This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Kubeadm Generated

  • 1:
  • 2:
    • 2.1:
    • 2.2:
    • 2.3:
    • 2.4:
    • 2.5:
    • 2.6:
    • 2.7:
    • 2.8:
    • 2.9:
    • 2.10:
    • 2.11:
    • 2.12:
    • 2.13:
    • 2.14:
    • 2.15:
    • 2.16:
  • 3:
    • 4:
      • 4.1:
      • 4.2:
      • 4.3:
      • 4.4:
      • 4.5:
      • 4.6:
      • 4.7:
      • 4.8:
      • 4.9:
      • 4.10:
    • 5:
      • 5.1:
      • 5.2:
      • 5.3:
      • 5.4:
      • 5.5:
      • 5.6:
      • 5.7:
      • 5.8:
      • 5.9:
      • 5.10:
      • 5.11:
      • 5.12:
      • 5.13:
      • 5.14:
      • 5.15:
      • 5.16:
      • 5.17:
      • 5.18:
      • 5.19:
      • 5.20:
      • 5.21:
      • 5.22:
      • 5.23:
      • 5.24:
      • 5.25:
      • 5.26:
      • 5.27:
      • 5.28:
      • 5.29:
      • 5.30:
      • 5.31:
      • 5.32:
      • 5.33:
      • 5.34:
      • 5.35:
      • 5.36:
      • 5.37:
      • 5.38:
      • 5.39:
      • 5.40:
      • 5.41:
      • 5.42:
      • 5.43:
      • 5.44:
      • 5.45:
      • 5.46:
    • 6:
      • 6.1:
      • 6.2:
      • 6.3:
      • 6.4:
      • 6.5:
      • 6.6:
      • 6.7:
      • 6.8:
      • 6.9:
      • 6.10:
      • 6.11:
      • 6.12:
      • 6.13:
      • 6.14:
    • 7:
      • 7.1:
    • 8:
      • 8.1:
      • 8.2:
      • 8.3:
      • 8.4:
    • 9:
      • 9.1:
      • 9.2:
      • 9.3:
      • 9.4:
    • 10:
      • 10.1:
      • 10.2:
      • 10.3:
      • 10.4:
      • 10.5:
      • 10.6:
      • 10.7:
      • 10.8:
    • 11:
      • 12:

      1 -

      kubeadm: easily bootstrap a secure Kubernetes cluster

      Synopsis

      ┌──────────────────────────────────────────────────────────┐
│ KUBEADM                                                  │
│ Easily bootstrap a secure Kubernetes cluster             │
│                                                          │
│ Please give us feedback at:                              │
│ https://github.com/kubernetes/kubeadm/issues             │
└──────────────────────────────────────────────────────────┘

      Example usage:

      Create a two-machine cluster with one control-plane node
(which controls the cluster), and one worker node
(where your workloads, like Pods and Deployments run).

┌──────────────────────────────────────────────────────────┐
│ On the first machine:                                    │
├──────────────────────────────────────────────────────────┤
│ control-plane# kubeadm init                              │
└──────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────┐
│ On the second machine:                                   │
├──────────────────────────────────────────────────────────┤
│ worker# kubeadm join <arguments-returned-from-init>      │
└──────────────────────────────────────────────────────────┘

You can then repeat the second step on as many other machines as you like.

      Options

      -h, --help

      help for kubeadm

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2 -

      Commands related to handling kubernetes certificates

      Synopsis

      Commands related to handling kubernetes certificates

      kubeadm certs [flags]

      Options

      -h, --help

      help for certs

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.1 -

      Generate certificate keys

      Synopsis

      This command will print out a secure randomly-generated certificate key that can be used with the "init" command.

      You can also use "kubeadm init --upload-certs" without specifying a certificate key and it will generate and print one for you.

      kubeadm certs certificate-key [flags]

      Options

      -h, --help

      help for certificate-key

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.2 -

      Check certificates expiration for a Kubernetes cluster

      Synopsis

      Checks expiration for the certificates in the local PKI managed by kubeadm.

      kubeadm certs check-expiration [flags]

      Options

      --allow-missing-template-keys     Default: true

      If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for check-expiration

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      -o, --output string     Default: "text"

      Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

      --show-managed-fields

      If true, keep the managedFields when printing objects in JSON or YAML format.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.3 -

      Generate keys and certificate signing requests

      Synopsis

      Generates keys and certificate signing requests (CSRs) for all the certificates required to run the control plane. This command also generates partial kubeconfig files with private key data in the "users > user > client-key-data" field, and for each kubeconfig file an accompanying ".csr" file is created.

      This command is designed for use in Kubeadm External CA Mode. It generates CSRs which you can then submit to your external certificate authority for signing.

      The PEM encoded signed certificates should then be saved alongside the key files, using ".crt" as the file extension, or in the case of kubeconfig files, the PEM encoded signed certificate should be base64 encoded and added to the kubeconfig file in the "users > user > client-certificate-data" field.

      kubeadm certs generate-csr [flags]

      Examples

        # The following command will generate keys and CSRs for all control-plane certificates and kubeconfig files:
  kubeadm certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki

      Options

      --cert-dir string

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for generate-csr

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.4 -

      Renew certificates for a Kubernetes cluster

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm certs renew [flags]

      Options

      -h, --help

      help for renew

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.5 -

      Renew the certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself

      Synopsis

      Renew the certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew admin.conf [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for admin.conf

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.6 -

      Renew all available certificates

      Synopsis

      Renew all known certificates necessary to run the control plane. Renewals are run unconditionally, regardless of expiration date. Renewals can also be run individually for more control.

      kubeadm certs renew all [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for all

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.7 -

      Renew the certificate the apiserver uses to access etcd

      Synopsis

      Renew the certificate the apiserver uses to access etcd.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew apiserver-etcd-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for apiserver-etcd-client

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.8 -

      Renew the certificate for the API server to connect to kubelet

      Synopsis

      Renew the certificate for the API server to connect to kubelet.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew apiserver-kubelet-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for apiserver-kubelet-client

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.9 -

      Renew the certificate for serving the Kubernetes API

      Synopsis

      Renew the certificate for serving the Kubernetes API.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew apiserver [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for apiserver

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.10 -

      Renew the certificate embedded in the kubeconfig file for the controller manager to use

      Synopsis

      Renew the certificate embedded in the kubeconfig file for the controller manager to use.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew controller-manager.conf [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for controller-manager.conf

