Command options

-q

Do not show the message of the day or update reminders.

Examples

View the current API endpoint

ibmcloud ks api

Examples

Show help

ibmcloud ks api-key help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View information about the API key owner for a cluster

ibmcloud ks api-key info --cluster CLUSTER

Command options

-f

Force the command to run without user prompts.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target.

Examples

Replace the API key for all clusters in the specified region and targeted resource group

ibmcloud ks api-key reset --region REGION

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Red Hat Advanced Cluster Management add-on

ibmcloud ks cluster addon disable acm --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the ALB OAuth Proxy add-on

ibmcloud ks cluster addon disable alb-oauth-proxy --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Cluster Autoscaler add-on

ibmcloud ks cluster addon disable cluster-autoscaler --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Diagnostics and Debug Tool add-on

ibmcloud ks cluster addon disable debug-tool --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Headlamp add-on

ibmcloud ks cluster addon disable headlamp --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster addon disable help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the HPCS Router Operator add-on for OpenShift

ibmcloud ks cluster addon disable hpcs-router --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the IBM Cloud Storage Operator add-on

ibmcloud ks cluster addon disable ibm-storage-operator --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the managed Istio add-on

ibmcloud ks cluster addon disable istio --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable extra Istio components: Grafana, Jaeger, and Kiali

ibmcloud ks cluster addon disable istio-extras --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Istio BookInfo sample application add-on (deprecated)

ibmcloud ks cluster addon disable istio-sample-bookinfo --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Knative serverless framework add-on

ibmcloud ks cluster addon disable knative --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Kubernetes web terminal add-on

ibmcloud ks cluster addon disable kube-terminal --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Static Route add-on

ibmcloud ks cluster addon disable static-route --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the VPC Block Storage CSI Driver add-on

ibmcloud ks cluster addon disable vpc-block-csi-driver --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--param

Specify installation options for the add-on. If no parameters are specified, the default values are used. Review the available options with the ibmcloud ks cluster addon options command.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Red Hat Advanced Cluster Management add-on

ibmcloud ks cluster addon enable acm --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the ALB OAuth Proxy add-on

ibmcloud ks cluster addon enable alb-oauth-proxy --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Cluster Autoscaler add-on

ibmcloud ks cluster addon enable cluster-autoscaler --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Diagnostics and Debug Tool add-on

ibmcloud ks cluster addon enable debug-tool --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Headlamp add-on

ibmcloud ks cluster addon enable headlamp --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster addon enable help

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the HPCS Router Operator add-on for OpenShift

ibmcloud ks cluster addon enable hpcs-router --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the IBM Cloud Storage Operator add-on

ibmcloud ks cluster addon enable ibm-storage-operator --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the managed Istio add-on

ibmcloud ks cluster addon enable istio --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable extra Istio components: Grafana, Jaeger, and Kiali

ibmcloud ks cluster addon enable istio-extras --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Istio BookInfo sample application add-on on a cluster (deprecated)

ibmcloud ks cluster addon enable istio-sample-bookinfo --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the Static Route add-on

ibmcloud ks cluster addon enable static-route --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Enable the VPC Block Storage CSI Driver add-on

ibmcloud ks cluster addon enable vpc-block-csi-driver --cluster CLUSTER

Command options

--addon

The add-on name or ID.

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View details of an installed add-on

ibmcloud ks cluster addon get --addon ADDON --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster addon help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List enabled add-ons

ibmcloud ks cluster addon ls --cluster CLUSTER

Command options

--addon

The add-on name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--version

Specify an add-on version to display options for. If no version is specified, the default version's options are displayed.

Examples

View installation options for an add-on

ibmcloud ks cluster addon options --addon ADDON

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Red Hat Advanced Cluster Management add-on

ibmcloud ks cluster addon update acm --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the ALB OAuth Proxy add-on

ibmcloud ks cluster addon update alb-oauth-proxy --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Cluster Autoscaler add-on

ibmcloud ks cluster addon update cluster-autoscaler --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Diagnostics and Debug Tool add-on

ibmcloud ks cluster addon update debug-tool --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Headlamp add-on

ibmcloud ks cluster addon update headlamp --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster addon update help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the HPCS Router Operator add-on for OpenShift

ibmcloud ks cluster addon update hpcs-router --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the IBM Cloud Storage Operator add-on

