/

Console

• English
• Deutsch
• Español – América Latina
• Français
• Português – Brasil
• 中文 – 简体
• 日本語
• 한국어

Sign in

• Google Cloud SDK

Start free

gcloud container clusters create-auto

gcloud container clusters create-auto sample-cluster

ENABLED

'ENABLED' enables anonymous calls.

LIMITED

'LIMITED' restricts anonymous access to the cluster. Only calls to the health check endpoints are allowed anonymously, all other calls will be rejected.

The value is a comma-separated list of paths in the format:

• gke://<partner_name>/<app_name>/<allowlist_path> for Autopilot partner allowlists
• gs://<bucket_name>/<allowlist_path> for user allowlists

By default, all GKE-managed allowlists (gke://*) are authorized. See https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-partners for all supported Autopilot partner allowlists. When setting this flag, be careful to explicitly specify gke://* in addition to other entries if you rely on this default behavior.

Wildcards (*) are supported. For example, if gke://* is authorized, then AllowlistSynchronizers can be used to install gke://partner1/allowlist1.yaml and gke://partner2/allowlist2.yaml.

Note: Use of user allowlists (gs://) requires special permissions and is only available to a subset of high tier customers. Please contact your account team for more information.

Examples:

Allow all GKE-managed allowlists (default behavior):

gcloud container clusters create-auto --autopilot-privileged-admission=gke://*

Authorize only allowlists from a GKE Autopilot partner:

gcloud container clusters create-auto --autopilot-privileged-admission=gke://my-partner/*

Authorize only a singular user-owned allowlist

gcloud container clusters create-auto --autopilot-privileged-admission=gs://my-bucket/allowlists/my-allowlist.yaml

Authorize all user-owned allowlists under a given path:

gcloud container clusters create-auto --autopilot-privileged-admission=gs://my-bucket/*

Authorize all GKE-managed allowlists and a specific user-owned allowlist:

gcloud container clusters create-auto --autopilot-privileged-admission=gke://*,gs://my-bucket/allowlists/my-allowlist.yaml

Disable allowlist installation entirely:

gcloud container clusters create-auto --autopilot-privileged-admission=""

Exercise caution when using this flag on an existing cluster. Upon updates, existing AllowlistSynchronizers will uninstall allowlists that are no longer authorized.

If not set, the value from nodePoolDefaults.nodeConfigDefaults will be used.

Examples:

gcloud container clusters create-auto example-cluster --autoprovisioning-network-tags=tag1,tag2

Examples:

gcloud container clusters create-auto example-cluster --autoprovisioning-resource-manager-tags=tagKeys/1234=tagValues/2345
gcloud container clusters create-auto example-cluster --autoprovisioning-resource-manager-tags=my-project/key1=value1
gcloud container clusters create-auto example-cluster --autoprovisioning-resource-manager-tags=12345/key1=value1,23456/key2=value2
gcloud container clusters create-auto example-cluster --autoprovisioning-resource-manager-tags=

If you omit this option, a range is chosen automatically. The automatically chosen range is randomly selected from 10.0.0.0/8 and will not include IP address ranges allocated to VMs, existing routes, or ranges allocated to other clusters. The automatically chosen range might conflict with reserved IP addresses, dynamic routes, or routes within VPCs that peer with this cluster. You should specify --cluster-ipv4-cidr to prevent conflicts.

gcloud container get-server-config

For detailed information on the configuration usage, please refer to https://cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration.

Note: Updating the containerd configuration of an existing cluster or node pool requires recreation of the existing nodes, which might cause disruptions in running workloads.

'name' specifies the name of the subnetwork to be created.

'range' specifies the IP range for the new subnetwork. This can either be a netmask size (e.g. '/20') or a CIDR range (e.g. '10.0.0.0/20'). If a netmask size is specified, the IP is automatically taken from the free space in the cluster's network.

Examples:

Create a new subnetwork with a default name and size.

gcloud container clusters create-auto --create-subnetwork ""

Create a new subnetwork named "my-subnet" with netmask of size 21.

gcloud container clusters create-auto --create-subnetwork name=my-subnet,range=/21

Create a new subnetwork with a default name with the primary range of 10.100.0.0/16.

gcloud container clusters create-auto --create-subnetwork range=10.100.0.0/16

Create a new subnetwork with the name "my-subnet" with a default range.

gcloud container clusters create-auto --create-subnetwork name=my-subnet

gcloud container clusters create-auto example-cluster --enable-kernel-module-signature-enforcement

gcloud container clusters create-auto example-cluster --labels=label_a=value1,label_b=,label_c=value3

gcloud container clusters create-auto --logging=SYSTEM
gcloud container clusters create-auto --logging=SYSTEM,WORKLOAD
gcloud container clusters create-auto --logging=SYSTEM,WORKLOAD,API_SERVER,CONTROLLER_MANAGER,SCHEDULER,KCP_HPA

gcloud container clusters create-auto --monitoring=SYSTEM,API_SERVER,POD,DCGM
gcloud container clusters create-auto --monitoring=SYSTEM

If left unspecified and a version is specified, the cluster is enrolled in the most mature release channel where the version is available (first checking STABLE, then REGULAR, and finally RAPID). Otherwise, if no release channel and no version is specified, the cluster is enrolled in the REGULAR channel with its default version. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade is enabled by default for release channel clusters and can be controlled via upgrade-scope exclusions.

To include group membership as part of the claims issued by Google during authentication, a group must be designated as a security group by including it as a direct member of this group.

To enable advanced mode explicitly set the flag to --security-posture=enterprise.