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.11 -

      Renew the certificate for liveness probes to healthcheck etcd

      Synopsis

      Renew the certificate for liveness probes to healthcheck etcd.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew etcd-healthcheck-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for etcd-healthcheck-client

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.12 -

      Renew the certificate for etcd nodes to communicate with each other

      Synopsis

      Renew the certificate for etcd nodes to communicate with each other.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew etcd-peer [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for etcd-peer

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.13 -

      Renew the certificate for serving etcd

      Synopsis

      Renew the certificate for serving etcd.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew etcd-server [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for etcd-server

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.14 -

      Renew the certificate for the front proxy client

      Synopsis

      Renew the certificate for the front proxy client.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew front-proxy-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for front-proxy-client

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.15 -

      Renew the certificate embedded in the kubeconfig file for the scheduler manager to use

      Synopsis

      Renew the certificate embedded in the kubeconfig file for the scheduler manager to use.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew scheduler.conf [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for scheduler.conf

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      2.16 -

      Renew the certificate embedded in the kubeconfig file for the super-admin

      Synopsis

      Renew the certificate embedded in the kubeconfig file for the super-admin.

      Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

      Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

      After renewal, in order to make changes effective, is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

      kubeadm certs renew super-admin.conf [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save the certificates

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for super-admin.conf

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      3 -

      Output shell completion code for the specified shell (bash or zsh)

      Synopsis

      Output shell completion code for the specified shell (bash or zsh). The shell code must be evaluated to provide interactive completion of kubeadm commands. This can be done by sourcing it from the .bash_profile.

      Note: this requires the bash-completion framework.

      To install it on Mac use homebrew: $ brew install bash-completion Once installed, bash_completion must be evaluated. This can be done by adding the following line to the .bash_profile $ source $(brew --prefix)/etc/bash_completion

      If bash-completion is not installed on Linux, please install the 'bash-completion' package via your distribution's package manager.

      Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2

      kubeadm completion SHELL [flags]

      Examples

      
# Install bash completion on a Mac using homebrew
brew install bash-completion
printf "\n# Bash completion support\nsource $(brew --prefix)/etc/bash_completion\n" >> $HOME/.bash_profile
source $HOME/.bash_profile

# Load the kubeadm completion code for bash into the current shell
source <(kubeadm completion bash)

# Write bash completion code to a file and source it from .bash_profile
kubeadm completion bash > ~/.kube/kubeadm_completion.bash.inc
printf "\n# Kubeadm shell completion\nsource '$HOME/.kube/kubeadm_completion.bash.inc'\n" >> $HOME/.bash_profile
source $HOME/.bash_profile

# Load the kubeadm completion code for zsh[1] into the current shell
source <(kubeadm completion zsh)

      Options

      -h, --help

      help for completion

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4 -

      Manage configuration for a kubeadm cluster persisted in a ConfigMap in the cluster

      Synopsis

      There is a ConfigMap in the kube-system namespace called "kubeadm-config" that kubeadm uses to store internal configuration about the cluster. kubeadm CLI v1.8.0+ automatically creates this ConfigMap with the config used with 'kubeadm init', but if you initialized your cluster using kubeadm v1.7.x or lower, you must use the 'kubeadm init phase upload-config' command to create this ConfigMap. This is required so that 'kubeadm upgrade' can configure your upgraded cluster correctly.

      kubeadm config [flags]

      Options

      -h, --help

      help for config

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.1 -

      Interact with container images used by kubeadm

      Synopsis

      Interact with container images used by kubeadm

      kubeadm config images [flags]

      Options

      -h, --help

      help for images

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.2 -

      Print a list of images kubeadm will use. The configuration file is used in case any images or image repositories are customized

      Synopsis

      Print a list of images kubeadm will use. The configuration file is used in case any images or image repositories are customized

      kubeadm config images list [flags]

      Options

      --allow-missing-template-keys     Default: true

      If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

      --config string

      Path to a kubeadm configuration file.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for list

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      -o, --output string     Default: "text"

      Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

      --show-managed-fields

      If true, keep the managedFields when printing objects in JSON or YAML format.

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.3 -

      Pull images used by kubeadm

      Synopsis

      Pull images used by kubeadm

      kubeadm config images pull [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for pull

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.4 -

      Read an older version of the kubeadm configuration API types from a file, and output the similar config object for the newer version

      Synopsis

      This command lets you convert configuration objects of older versions to the latest supported version, locally in the CLI tool without ever touching anything in the cluster. In this version of kubeadm, the following API versions are supported:

      • kubeadm.k8s.io/v1beta4

      Further, kubeadm can only write out config of version "kubeadm.k8s.io/v1beta4", but read both types. So regardless of what version you pass to the --old-config parameter here, the API object will be read, deserialized, defaulted, converted, validated, and re-serialized when written to stdout or --new-config if specified.

      In other words, the output of this command is what kubeadm actually would read internally if you submitted this file to "kubeadm init"

      kubeadm config migrate [flags]

      Options

      --allow-experimental-api

      Allow migration to experimental, unreleased APIs.

      -h, --help

      help for migrate

      --new-config string

      Path to the resulting equivalent kubeadm config file using the new API version. Optional, if not specified output will be sent to STDOUT.

      --old-config string

      Path to the kubeadm config file that is using an old API version and should be converted. This flag is mandatory.

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.5 -

      Print configuration

      Synopsis

      This command prints configurations for subcommands provided. For details, see: https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#section-directories

      kubeadm config print [flags]

      Options

      -h, --help

      help for print

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.6 -

      Print default init configuration, that can be used for 'kubeadm init'

      Synopsis

      This command prints objects such as the default init configuration that is used for 'kubeadm init'.

      Note that sensitive values like the Bootstrap Token fields are replaced with placeholder values like "abcdef.0123456789abcdef" in order to pass validation but not perform the real computation for creating a token.

      kubeadm config print init-defaults [flags]

      Options

      --component-configs strings

      A comma-separated list for component config API objects to print the default values for. Available values: [KubeProxyConfiguration KubeletConfiguration]. If this flag is not set, no component configs will be printed.

      -h, --help

      help for init-defaults

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.7 -

      Print default join configuration, that can be used for 'kubeadm join'

      Synopsis

      This command prints objects such as the default join configuration that is used for 'kubeadm join'.