ibmcloud ks cluster addon update ibm-storage-operator --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Image Key Synchronizer add-on

ibmcloud ks cluster addon update image-key-synchronizer --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the managed Istio add-on

ibmcloud ks cluster addon update istio --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update extra Istio components: Grafana, Jaeger, and Kiali

ibmcloud ks cluster addon update istio-extras --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Istio BookInfo sample application add-on (deprecated)

ibmcloud ks cluster addon update istio-sample-bookinfo --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Knative serverless framework add-on

ibmcloud ks cluster addon update knative --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Kubernetes web terminal add-on

ibmcloud ks cluster addon update kube-terminal --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the OpenShift Data Foundation add-on

ibmcloud ks cluster addon update openshift-data-foundation --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the Static Route add-on

ibmcloud ks cluster addon update static-route --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Update the VPC Block Storage CSI Driver add-on

ibmcloud ks cluster addon update vpc-block-csi-driver --cluster CLUSTER

Command options

--addon

Specify an add-on name to filter versions for.

--offering

Specify an offering to filter versions for. Accepted values: kubernetes, openshift, openshift-vs

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-defaults

Show the default version columns in the output.

Examples

List supported versions for managed add-ons

ibmcloud ks cluster addon versions

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Create a CA certificate for your cluster

ibmcloud ks cluster ca create --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of a cluster's CA certificate

ibmcloud ks cluster ca get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster ca help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Rotate the CA certificates of a cluster, which requires that you previously created CA certificates

ibmcloud ks cluster ca rotate --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

View the rotation status of CA certificates for a cluster

ibmcloud ks cluster ca status --cluster CLUSTER

Command options

--admin

Retrieve administrator certificates and PEM keys.

-c, --cluster

Specify the cluster name or ID.

--endpoint

The server URL to use for the cluster context. If you do not include this flag, the default cluster service endpoint is used. For more info, see https://ibm.biz/context-kube for Kubernetes or https://ibm.biz/context-ocp for OpenShift clusters. Accepted values: private, link, vpe

--network

Retrieve the Calico network config with the Admin config.

--output

Prints the command output in the provided format and skips kubeconfig merges. A zip output does not contain a refresh token. Accepted values: json, yaml, zip

-q

Do not show the message of the day or update reminders.

--skip-rbac

Skip adding RBAC roles. Include this option only if you manage your own Kubernetes RBAC roles. If you use IAM service access roles to manage all your RBAC users, do not include this option.

Examples

Download the Kubernetes configuration files and certificates to connect to your cluster by using kubectl commands

ibmcloud ks cluster config --cluster CLUSTER

Command options

--disable-disk-encrypt

Disable encryption on a worker node.

--entitlement

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--hardware

The level of hardware isolation for your worker node. Use dedicated to have available physical resources dedicated to you only, or shared to allow physical resources to be shared with other IBM customers. For IBM Cloud Public accounts, the default value is shared. For IBM Cloud Dedicated accounts, dedicated is the only available option.

--location

Deprecated Flag maintained for compatibility with an earlier version. Use the --zone flag instead.

--name

Enter a name for the cluster.

--no-subnet

Prevent the creation of a portable subnet when creating the cluster. By default, both a public and a private portable subnet are created on the associated VLAN, and this flag prevents that behavior. To add a subnet to the cluster later, run ibmcloud ks cluster subnet add.

--operating-system

Specify the name of the operating system.

--pod-subnet

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-classic

--private-only

Use this flag to prevent a public VLAN from being created. Required only when you specify the --private-vlan flag without specifying the --public-vlan flag.

--private-service-endpoint

Enable the private service endpoint to make the master privately accessible.

--private-vlan

Conditional: Specify the ID of the private VLAN. To see available VLANs, run ibmcloud ks vlan ls --zone <zone name>. If you do not have a private VLAN yet, do not specify this option because one will be automatically created for you. When you specify a private VLAN, you must also specify either the --public-vlan flag or the --private-only flag.

--public-service-endpoint

Enable the public service endpoint to make the master publicly accessible.

--public-vlan

Conditional: Specify the ID of the public VLAN. To see available VLANs, run ibmcloud ks vlan ls --zone <zone name>. If you do not have a public VLAN yet, do not specify this option because one will be automatically created for you.