To enable in standard mode explicitly set the flag to --security-posture=standard

To disable in an existing cluster, explicitly set the flag to --security-posture=disabled.

For more information on enablement, see https://cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard#feature-enablement.

Can be specified as a netmask size (e.g. '/20') or as in CIDR notion (e.g. '10.100.0.0/20'). If given as a netmask size, the IP range will be chosen automatically from the available space in the network.

Examples:

gcloud container clusters create-auto example-cluster --workload-policies=allow-net-admin

To enable Advanced vulnerability insights mode explicitly set the flag to --workload-vulnerability-scanning=enterprise.

To enable in standard mode explicitly set the flag to --workload-vulnerability-scanning=standard.

To disable in an existing cluster, explicitly set the flag to --workload-vulnerability-scanning=disabled.

For more information on enablement, see https://cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard#feature-enablement.

--additive-vpc-scope-dns-domain=ADDITIVE_VPC_SCOPE_DNS_DOMAIN

The domain used in Additive VPC scope. Only works with Cluster Scope.

--disable-additive-vpc-scope

Disables Additive VPC Scope.

Advanced Datapath Observability allows for a real-time view into pod-to-pod traffic within your cluster.

Examples:

gcloud container clusters create-auto --dataplane-v2-observability-mode=DISABLED

gcloud container clusters create-auto --dataplane-v2-observability-mode=INTERNAL_VPC_LB

gcloud container clusters create-auto --dataplane-v2-observability-mode=EXTERNAL_LB

Flag --dataplane-v2-observability-mode has been removed.

DISABLED

Disables Advanced Datapath Observability.

EXTERNAL_LB

Makes Advanced Datapath Observability available to the external network.

INTERNAL_VPC_LB

Makes Advanced Datapath Observability available from the VPC network.

--disable-pod-snapshots

Disable the Pod Snapshot feature on the cluster.

--enable-pod-snapshots

Enable the Pod Snapshot feature on the cluster.

1) The private network the cluster connects to if
`--enable-private-nodes` is specified.
2) Google Compute Engine Public IPs if `--enable-private-nodes` is not
specified.

--location=LOCATION

Compute zone or region (e.g. us-central1-a or us-central1) for the cluster. Overrides the default compute/region or compute/zone value for this command invocation. Prefer using this flag over the --region or --zone flags.

--region=REGION

Compute region (e.g. us-central1) for a regional cluster. Overrides the default compute/region property value for this command invocation.

--zone=ZONE, -z ZONE

Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the default compute/zone property value for this command invocation.

Examples:

gcloud container clusters create-auto example-cluster --scopes=https://www.googleapis.com/auth/devstorage.read_only

gcloud container clusters create-auto example-cluster --scopes=bigquery,storage-rw,compute-ro

Multiple scopes can be specified, separated by commas. Various scopes are automatically added based on feature usage. Such scopes are not added if an equivalent scope already exists.

• monitoring-write: always added to ensure metrics can be written
• logging-write: added if Cloud Logging is enabled (--enable-cloud-logging/--logging)
• monitoring: added if Cloud Monitoring is enabled (--enable-cloud-monitoring/--monitoring)
• gke-default: added for Autopilot clusters that use the default service account
• cloud-platform: added for Autopilot clusters that use any other service account

Alias	URI
bigquery	https://www.googleapis.com/auth/bigquery
cloud-platform	https://www.googleapis.com/auth/cloud-platform
cloud-source-repos	https://www.googleapis.com/auth/source.full_control
cloud-source-repos-ro	https://www.googleapis.com/auth/source.read_only
compute-ro	https://www.googleapis.com/auth/compute.readonly
compute-rw	https://www.googleapis.com/auth/compute
datastore	https://www.googleapis.com/auth/datastore
default	https://www.googleapis.com/auth/devstorage.read_only
	https://www.googleapis.com/auth/logging.write
	https://www.googleapis.com/auth/monitoring.write
	https://www.googleapis.com/auth/pubsub
	https://www.googleapis.com/auth/service.management.readonly
	https://www.googleapis.com/auth/servicecontrol
	https://www.googleapis.com/auth/trace.append
gke-default	https://www.googleapis.com/auth/devstorage.read_only
	https://www.googleapis.com/auth/logging.write
	https://www.googleapis.com/auth/monitoring
	https://www.googleapis.com/auth/service.management.readonly
	https://www.googleapis.com/auth/servicecontrol
	https://www.googleapis.com/auth/trace.append
logging-write	https://www.googleapis.com/auth/logging.write
monitoring	https://www.googleapis.com/auth/monitoring
monitoring-read	https://www.googleapis.com/auth/monitoring.read
monitoring-write	https://www.googleapis.com/auth/monitoring.write
pubsub	https://www.googleapis.com/auth/pubsub
service-control	https://www.googleapis.com/auth/servicecontrol
service-management	https://www.googleapis.com/auth/service.management.readonly
sql (deprecated)	https://www.googleapis.com/auth/sqlservice
sql-admin	https://www.googleapis.com/auth/sqlservice.admin
storage-full	https://www.googleapis.com/auth/devstorage.full_control
storage-ro	https://www.googleapis.com/auth/devstorage.read_only
storage-rw	https://www.googleapis.com/auth/devstorage.read_write
taskqueue	https://www.googleapis.com/auth/taskqueue
trace	https://www.googleapis.com/auth/trace.append
userinfo-email	https://www.googleapis.com/auth/userinfo.email

Run $ gcloud help for details.

gcloud alpha container clusters create-auto

gcloud beta container clusters create-auto