      Note that sensitive values like the Bootstrap Token fields are replaced with placeholder values like "abcdef.0123456789abcdef" in order to pass validation but not perform the real computation for creating a token.

      kubeadm config print join-defaults [flags]

      Options

      -h, --help

      help for join-defaults

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.8 -

      Print default reset configuration, that can be used for 'kubeadm reset'

      Synopsis

      This command prints objects such as the default reset configuration that is used for 'kubeadm reset'.

      Note that sensitive values like the Bootstrap Token fields are replaced with placeholder values like "abcdef.0123456789abcdef" in order to pass validation but not perform the real computation for creating a token.

      kubeadm config print reset-defaults [flags]

      Options

      -h, --help

      help for reset-defaults

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.9 -

      Print default upgrade configuration, that can be used for 'kubeadm upgrade'

      Synopsis

      This command prints objects such as the default upgrade configuration that is used for 'kubeadm upgrade'.

      Note that sensitive values like the Bootstrap Token fields are replaced with placeholder values like "abcdef.0123456789abcdef" in order to pass validation but not perform the real computation for creating a token.

      kubeadm config print upgrade-defaults [flags]

      Options

      -h, --help

      help for upgrade-defaults

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      4.10 -

      Read a file containing the kubeadm configuration API and report any validation problems

      Synopsis

      This command lets you validate a kubeadm configuration API file and report any warnings and errors. If there are no errors the exit status will be zero, otherwise it will be non-zero. Any unmarshaling problems such as unknown API fields will trigger errors. Unknown API versions and fields with invalid values will also trigger errors. Any other errors or warnings may be reported depending on contents of the input file.

      In this version of kubeadm, the following API versions are supported:

      • kubeadm.k8s.io/v1beta4
      kubeadm config validate [flags]

      Options

      --allow-experimental-api

      Allow validation of experimental, unreleased APIs.

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for validate

      Options inherited from parent commands

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5 -

      Run this command in order to set up the Kubernetes control plane

      Synopsis

      Run this command in order to set up the Kubernetes control plane

      The "init" command executes the following phases:

      preflight                     Run pre-flight checks
certs                         Certificate generation
  /ca                           Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components
  /apiserver                    Generate the certificate for serving the Kubernetes API
  /apiserver-kubelet-client     Generate the certificate for the API server to connect to kubelet
  /front-proxy-ca               Generate the self-signed CA to provision identities for front proxy
  /front-proxy-client           Generate the certificate for the front proxy client
  /etcd-ca                      Generate the self-signed CA to provision identities for etcd
  /etcd-server                  Generate the certificate for serving etcd
  /etcd-peer                    Generate the certificate for etcd nodes to communicate with each other
  /etcd-healthcheck-client      Generate the certificate for liveness probes to healthcheck etcd
  /apiserver-etcd-client        Generate the certificate the apiserver uses to access etcd
  /sa                           Generate a private key for signing service account tokens along with its public key
kubeconfig                    Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file
  /admin                        Generate a kubeconfig file for the admin to use and for kubeadm itself
  /super-admin                  Generate a kubeconfig file for the super-admin
  /kubelet                      Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes
  /controller-manager           Generate a kubeconfig file for the controller manager to use
  /scheduler                    Generate a kubeconfig file for the scheduler to use
etcd                          Generate static Pod manifest file for local etcd
  /local                        Generate the static Pod manifest file for a local, single-node local etcd instance
control-plane                 Generate all static Pod manifest files necessary to establish the control plane
  /apiserver                    Generates the kube-apiserver static Pod manifest
  /controller-manager           Generates the kube-controller-manager static Pod manifest
  /scheduler                    Generates the kube-scheduler static Pod manifest
kubelet-start                 Write kubelet settings and (re)start the kubelet
upload-config                 Upload the kubeadm and kubelet configuration to a ConfigMap
  /kubeadm                      Upload the kubeadm ClusterConfiguration to a ConfigMap
  /kubelet                      Upload the kubelet component config to a ConfigMap
upload-certs                  Upload certificates to kubeadm-certs
mark-control-plane            Mark a node as a control-plane
bootstrap-token               Generates bootstrap tokens used to join a node to a cluster
kubelet-finalize              Updates settings relevant to the kubelet after TLS bootstrap
  /enable-client-cert-rotation  Enable kubelet client certificate rotation
  /experimental-cert-rotation   Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead)
addon                         Install required addons for passing conformance tests
  /coredns                      Install the CoreDNS addon to a Kubernetes cluster
  /kube-proxy                   Install the kube-proxy addon to a Kubernetes cluster
show-join-command             Show the join command for control-plane and worker node

      kubeadm init [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --apiserver-cert-extra-sans strings

      Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --certificate-key string

      Key used to encrypt the control-plane certificates in the kubeadm-certs Secret. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for init

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --pod-network-cidr string

      Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      --service-dns-domain string     Default: "cluster.local"

      Use alternative domain for services, e.g. "myorg.internal".

      --skip-certificate-key-print

      Don't print the key used to encrypt the control-plane certificates.

      --skip-phases strings

      List of phases to be skipped

      --skip-token-print

      Skip printing of the default bootstrap token generated by 'kubeadm init'.

      --token string

      The token to use for establishing bidirectional trust between nodes and control-plane nodes. The format is [a-z0-9]{6}.[a-z0-9]{16} - e.g. abcdef.0123456789abcdef

      --token-ttl duration     Default: 24h0m0s

      The duration before the token is automatically deleted (e.g. 1s, 2m, 3h). If set to '0', the token will never expire

      --upload-certs

      Upload control-plane certificates to the kubeadm-certs Secret.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.1 -

      Use this command to invoke single phase of the init workflow

      Synopsis

      Use this command to invoke single phase of the init workflow

      Options

      -h, --help

      help for phase

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.2 -

      Install required addons for passing conformance tests

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase addon [flags]

      Options

      -h, --help

      help for addon

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.3 -

      Install all the addons

      Synopsis

      Install all the addons

      kubeadm init phase addon all [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for all

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --pod-network-cidr string

      Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      --service-dns-domain string     Default: "cluster.local"

      Use alternative domain for services, e.g. "myorg.internal".

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.4 -

      Install the CoreDNS addon to a Kubernetes cluster

      Synopsis

      Install the CoreDNS addon components via the API server. Please note that although the DNS server is deployed, it will not be scheduled until CNI is installed.

      kubeadm init phase addon coredns [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for coredns

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --print-manifest

      Print the addon manifests to STDOUT instead of installing them

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      --service-dns-domain string     Default: "cluster.local"

      Use alternative domain for services, e.g. "myorg.internal".