-q

Do not show the message of the day or update reminders.

--service-subnet

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-classic. Default value: 172.21.0.0/16

--skip-advance-permissions-check

Skip checking for infrastructure permissions before completing this action. Note that if you do not have the correct infrastructure permissions, this action might only partially succeed.

--sm-group

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance

The CRN of the IBM Cloud Secrets Manager instance.

--version

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--workers

The number of cluster worker nodes. Defaults to 1.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on classic infrastructure

ibmcloud ks cluster create classic --flavor FLAVOR --name NAME --zone ZONE --private-only

Examples

Show help

ibmcloud ks cluster create help

Command options

--enable-config-admin

Grant cluster admin access to Satellite Config to manage Kubernetes resources.

--entitlement

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--host-label, --hl

Enter any labels as key-value pairs to identify the host to assign to your Satellite control plane or Red Hat OpenShift cluster. The first host that has this label and is unassigned is automatically assigned to the control plane or cluster. To find available host labels, run ibmcloud sat host get --host <host_name_or_ID> --location <location_name_or_ID>.

--infrastructure-topology

Specify whether the cluster should run a single worker node or the default number of worker nodes. To create a single-node cluster, specify single-replica. To create a default cluster with multiple worker nodes, specify highly-available. The highly-available option is applied by default. Accepted values: single-replica, highly-available

--location

The name or ID of the Satellite location. To find the location ID or name, run ibmcloud sat location ls.

--name

Enter a name for the cluster.

--operating-system

Specify the name of the operating system.

--pod-network-interface-selection

The method for selecting the node network interface for the internal pod network. This option can be used only if the Satellite location that you specify has Red Hat CoreOS enabled. To provide a direct URL or IP address, specify can-reach=<url> or can-reach=<ip_address>. To choose a network interface, specify interface=<network_interface>.

--pod-subnet

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-satellite. Default value: 172.30.0.0/16

--pull-secret

Specify an existing OpenShift entitlement for this cluster's worker nodes by providing your Red Hat account pull secret.

-q

Do not show the message of the day or update reminders.

--service-subnet

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-satellite. Default value: 172.21.0.0/16

--sm-group

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance

The CRN of the IBM Cloud Secrets Manager instance.

--version

The Red Hat OpenShift on IBM Cloud version, including at least the major.minor version. To see available versions, run ibmcloud ks versions.

--workers

The number of worker nodes per zone in the default worker pool. Required when --host-label is specified.

--zone

The zone for the default worker pool in a multizone cluster. To list zones for your location, run ibmcloud sat location get.

Examples

Create an IBM Cloud Satellite cluster on your own infrastructure

ibmcloud ks cluster create satellite --location LOCATION --name NAME --version VERSION

Command options

--disable-public-service-endpoint

Disable the public service endpoint to prevent public access to the master.

--entitlement

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--name

Enter a name for the cluster.

--operating-system

Specify the name of the operating system.

--pod-subnet

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-vpc

-q

Do not show the message of the day or update reminders.

--service-subnet

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-vpc. Default value: 172.21.0.0/16

--sm-group

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance

The CRN of the IBM Cloud Secrets Manager instance.

--subnet-id

The VPC subnet to assign the cluster. To list available subnets, run ibmcloud ks subnets --provider vpc-classic --vpc-id <vpc-id> --zone <vpc-zone>.

--version

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--vpc-id

The ID of the VPC in which to create the worker nodes. To list available IDs, run ibmcloud ks vpcs.

--workers

The number of worker nodes per zone in the default worker pool. For OpenShift clusters, you must set this value to at least 2. For Kubernetes clusters, this value is optional.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on Virtual Private Cloud (VPC) Gen 1 infrastructure

ibmcloud ks cluster create vpc-classic \
  --flavor FLAVOR \
  --name NAME \
  --subnet-id ID \
  --vpc-id ID \
  --zone ZONE

Command options

--cluster-security-group

Optional. Specify one or more security group IDs to apply to all workers on the cluster. For OpenShift version 4.15 and Kubernetes version 1.30 and later, these security groups are applied in addition to the IBM-managed kube-clusterID security group. For earlier cluster versions, specify the --cluster-security-group cluster option to apply the kube-clusterID security group. If no value is specified, a default set of security groups including kube-clusterID are applied.

