NAME,…]

Add additional subnetworks named "my-subnet" with pod ipv4 range named "my-range" to the cluster.

Examples:

gcloud container clusters update example-cluster --additional-ip-ranges=subnetwork=my-subnet,pod-ipv4-range=my-range

--remove-additional-ip-ranges=[subnetwork=NAME,pod-ipv4-range=NAME,…]

Additional subnetworks to be removed from the cluster.

Examples:

Remove pod range named "my-range" under additional subnetwork named "my-subnet" from the cluster.

gcloud container clusters update example-cluster --remove-additional-ip-ranges=subnetwork=my-subnet,pod-ipv4-range=my-range

Remove additional subnetwork named "my-subnet", including all the pod ipv4 ranges under the subnetwork.

gcloud container clusters update example-cluster --remove-additional-ip-ranges=subnetwork=my-subnet

--additional-pod-ipv4-ranges=NAME,[NAME,…]

Additional IP address ranges(by name) for pods that need to be added to the cluster.

Examples:

gcloud container clusters update example-cluster --additional-pod-ipv4-ranges=range1,range2

--remove-additional-pod-ipv4-ranges=NAME,[NAME,…]

Previously added additional pod ranges(by name) for pods that are to be removed from the cluster.

Examples:

gcloud container clusters update example-cluster --remove-additional-pod-ipv4-ranges=range1,range2

gcloud container clusters update --logging=SYSTEM
gcloud container clusters update --logging=SYSTEM,API_SERVER,WORKLOAD
gcloud container clusters update --logging=NONE

gcloud container clusters update --monitoring=SYSTEM,API_SERVER,POD
gcloud container clusters update --monitoring=NONE

See https://cloud.google.com/stackdriver/docs/managed-prometheus/setup-managed#enable-mgdcoll-gke for more info.

--clear-maintenance-minor-version-disruption-interval

Restore the default values for the minimum interval of time between minor version cluster upgrades.

--maintenance-minor-version-disruption-interval=MAINTENANCE_MINOR_VERSION_DISRUPTION_INTERVAL

Set the minimum interval of time between minor version cluster upgrades.

Examples:

gcloud container clusters update example-cluster   --add-maintenance-exclusion-name=holidays-2000   --add-maintenance-exclusion-start=2000-11-20T00:00:00   --add-maintenance-exclusion-end=2000-12-31T23:59:59   --add-maintenance-exclusion-scope=no_upgrades

Examples:

For a 9-5 Mon-Wed UTC-4 maintenance window:

gcloud container clusters update example-cluster --maintenance-window-start=2000-01-01T09:00:00-04:00 --maintenance-window-end=2000-01-01T17:00:00-04:00 --maintenance-window-recurrence='FREQ=WEEKLY;BYDAY=MO,TU,WE'

For a daily window from 22:00 - 04:00 UTC:

gcloud container clusters update example-cluster --maintenance-window-start=2000-01-01T22:00:00Z --maintenance-window-end=2000-01-02T04:00:00Z --maintenance-window-recurrence=FREQ=DAILY

When enabled, a DaemonSet is deployed into the cluster. Each DaemonSet pod meters network egress traffic by collecting data from the conntrack table, and exports the metered metrics to the specified destination.

When enabled, a table will be created in the specified BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export.

gcloud container clusters update example-cluster --resource-usage-bigquery-dataset=example_bigquery_dataset_name

cluster

Configures the Cloud DNS zone to be private to the cluster.

vpc

Configures the Cloud DNS zone to be private to the VPC Network.

Advanced Datapath Observability allows for a real-time view into pod-to-pod traffic within your cluster.

Examples:

gcloud container clusters update --dataplane-v2-observability-mode=DISABLED

gcloud container clusters update --dataplane-v2-observability-mode=INTERNAL_VPC_LB

gcloud container clusters update --dataplane-v2-observability-mode=EXTERNAL_LB

Flag --dataplane-v2-observability-mode has been removed.

DISABLED

Disables Advanced Datapath Observability.

EXTERNAL_LB

Makes Advanced Datapath Observability available to the external network.

INTERNAL_VPC_LB

Makes Advanced Datapath Observability available from the VPC network.

--disable-auto-ipam

Disable the Auto IP Address Management (Auto IPAM) feature for the cluster.

--enable-auto-ipam

Enable the Auto IP Address Management (Auto IPAM) feature for the cluster.

--disable-l4-lb-firewall-reconciliation

Disable reconciliation on the cluster for L4 Load Balancer VPC firewalls targeting ingress traffic.

--enable-l4-lb-firewall-reconciliation

Enable reconciliation on the cluster for L4 Load Balancer VPC firewalls targeting ingress traffic. L4 LB VPC firewall reconciliation is enabled by default.

--disable-pod-snapshots

Disable the Pod Snapshot feature on the cluster.