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.5 -

      Install the kube-proxy addon to a Kubernetes cluster

      Synopsis

      Install the kube-proxy addon components via the API server.

      kubeadm init phase addon kube-proxy [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kube-proxy

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --pod-network-cidr string

      Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

      --print-manifest

      Print the addon manifests to STDOUT instead of installing them

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.6 -

      Generates bootstrap tokens used to join a node to a cluster

      Synopsis

      Bootstrap tokens are used for establishing bidirectional trust between a node joining the cluster and a control-plane node.

      This command makes all the configurations required to make bootstrap tokens works and then creates an initial token.

      kubeadm init phase bootstrap-token [flags]

      Examples

        # Make all the bootstrap token configurations and create an initial token, functionally
  # equivalent to what generated by kubeadm init.
  kubeadm init phase bootstrap-token

      Options

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for bootstrap-token

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --skip-token-print

      Skip printing of the default bootstrap token generated by 'kubeadm init'.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.7 -

      Certificate generation

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase certs [flags]

      Options

      -h, --help

      help for certs

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.8 -

      Generate all certificates

      Synopsis

      Generate all certificates

      kubeadm init phase certs all [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-cert-extra-sans strings

      Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      --service-dns-domain string     Default: "cluster.local"

      Use alternative domain for services, e.g. "myorg.internal".

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.9 -

      Generate the certificate the apiserver uses to access etcd

      Synopsis

      Generate the certificate the apiserver uses to access etcd, and save them into apiserver-etcd-client.crt and apiserver-etcd-client.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs apiserver-etcd-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for apiserver-etcd-client

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.10 -

      Generate the certificate for the API server to connect to kubelet

      Synopsis

      Generate the certificate for the API server to connect to kubelet, and save them into apiserver-kubelet-client.crt and apiserver-kubelet-client.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs apiserver-kubelet-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for apiserver-kubelet-client

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.11 -

      Generate the certificate for serving the Kubernetes API

      Synopsis

      Generate the certificate for serving the Kubernetes API, and save them into apiserver.crt and apiserver.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs apiserver [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-cert-extra-sans strings

      Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for apiserver

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      --service-dns-domain string     Default: "cluster.local"

      Use alternative domain for services, e.g. "myorg.internal".

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.12 -

      Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components

      Synopsis

      Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components, and save them into ca.crt and ca.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs ca [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for ca

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.13 -

      Generate the self-signed CA to provision identities for etcd

      Synopsis

      Generate the self-signed CA to provision identities for etcd, and save them into etcd/ca.crt and etcd/ca.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs etcd-ca [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for etcd-ca

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.14 -

      Generate the certificate for liveness probes to healthcheck etcd

      Synopsis

      Generate the certificate for liveness probes to healthcheck etcd, and save them into etcd/healthcheck-client.crt and etcd/healthcheck-client.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs etcd-healthcheck-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for etcd-healthcheck-client

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.15 -

      Generate the certificate for etcd nodes to communicate with each other

      Synopsis

      Generate the certificate for etcd nodes to communicate with each other, and save them into etcd/peer.crt and etcd/peer.key files.

      Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs etcd-peer [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for etcd-peer

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.16 -

      Generate the certificate for serving etcd

      Synopsis

      Generate the certificate for serving etcd, and save them into etcd/server.crt and etcd/server.key files.

      Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs etcd-server [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for etcd-server

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.17 -

      Generate the self-signed CA to provision identities for front proxy

      Synopsis

      Generate the self-signed CA to provision identities for front proxy, and save them into front-proxy-ca.crt and front-proxy-ca.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs front-proxy-ca [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for front-proxy-ca

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.18 -

      Generate the certificate for the front proxy client

      Synopsis

      Generate the certificate for the front proxy client, and save them into front-proxy-client.crt and front-proxy-client.key files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs front-proxy-client [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for front-proxy-client

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.19 -

      Generate a private key for signing service account tokens along with its public key

      Synopsis

      Generate the private key for signing service account tokens along with its public key, and save them into sa.key and sa.pub files.

      If both files already exist, kubeadm skips the generation step and existing files will be used.

      kubeadm init phase certs sa [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for sa

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.20 -

      Generate all static Pod manifest files necessary to establish the control plane

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase control-plane [flags]

      Options

      -h, --help

      help for control-plane

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.21 -

      Generate all static Pod manifest files

      Synopsis

      Generate all static Pod manifest files

      kubeadm init phase control-plane all [flags]

      Examples

        # Generates all static Pod manifest files for control plane components,
  # functionally equivalent to what is generated by kubeadm init.
  kubeadm init phase control-plane all
  
  # Generates all static Pod manifest files using options read from a configuration file.
  kubeadm init phase control-plane all --config config.yaml

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for all

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --pod-network-cidr string

      Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.22 -

      Generates the kube-apiserver static Pod manifest

      Synopsis

      Generates the kube-apiserver static Pod manifest

      kubeadm init phase control-plane apiserver [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      --feature-gates string

      A set of key=value pairs that describe feature gates for various features. Options are:
      ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
      EtcdLearnerMode=true|false (BETA - default=true)
      PublicKeysECDSA=true|false (DEPRECATED - default=false)
      RootlessControlPlane=true|false (ALPHA - default=false)
      WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

      -h, --help

      help for apiserver

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --service-cidr string     Default: "10.96.0.0/12"

      Use alternative range of IP address for service VIPs.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.23 -

      Generates the kube-controller-manager static Pod manifest

      Synopsis

      Generates the kube-controller-manager static Pod manifest

      kubeadm init phase control-plane controller-manager [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for controller-manager

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --pod-network-cidr string

      Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.24 -

      Generates the kube-scheduler static Pod manifest

      Synopsis

      Generates the kube-scheduler static Pod manifest

      kubeadm init phase control-plane scheduler [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for scheduler

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.25 -

      Generate static Pod manifest file for local etcd

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase etcd [flags]

      Options

      -h, --help

      help for etcd

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.26 -

      Generate the static Pod manifest file for a local, single-node local etcd instance

      Synopsis

      Generate the static Pod manifest file for a local, single-node local etcd instance

      kubeadm init phase etcd local [flags]

      Examples

        # Generates the static Pod manifest file for etcd, functionally
  # equivalent to what is generated by kubeadm init.
  kubeadm init phase etcd local
  