--cni

Set the network plugin for the cluster. Calico is set by default. Accepted values: Calico, OVNKubernetes

--cos-instance

Required for OpenShift clusters only. The CRN for the standard cloud object storage instance to back up the internal registry in your OpenShift cluster. To list the CRNs of your cloud object storage instances, run ibmcloud resource service-instances --long --service-name cloud-object-storage.

--crk

The ID of the root key in your KMS instance to use for local disk encryption. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance>.

--disable-outbound-traffic-protection

Include this option to allow public outbound access from the cluster workers. By default, public outbound access is blocked in OpenShift versions 4.15 and later and Kubernetes versions 1.30 and later.

--disable-public-service-endpoint

Disable the public service endpoint to prevent public access to the master.

--entitlement

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--kms-account-id

The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--kms-instance

The ID of the KMS instance to use for local disk encryption. To list available KMS instances, run ibmcloud ks kms instance ls.

--name

Enter a name for the cluster.

--offering

Specify the cluster offering. Accepted values: kubernetes, openshift, openshift-vs

--operating-system

Specify the name of the operating system.

--pod-subnet

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-vpc

-q

Do not show the message of the day or update reminders.

--secondary-storage

The secondary storage option for the flavor. To view the secondary storage options that are available for a flavor, run ibmcloud ks flavor get --provider vpc-gen2 --zone <zone name>.

--service-subnet

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-vpc. Default value: 172.21.0.0/16

--sm-group

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance

The CRN of the IBM Cloud Secrets Manager instance.

--subnet-id

The VPC subnet to assign the cluster. To list available subnets, run ibmcloud ks subnets --provider vpc-gen2 --vpc-id <vpc-id> --zone <vpc-zone>.

--version

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--vpc-id

The ID of the VPC in which to create the worker nodes. To list available IDs, run ibmcloud ks vpcs.

--workers

The number of worker nodes per zone in the default worker pool. For OpenShift clusters, you must set this value to at least 2. For Kubernetes clusters, this value is optional.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on Virtual Private Cloud (VPC) Gen 2 infrastructure

ibmcloud ks cluster create vpc-gen2 \
  --flavor FLAVOR \
  --name NAME \
  --subnet-id ID \
  --vpc-id ID \
  --zone ZONE

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-resources

Show additional cluster resources such as add-ons, VLANs, and subnets.

Examples

View the details of a cluster

ibmcloud ks cluster get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster help

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable image security enforcement in your cluster

ibmcloud ks cluster image-security disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable image security enforcement in your cluster

ibmcloud ks cluster image-security enable --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster image-security help

Command options

-l, --location

A location to filter for. To list available locations, run ibmcloud ks locations.

--output

Prints the command output in the provided format. If you do not include the provider flag, only classic clusters are returned. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

Examples

List all clusters in your IBM Cloud account

ibmcloud ks cluster ls

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the audit webhook configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master audit-webhook get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master audit-webhook help

Command options

-c, --cluster

Specify the cluster name or ID.

--ca-cert

The filepath of the CA cert used to verify the remote logging service.

--client-cert

The filepath for the client cert that is used to authenticate against the remote logging service.

--client-key

The filepath for the corresponding client key that is used to connect to the remote logging service.

--policy

Specify the audit policy type. Accepted values: default, verbose

-q

Do not show the message of the day or update reminders.

--remote-server

The URL or IP address for the remote logging service.

Examples

Set the audit webhook configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master audit-webhook set --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Remove the audit webhook configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master audit-webhook unset --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the OpenShift web console and OAuth server access type

ibmcloud ks cluster master console-oauth-access get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master console-oauth-access help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--type

Specify the OpenShift web console and OAuth server access type. Accepted values: vpe-gateway, legacy

Examples

Set the OpenShift web console and OAuth server access type

ibmcloud ks cluster master console-oauth-access set --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the PodSecurity admission configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master pod-security help

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable PodSecurityPolicy for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security policy disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable PodSecurityPolicy for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security policy enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the PodSecurityPolicy configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security policy get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master pod-security policy help

Command options

-c, --cluster

Specify the cluster name or ID.

--config-file

The filepath of a custom PodSecurity configuration. If not specified, the Kubernetes defaults are applied. For more information, see https://ibm.biz/BdPtUB

-q

Do not show the message of the day or update reminders.