--enable-pod-snapshots

Enable the Pod Snapshot feature on the cluster.

1) The private network the cluster connects to if
`--enable-private-nodes` is specified.
2) Google Compute Engine Public IPs if `--enable-private-nodes` is not
specified.

Resource limits are specified in the field 'resourceLimits'. Each resource limits definition contains three fields: resourceType, maximum and minimum. Resource type can be "cpu", "memory" or an accelerator (e.g. "nvidia-tesla-t4" for NVIDIA T4). Use gcloud compute accelerator-types list to learn about available accelerator types. Maximum is the maximum allowed amount with the unit of the resource. Minimum is the minimum allowed amount with the unit of the resource.

Identity default contains at most one of the below fields: serviceAccount: The Google Cloud Platform Service Account to be used by node VMs in autoprovisioned node pools. If not specified, the project's default service account is used. scopes: A list of scopes to be used by node instances in autoprovisioned node pools. Multiple scopes can be specified, separated by commas. For information on defaults, look at: https://cloud.google.com/sdk/gcloud/reference/container/clusters/create#--scopes

Node Upgrade settings are specified under the field 'upgradeSettings', which has the following fields: maxSurgeUpgrade: Number of extra (surge) nodes to be created on each upgrade of an autoprovisioned node pool. maxUnavailableUpgrade: Number of nodes that can be unavailable at the same time on each upgrade of an autoprovisioned node pool.

Node Management settings are specified under the field 'management', which has the following fields: autoUpgrade: A boolean field that indicates if node autoupgrade is enabled for autoprovisioned node pools. autoRepair: A boolean field that indicates if node autorepair is enabled for autoprovisioned node pools.

minCpuPlatform (deprecated): If specified, new autoprovisioned nodes will be scheduled on host with specified CPU architecture or a newer one. Note: Min CPU platform can only be specified in Beta and Alpha.

Autoprovisioned node image is specified under the 'imageType' field. If not specified the default value will be applied.

Autoprovisioning locations is a set of zones where new node pools can be created by Autoprovisioning. Autoprovisioning locations are specified in the field 'autoprovisioningLocations'. All zones must be in the same region as the cluster's master(s).

Disk type and size are specified under the 'diskType' and 'diskSizeGb' fields, respectively. If specified, new autoprovisioned nodes will be created with custom boot disks configured by these settings.

Shielded instance settings are specified under the 'shieldedInstanceConfig' field, which has the following fields: enableSecureBoot: A boolean field that indicates if secure boot is enabled for autoprovisioned nodes. enableIntegrityMonitoring: A boolean field that indicates if integrity monitoring is enabled for autoprovisioned nodes.

Customer Managed Encryption Keys (CMEK) used by new auto-provisioned node pools can be specified in the 'bootDiskKmsKey' field.

Batch sizes are specified by one of, batch-node-count or batch-percent. The duration between batches is specified by batch-soak-duration.

--enable-autoprovisioning-blue-green-upgrade

Whether to use blue-green upgrade for the autoprovisioned node pool.

--enable-autoprovisioning-surge-upgrade

Whether to use surge upgrade for the autoprovisioned node pool.

--[no-]enable-ray-cluster-logging

Enable automatic log processing sidecar for Ray clusters. Use --enable-ray-cluster-logging to enable and --no-enable-ray-cluster-logging to disable.

--[no-]enable-ray-cluster-monitoring

Enable automatic metrics collection for Ray clusters. Use --enable-ray-cluster-monitoring to enable and --no-enable-ray-cluster-monitoring to disable.

--enable-basic-auth

Enable basic (username/password) auth for the cluster. --enable-basic-auth is an alias for --username=admin; --no-enable-basic-auth is an alias for --username="". Use --password to specify a password; if not, the server will randomly generate one. For cluster versions before 1.12, if neither --enable-basic-auth nor --username is specified, --enable-basic-auth will default to true. After 1.12, --enable-basic-auth will default to false.

--username=USERNAME, -u USERNAME

The user name to use for basic auth for the cluster. Use --password to specify a password; if not, the server will randomly generate one.

--location=LOCATION

Compute zone or region (e.g. us-central1-a or us-central1) for the cluster. Overrides the default compute/region or compute/zone value for this command invocation. Prefer using this flag over the --region or --zone flags.

--region=REGION

Compute region (e.g. us-central1) for a regional cluster. Overrides the default compute/region property value for this command invocation.

--zone=ZONE, -z ZONE

Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the default compute/zone property value for this command invocation.

• BALANCED - Is a best effort policy that aims to balance the sizes of available zones.
• ANY - Instructs the cluster autoscaler to prioritize utilization of unused reservations, and reduces preemption risk for Spot VMs.

Run $ gcloud help for details.

gcloud alpha container clusters update

gcloud beta container clusters update