  # Generates the static Pod manifest file for etcd using options
  # read from a configuration file.
  kubeadm init phase etcd local --config config.yaml

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for local

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.27 -

      Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase kubeconfig [flags]

      Options

      -h, --help

      help for kubeconfig

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.28 -

      Generate a kubeconfig file for the admin to use and for kubeadm itself

      Synopsis

      Generate the kubeconfig file for the admin and for kubeadm itself, and save it to admin.conf file.

      kubeadm init phase kubeconfig admin [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for admin

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.29 -

      Generate all kubeconfig files

      Synopsis

      Generate all kubeconfig files

      kubeadm init phase kubeconfig all [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --node-name string

      Specify the node name.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.30 -

      Generate a kubeconfig file for the controller manager to use

      Synopsis

      Generate the kubeconfig file for the controller manager to use and save it to controller-manager.conf file

      kubeadm init phase kubeconfig controller-manager [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for controller-manager

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.31 -

      Generate a kubeconfig file for the kubelet to use only for cluster bootstrapping purposes

      Synopsis

      Generate the kubeconfig file for the kubelet to use and save it to kubelet.conf file.

      Please note that this should only be used for cluster bootstrapping purposes. After your control plane is up, you should request all kubelet credentials from the CSR API.

      kubeadm init phase kubeconfig kubelet [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubelet

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      --node-name string

      Specify the node name.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.32 -

      Generate a kubeconfig file for the scheduler to use

      Synopsis

      Generate the kubeconfig file for the scheduler to use and save it to scheduler.conf file.

      kubeadm init phase kubeconfig scheduler [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for scheduler

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.33 -

      Generate a kubeconfig file for the super-admin

      Synopsis

      Generate a kubeconfig file for the super-admin, and save it to super-admin.conf file.

      kubeadm init phase kubeconfig super-admin [flags]

      Options

      --apiserver-advertise-address string

      The IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      Port for the API Server to bind to.

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --control-plane-endpoint string

      Specify a stable IP address or DNS name for the control plane.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for super-admin

      --kubeconfig-dir string     Default: "/etc/kubernetes"

      The path where to save the kubeconfig file.

      --kubernetes-version string     Default: "stable-1"

      Choose a specific Kubernetes version for the control plane.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.34 -

      Updates settings relevant to the kubelet after TLS bootstrap

      Synopsis

      Updates settings relevant to the kubelet after TLS bootstrap

      kubeadm init phase kubelet-finalize [flags]

      Examples

        # Updates settings relevant to the kubelet after TLS bootstrap"
  kubeadm init phase kubelet-finalize all --config

      Options

      -h, --help

      help for kubelet-finalize

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.35 -

      Run all kubelet-finalize phases

      Synopsis

      Run all kubelet-finalize phases

      kubeadm init phase kubelet-finalize all [flags]

      Examples

        # Updates settings relevant to the kubelet after TLS bootstrap"
  kubeadm init phase kubelet-finalize all --config

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.36 -

      Enable kubelet client certificate rotation

      Synopsis

      Enable kubelet client certificate rotation

      kubeadm init phase kubelet-finalize enable-client-cert-rotation [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for enable-client-cert-rotation

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.37 -

      Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead)

      Synopsis

      Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead)

      kubeadm init phase kubelet-finalize experimental-cert-rotation [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path where to save and store the certificates.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for experimental-cert-rotation

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.38 -

      Write kubelet settings and (re)start the kubelet

      Synopsis

      Write a file with KubeletConfiguration and an environment file with node specific kubelet settings, and then (re)start kubelet.

      kubeadm init phase kubelet-start [flags]

      Examples

        # Writes a dynamic environment file with kubelet flags from a InitConfiguration file.
  kubeadm init phase kubelet-start --config config.yaml

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubelet-start

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.39 -

      Mark a node as a control-plane

      Synopsis

      Mark a node as a control-plane

      kubeadm init phase mark-control-plane [flags]

      Examples

        # Applies control-plane label and taint to the current node, functionally equivalent to what executed by kubeadm init.
  kubeadm init phase mark-control-plane --config config.yaml
  
  # Applies control-plane label and taint to a specific node
  kubeadm init phase mark-control-plane --node-name myNode

      Options

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for mark-control-plane

      --node-name string

      Specify the node name.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.40 -

      Run pre-flight checks

      Synopsis

      Run pre-flight checks for kubeadm init.

      kubeadm init phase preflight [flags]

      Examples

        # Run pre-flight checks for kubeadm init using a config file.
  kubeadm init phase preflight --config kubeadm-config.yaml

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for preflight

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --image-repository string     Default: "registry.k8s.io"

      Choose a container registry to pull control plane images from

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.41 -

      Show the join command for control-plane and worker node

      Synopsis

      Show the join command for control-plane and worker node

      kubeadm init phase show-join-command [flags]

      Options

      -h, --help

      help for show-join-command

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.42 -

      Upload certificates to kubeadm-certs

      Synopsis

      Upload control plane certificates to the kubeadm-certs Secret

      kubeadm init phase upload-certs [flags]

      Options

      --certificate-key string

      Key used to encrypt the control-plane certificates in the kubeadm-certs Secret. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for upload-certs

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --skip-certificate-key-print

      Don't print the key used to encrypt the control-plane certificates.

      --upload-certs

      Upload control-plane certificates to the kubeadm-certs Secret.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.43 -

      Upload the kubeadm and kubelet configuration to a ConfigMap

      Synopsis

      This command is not meant to be run on its own. See list of available subcommands.

      kubeadm init phase upload-config [flags]

      Options

      -h, --help

      help for upload-config

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.44 -

      Upload all configuration to a config map

      Synopsis

      Upload all configuration to a config map

      kubeadm init phase upload-config all [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.45 -

      Upload the kubeadm ClusterConfiguration to a ConfigMap

      Synopsis

      Upload the kubeadm ClusterConfiguration to a ConfigMap called kubeadm-config in the kube-system namespace. This enables correct configuration of system components and a seamless user experience when upgrading.