Examples

Set and enable the PodSecurity admission configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security set --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Remove the PodSecurity admission configuration for a cluster's Kubernetes API server

ibmcloud ks cluster master pod-security unset --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet

Specify the subnet CIDR.

Examples

Add subnets to a cluster's private service endpoint allowlist

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster CLUSTER --subnet SUBNET

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the allowlist

ibmcloud ks cluster master private-service-endpoint allowlist disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the allowlist

ibmcloud ks cluster master private-service-endpoint allowlist enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Get a cluster's private service endpoint allowlist

ibmcloud ks cluster master private-service-endpoint allowlist get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master private-service-endpoint allowlist help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet

Specify the subnet CIDR.

Examples

Remove subnets from a cluster's private service endpoint allowlist

ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Enable the private service endpoint to make the master privately accessible

ibmcloud ks cluster master private-service-endpoint enable --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master private-service-endpoint help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Disable the public service endpoint to make the master only privately accessible

ibmcloud ks cluster master public-service-endpoint disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Enable the public service endpoint to make the master publicly accessible

ibmcloud ks cluster master public-service-endpoint enable --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master public-service-endpoint help

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Restart the cluster master nodes to apply new Kubernetes API configuration changes

ibmcloud ks cluster master refresh --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet

Specify the subnet CIDR.

Examples

Add subnets to a Satellite cluster's service endpoint allowlist

ibmcloud ks cluster master satellite-service-endpoint allowlist add \
  --cluster CLUSTER \
  --subnet SUBNET

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the allowlist for a Satellite cluster

ibmcloud ks cluster master satellite-service-endpoint allowlist disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the allowlist for a Satellite cluster

ibmcloud ks cluster master satellite-service-endpoint allowlist enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Get a Satellite cluster's service endpoint allowlist

ibmcloud ks cluster master satellite-service-endpoint allowlist get --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster master satellite-service-endpoint allowlist help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet

Specify the subnet CIDR.

Examples

Remove subnets from a Satellite cluster's service endpoint allowlist

ibmcloud ks cluster master satellite-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET

Examples

Show help

ibmcloud ks cluster master satellite-service-endpoint help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--force-update

Attempt the update even if the change is greater than two minor versions from the worker node's current version.

-q

Do not show the message of the day or update reminders.

--version

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

Examples

Update the cluster master to the latest or a specified Kubernetes version

ibmcloud ks cluster master update --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Generate and apply a new image pull secret that stores IAM credentials for the cluster to access images in IBM Cloud Container Registry

ibmcloud ks cluster pull-secret apply --cluster CLUSTER

Examples

Show help

ibmcloud ks cluster pull-secret help

Command options

-c, --cluster

Specify the cluster name or ID.

--delete-openshift-registry-cos-bucket

Remove the COS bucket and the associated service key that holds the OpenShift registry backups on ROKS clusters

--delete-storage

Force the removal of the cluster's persistent storage. Deleted data cannot be recovered.

-f

Force the command to run without user prompts. The cluster's persistent storage is not deleted unless the delete-storage option is also provided. The COS bucket and it's associated service key is not deleted unless the delete-openshift-registry-cos-bucket option is also provided.

-q

Do not show the message of the day or update reminders.

--skip-advance-permissions-check

Skip checking for infrastructure permissions before completing this action. Note that if you do not have the correct infrastructure permissions, this action might only partially succeed.

Examples

Delete a cluster

ibmcloud ks cluster rm --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--key

Specify the name or GUID of an existing service key. If you define a service key, you cannot set the --role option at the same time.

-n, --namespace

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

--role

Specify the IAM role for the service key. This flag does not work if you specify an existing key to use or for services that are not IAM-enabled, such as Cloud Foundry services.

--service

Specify the name of the service instance. To see a list of available service instances, run ibmcloud service list for Cloud Foundry services, or ibmcloud resource service-instances for IAM-enabled services.

Examples

Add an IBM Cloud service to a cluster by binding the service instance to a Kubernetes namespace

ibmcloud ks cluster service bind --cluster CLUSTER --namespace NAMESPACE --service SERVICE --key KEY

Examples

Show help

ibmcloud ks cluster service help

Command options

--all-namespaces

Include all Kubernetes namespaces.