      Alternatively, you can use kubeadm config.

      kubeadm init phase upload-config kubeadm [flags]

      Examples

        # upload the configuration of your cluster
  kubeadm init phase upload-config --config=myConfig.yaml

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubeadm

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      5.46 -

      Upload the kubelet component config to a ConfigMap

      Synopsis

      Upload the kubelet configuration extracted from the kubeadm InitConfiguration object to a kubelet-config ConfigMap in the cluster

      kubeadm init phase upload-config kubelet [flags]

      Examples

        # Upload the kubelet configuration from the kubeadm Config file to a ConfigMap in the cluster.
  kubeadm init phase upload-config kubelet --config kubeadm.yaml

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubelet

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6 -

      Run this on any machine you wish to join an existing cluster

      Synopsis

      When joining a kubeadm initialized cluster, we need to establish bidirectional trust. This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).

      There are 2 main schemes for discovery. The first is to use a shared token along with the IP address of the API server. The second is to provide a file - a subset of the standard kubeconfig file. The discovery/kubeconfig file supports token, client-go authentication plugins ("exec"), "tokenFile", and "authProvider". This file can be a local file or downloaded via an HTTPS URL. The forms are kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443, kubeadm join --discovery-file path/to/file.conf, or kubeadm join --discovery-file https://url/file.conf. Only one form can be used. If the discovery information is loaded from a URL, HTTPS must be used. Also, in that case the host installed CA bundle is used to verify the connection.

      If you use a shared token for discovery, you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane. The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256". The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469). This value is available in the output of "kubeadm init" or can be calculated using standard tools. The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.

      If you cannot know the CA public key hash ahead of time, you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification. This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.

      The TLS bootstrap mechanism is also driven via a shared token. This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created key pair. By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests. This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.

      Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.

      The "join [api-server-endpoint]" command executes the following phases:

      preflight              Run join pre-flight checks
control-plane-prepare  Prepare the machine for serving a control plane
  /download-certs        Download certificates shared among control-plane nodes from the kubeadm-certs Secret
  /certs                 Generate the certificates for the new control plane components
  /kubeconfig            Generate the kubeconfig for the new control plane components
  /control-plane         Generate the manifests for the new control plane components
kubelet-start          Write kubelet settings, certificates and (re)start the kubelet
control-plane-join     Join a machine as a control plane instance
  /etcd                  Add a new local etcd member
  /mark-control-plane    Mark a node as a control-plane
wait-control-plane     EXPERIMENTAL: Wait for the control plane to start

      kubeadm join [api-server-endpoint] [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      If the node should host a new control plane instance, the port for the API Server to bind to.

      --certificate-key string

      Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for join

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --skip-phases strings

      List of phases to be skipped

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.1 -

      Use this command to invoke single phase of the join workflow

      Synopsis

      Use this command to invoke single phase of the join workflow

      Options

      -h, --help

      help for phase

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.2 -

      Join a machine as a control plane instance

      Synopsis

      Join a machine as a control plane instance

      kubeadm join phase control-plane-join [flags]

      Examples

        # Joins a machine as a control plane instance
  kubeadm join phase control-plane-join all

      Options

      -h, --help

      help for control-plane-join

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.3 -

      Join a machine as a control plane instance

      Synopsis

      Join a machine as a control plane instance

      kubeadm join phase control-plane-join all [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.4 -

      Add a new local etcd member

      Synopsis

      Add a new local etcd member

      kubeadm join phase control-plane-join etcd [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for etcd

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.5 -

      Mark a node as a control-plane

      Synopsis

      Mark a node as a control-plane

      kubeadm join phase control-plane-join mark-control-plane [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for mark-control-plane

      --node-name string

      Specify the node name.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.6 -

      Prepare the machine for serving a control plane

      Synopsis

      Prepare the machine for serving a control plane

      kubeadm join phase control-plane-prepare [flags]

      Examples

        # Prepares the machine for serving a control plane
  kubeadm join phase control-plane-prepare all

      Options

      -h, --help

      help for control-plane-prepare

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.7 -

      Prepare the machine for serving a control plane

      Synopsis

      Prepare the machine for serving a control plane

      kubeadm join phase control-plane-prepare all [api-server-endpoint] [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      If the node should host a new control plane instance, the port for the API Server to bind to.

      --certificate-key string

      Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for all

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.8 -

      Generate the certificates for the new control plane components

      Synopsis

      Generate the certificates for the new control plane components

      kubeadm join phase control-plane-prepare certs [api-server-endpoint] [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for certs

      --node-name string

      Specify the node name.

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.9 -

      Generate the manifests for the new control plane components

      Synopsis

      Generate the manifests for the new control plane components

      kubeadm join phase control-plane-prepare control-plane [flags]

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      If the node should host a new control plane instance, the port for the API Server to bind to.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for control-plane

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.10 -

      Download certificates shared among control-plane nodes from the kubeadm-certs Secret

      Synopsis

      Download certificates shared among control-plane nodes from the kubeadm-certs Secret

      kubeadm join phase control-plane-prepare download-certs [api-server-endpoint] [flags]

      Options

      --certificate-key string

      Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for download-certs

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.11 -

      Generate the kubeconfig for the new control plane components

      Synopsis

      Generate the kubeconfig for the new control plane components

      kubeadm join phase control-plane-prepare kubeconfig [api-server-endpoint] [flags]

      Options

      --certificate-key string

      Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubeconfig

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.12 -

      Write kubelet settings, certificates and (re)start the kubelet

      Synopsis

      Write a file with KubeletConfiguration and an environment file with node specific kubelet settings, and then (re)start kubelet.

      kubeadm join phase kubelet-start [api-server-endpoint] [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for kubelet-start

      --node-name string

      Specify the node name.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.13 -

      Run join pre-flight checks

      Synopsis

      Run pre-flight checks for kubeadm join.

      kubeadm join phase preflight [api-server-endpoint] [flags]

      Examples

        # Run join pre-flight checks using a config file.
  kubeadm join phase preflight --config kubeadm-config.yaml

      Options

      --apiserver-advertise-address string

      If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

      --apiserver-bind-port int32     Default: 6443

      If the node should host a new control plane instance, the port for the API Server to bind to.

      --certificate-key string

      Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

      --config string

      Path to a kubeadm configuration file.

      --control-plane

      Create a new control plane instance on this node

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --discovery-file string

      For file-based discovery, a file or URL from which to load cluster information.

      --discovery-token string

      For token-based discovery, the token used to validate cluster information fetched from the API server.

      --discovery-token-ca-cert-hash strings

      For token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").

      --discovery-token-unsafe-skip-ca-verification

      For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for preflight

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --node-name string

      Specify the node name.

      --tls-bootstrap-token string

      Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

      --token string

      Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      6.14 -

      EXPERIMENTAL: Wait for the control plane to start

      Synopsis

      EXPERIMENTAL: Wait for the control plane to start

      kubeadm join phase wait-control-plane [flags]

      Options

      -h, --help

      help for wait-control-plane

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      7 -

      Kubeconfig file utilities

      Synopsis

      Kubeconfig file utilities.

      Options

      -h, --help

      help for kubeconfig

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      7.1 -

      Output a kubeconfig file for an additional user

      Synopsis

      Output a kubeconfig file for an additional user.

      kubeadm kubeconfig user [flags]

      Examples

        # Output a kubeconfig file for an additional user named foo
  kubeadm kubeconfig user --client-name=foo
  
  # Output a kubeconfig file for an additional user named foo using a kubeadm config file bar
  kubeadm kubeconfig user --client-name=foo --config=bar

      Options

      --client-name string

      The name of user. It will be used as the CN if client certificates are created

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for user

      --org strings

      The organizations of the client certificate. It will be used as the O if client certificates are created

      --token string

      The token that should be used as the authentication mechanism for this kubeconfig, instead of client certificates

      --validity-period duration     Default: 8760h0m0s

      The validity period of the client certificate. It is an offset from the current time.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      8 -

      Performs a best effort revert of changes made to this host by 'kubeadm init' or 'kubeadm join'

      Synopsis

      Performs a best effort revert of changes made to this host by 'kubeadm init' or 'kubeadm join'

      The "reset" command executes the following phases:

      preflight           Run reset pre-flight checks
remove-etcd-member  Remove a local etcd member.
cleanup-node        Run cleanup node.

      kubeadm reset [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path to the directory where the certificates are stored. If specified, clean this directory.

      --cleanup-tmp-dir

      Cleanup the "/etc/kubernetes/tmp" directory

      --config string

      Path to a kubeadm configuration file.

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -f, --force

      Reset the node without prompting for confirmation.

      -h, --help

      help for reset

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --skip-phases strings

      List of phases to be skipped

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      8.1 -

      Use this command to invoke single phase of the reset workflow

      Synopsis

      Use this command to invoke single phase of the reset workflow

      Options

      -h, --help

      help for phase

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      8.2 -

      Run cleanup node.

      Synopsis

      Run cleanup node.

      kubeadm reset phase cleanup-node [flags]

      Options

      --cert-dir string     Default: "/etc/kubernetes/pki"

      The path to the directory where the certificates are stored. If specified, clean this directory.

      --cleanup-tmp-dir

      Cleanup the "/etc/kubernetes/tmp" directory

      --cri-socket string

      Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for cleanup-node

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      8.3 -

      Run reset pre-flight checks

      Synopsis

      Run pre-flight checks for kubeadm reset.

      kubeadm reset phase preflight [flags]

      Options

      --dry-run

      Don't apply any changes; just output what would be done.

      -f, --force

      Reset the node without prompting for confirmation.

      -h, --help

      help for preflight

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      8.4 -

      Remove a local etcd member.

      Synopsis

      Remove a local etcd member for a control plane node.

      kubeadm reset phase remove-etcd-member [flags]

      Options

      --dry-run

      Don't apply any changes; just output what would be done.

      -h, --help

      help for remove-etcd-member

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      9 -

      Manage bootstrap tokens

      Synopsis

      This command manages bootstrap tokens. It is optional and needed only for advanced use cases.

      In short, bootstrap tokens are used for establishing bidirectional trust between a client and a server. A bootstrap token can be used when a client (for example a node that is about to join the cluster) needs to trust the server it is talking to. Then a bootstrap token with the "signing" usage can be used. bootstrap tokens can also function as a way to allow short-lived authentication to the API Server (the token serves as a way for the API Server to trust the client), for example for doing the TLS Bootstrap.

      What is a bootstrap token more exactly?

      • It is a Secret in the kube-system namespace of type "bootstrap.kubernetes.io/token".
      • A bootstrap token must be of the form "[a-z0-9]{6}.[a-z0-9]{16}". The former part is the public token ID, while the latter is the Token Secret and it must be kept private at all circumstances!
      • The name of the Secret must be named "bootstrap-token-(token-id)".

      You can read more about bootstrap tokens here: https://kubernetes.io/docs/admin/bootstrap-tokens/

      kubeadm token [flags]

      Options

      --dry-run

      Whether to enable dry-run mode or not

      -h, --help

      help for token

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      9.1 -

      Create bootstrap tokens on the server

      Synopsis

      This command will create a bootstrap token for you. You can specify the usages for this token, the "time to live" and an optional human friendly description.

      The [token] is the actual token to write. This should be a securely generated random token of the form "[a-z0-9]{6}.[a-z0-9]{16}". If no [token] is given, kubeadm will generate a random token instead.

      kubeadm token create [token]

      Options

      --certificate-key string

      When used together with '--print-join-command', print the full 'kubeadm join' flag needed to join the cluster as a control-plane. To create a new certificate key you must use 'kubeadm init phase upload-certs --upload-certs'.

      --config string

      Path to a kubeadm configuration file.

      --description string

      A human friendly description of how this token is used.

      --groups strings     Default: "system:bootstrappers:kubeadm:default-node-token"

      Extra groups that this token will authenticate as when used for authentication. Must match "\Asystem:bootstrappers:[a-z0-9:-]{0,255}[a-z0-9]\z"

      -h, --help

      help for create

      --print-join-command

      Instead of printing only the token, print the full 'kubeadm join' flag needed to join the cluster using the token.

      --ttl duration     Default: 24h0m0s

      The duration before the token is automatically deleted (e.g. 1s, 2m, 3h). If set to '0', the token will never expire

      --usages strings     Default: "signing,authentication"

      Describes the ways in which this token can be used. You can pass --usages multiple times or provide a comma separated list of options. Valid options: [signing,authentication]

      Options inherited from parent commands

      --dry-run

      Whether to enable dry-run mode or not

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      9.2 -

      Delete bootstrap tokens on the server

      Synopsis

      This command will delete a list of bootstrap tokens for you.

      The [token-value] is the full Token of the form "[a-z0-9]{6}.[a-z0-9]{16}" or the Token ID of the form "[a-z0-9]{6}" to delete.

      kubeadm token delete [token-value] ...

      Options

      -h, --help

      help for delete

      Options inherited from parent commands

      --dry-run

      Whether to enable dry-run mode or not

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      9.3 -

      Generate and print a bootstrap token, but do not create it on the server

      Synopsis

      This command will print out a randomly-generated bootstrap token that can be used with the "init" and "join" commands.

      You don't have to use this command in order to generate a token. You can do so yourself as long as it is in the format "[a-z0-9]{6}.[a-z0-9]{16}". This command is provided for convenience to generate tokens in the given format.

      You can also use "kubeadm init" without specifying a token and it will generate and print one for you.

      kubeadm token generate [flags]

      Options

      -h, --help

      help for generate

      Options inherited from parent commands

      --dry-run

      Whether to enable dry-run mode or not

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      9.4 -

      List bootstrap tokens on the server

      Synopsis

      This command will list all bootstrap tokens for you.

      kubeadm token list [flags]

      Options

      --allow-missing-template-keys     Default: true

      If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

      -h, --help

      help for list

      -o, --output string     Default: "text"

      Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

      --show-managed-fields

      If true, keep the managedFields when printing objects in JSON or YAML format.

      Options inherited from parent commands

      --dry-run

      Whether to enable dry-run mode or not

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10 -

      Upgrade your cluster smoothly to a newer version with this command

      Synopsis

      Upgrade your cluster smoothly to a newer version with this command

      kubeadm upgrade [flags]

      Options

      -h, --help

      help for upgrade

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.1 -

      Upgrade your Kubernetes cluster to the specified version

      Synopsis

      Upgrade your Kubernetes cluster to the specified version

      kubeadm upgrade apply [version]

      Options

      --allow-experimental-upgrades

      Show unstable versions of Kubernetes as an upgrade alternative and allow upgrading to an alpha/beta/release candidate versions of Kubernetes.

      --allow-release-candidate-upgrades

      Show release candidate versions of Kubernetes as an upgrade alternative and allow upgrading to a release candidate versions of Kubernetes.

      --certificate-renewal     Default: true

      Perform the renewal of certificates used by component changed during upgrades.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Do not change any state, just output what actions would be performed.

      --etcd-upgrade     Default: true

      Perform the upgrade of etcd.

      -f, --force

      Force upgrading although some requirements might not be met. This also implies non-interactive mode.

      -h, --help

      help for apply

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --print-config

      Specifies whether the configuration file that will be used in the upgrade should be printed or not.

      -y, --yes

      Perform the upgrade and do not prompt for confirmation (non-interactive mode).

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.2 -

      Show what differences would be applied to existing static pod manifests. See also: kubeadm upgrade apply --dry-run

      Synopsis

      Show what differences would be applied to existing static pod manifests. See also: kubeadm upgrade apply --dry-run

      kubeadm upgrade diff [version] [flags]

      Options

      --config string

      Path to a kubeadm configuration file.

      -c, --context-lines int     Default: 3

      How many lines of context in the diff

      -h, --help

      help for diff

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.3 -

      Upgrade commands for a node in the cluster

      Synopsis

      Upgrade commands for a node in the cluster

      The "node" command executes the following phases:

      preflight       Run upgrade node pre-flight checks
control-plane   Upgrade the control plane instance deployed on this node, if any
kubelet-config  Upgrade the kubelet configuration for this node

      kubeadm upgrade node [flags]

      Options

      --certificate-renewal     Default: true

      Perform the renewal of certificates used by component changed during upgrades.

      --config string

      Path to a kubeadm configuration file.

      --dry-run

      Do not change any state, just output the actions that would be performed.

      --etcd-upgrade     Default: true

      Perform the upgrade of etcd.

      -h, --help

      help for node

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      --skip-phases strings

      List of phases to be skipped

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.4 -

      Use this command to invoke single phase of the node workflow

      Synopsis

      Use this command to invoke single phase of the node workflow

      Options

      -h, --help

      help for phase

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.5 -

      Upgrade the control plane instance deployed on this node, if any

      Synopsis

      Upgrade the control plane instance deployed on this node, if any

      kubeadm upgrade node phase control-plane [flags]

      Options

      --certificate-renewal     Default: true

      Perform the renewal of certificates used by component changed during upgrades.

      --dry-run

      Do not change any state, just output the actions that would be performed.

      --etcd-upgrade     Default: true

      Perform the upgrade of etcd.

      -h, --help

      help for control-plane

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.6 -

      Upgrade the kubelet configuration for this node

      Synopsis

      Download the kubelet configuration from the kubelet-config ConfigMap stored in the cluster

      kubeadm upgrade node phase kubelet-config [flags]

      Options

      --dry-run

      Do not change any state, just output the actions that would be performed.

      -h, --help

      help for kubelet-config

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      --patches string

      Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.7 -

      Run upgrade node pre-flight checks

      Synopsis

      Run pre-flight checks for kubeadm upgrade node.

      kubeadm upgrade node phase preflight [flags]

      Options

      -h, --help

      help for preflight

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      10.8 -

      Check which versions are available to upgrade to and validate whether your current cluster is upgradeable.

      Synopsis

      Check which versions are available to upgrade to and validate whether your current cluster is upgradeable. This command can only run on the control plane nodes where the kubeconfig file "admin.conf" exists. To skip the internet check, pass in the optional [version] parameter.

      kubeadm upgrade plan [version] [flags]

      Options

      --allow-experimental-upgrades

      Show unstable versions of Kubernetes as an upgrade alternative and allow upgrading to an alpha/beta/release candidate versions of Kubernetes.

      --allow-missing-template-keys     Default: true

      If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

      --allow-release-candidate-upgrades

      Show release candidate versions of Kubernetes as an upgrade alternative and allow upgrading to a release candidate versions of Kubernetes.

      --config string

      Path to a kubeadm configuration file.

      -h, --help

      help for plan

      --ignore-preflight-errors strings

      A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

      --kubeconfig string     Default: "/etc/kubernetes/admin.conf"

      The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

      -o, --output string     Default: "text"

      Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

      --print-config

      Specifies whether the configuration file that will be used in the upgrade should be printed or not.

      --show-managed-fields

      If true, keep the managedFields when printing objects in JSON or YAML format.

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      11 -

      Print the version of kubeadm

      Synopsis

      Print the version of kubeadm

      kubeadm version [flags]

      Options

      -h, --help

      help for version

      -o, --output string

      Output format; available options are 'yaml', 'json' and 'short'

      Options inherited from parent commands

      --rootfs string

      The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

      12 -

      All files in this directory are auto-generated from other repos. Do not edit them manually. You must edit them in their upstream repo.