-c, --cluster

Specify the cluster name or ID.

-n, --namespace

The Kubernetes namespace. Will use the default namespace if not specified.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List services bound to a Kubernetes namespace

ibmcloud ks cluster service ls --cluster CLUSTER --all-namespaces

Command options

-c, --cluster

Specify the cluster name or ID.

-n, --namespace

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

--service

Specify the name of the service instance. To see a list of available service instances, run ibmcloud service list for Cloud Foundry services, or ibmcloud resource service-instances for IAM-enabled services.

Examples

Remove an IBM Cloud service from a cluster by unbinding it from a Kubernetes namespace

ibmcloud ks cluster service unbind --cluster CLUSTER --namespace NAMESPACE --service SERVICE

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet-id

Specify the subnet ID.

Examples

Make an existing public or private portable subnet in your IBM Cloud infrastructure account available to a classic cluster

ibmcloud ks cluster subnet add --cluster CLUSTER --subnet-id ID

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--size

Specify the size of the portable subnet. The size must be one of 8, 16, 32, 64.

--vlan

Specify the public or private VLAN ID.

Examples

Create a portable subnet on your public or private VLAN and make it available to a classic cluster

ibmcloud ks cluster subnet create --cluster CLUSTER --size SIZE --vlan VLAN

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet-id

Specify the subnet ID.

Examples

Detach an existing public or private portable subnet from a classic cluster

ibmcloud ks cluster subnet detach --cluster CLUSTER --subnet-id ID

Examples

Show help

ibmcloud ks cluster subnet help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target.

Examples

If you set up your IBM Cloud account to use different credentials to access the IBM Cloud classic infrastructure portfolio, get the infrastructure user name

ibmcloud ks credential get --region REGION

Examples

Show help

ibmcloud ks credential help

Command options

--infrastructure-api-key

The API key of your IBM Cloud classic infrastructure account.

--infrastructure-username

The user name of your IBM Cloud classic infrastructure account.

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target.

Examples

Set credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud account

ibmcloud ks credential set classic \
  --infrastructure-api-key KEY \
  --infrastructure-username USERNAME \
  --region REGION

Examples

Show help

ibmcloud ks credential set help

Command options

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target.

Examples

Remove the credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud account

ibmcloud ks credential unset --region REGION

Examples

Show help

ibmcloud ks experimental help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

The region where the resource-group is located.

--resource-group

The resource-group whose default trusted profile is to be retrieved.

Examples

[Expires on 2026-10-21] Get the default trusted profile for clusters created in a resource-group

ibmcloud ks experimental trusted-profile default get --region REGION --resource-group GROUP

Examples

Show help

ibmcloud ks experimental trusted-profile default help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

The region where the resource group is located.

--resource-group

The resource group ID to set the trusted profile on.

--trusted-profile

The trusted profile ID.

Examples

[Expires on 2026-10-21] Set the default trusted profile for clusters created in a resource-group

ibmcloud ks experimental trusted-profile default set \
  --region REGION \
  --resource-group GROUP \
  --trusted-profile PROFILE

Command options

--cluster

The cluster ID to retrieve the trusted profile for.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

[Expires on 2026-10-21] Get trusted profile for a cluster

ibmcloud ks experimental trusted-profile get --cluster CLUSTER

Examples

Show help

ibmcloud ks experimental trusted-profile help

Command options

--cluster

The cluster ID to set the the trusted profile on.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--trusted-profile

The trusted profile ID.

Examples

[Expires on 2026-10-21] Set trusted profile on a cluster

ibmcloud ks experimental trusted-profile set --cluster CLUSTER --trusted-profile PROFILE

Command options

--flavor

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--output

Prints the command output in the provided format. Accepted values: json

--provider

Specify a provider. Available options are classic, vpc-classic and vpc-gen2.

-q

Do not show the message of the day or update reminders.

--zone

Specify the zone to list available flavors for. To list available zones, run ibmcloud ks zone ls.

Examples

Get the information of a flavor for a zone and provider

ibmcloud ks flavor get --flavor FLAVOR --provider PROVIDER --zone ZONE

Examples

Show help

ibmcloud ks flavor help

Command options

--output

Prints the command output in the provided format. Accepted values: json

--provider

The provider type to get the flavors for. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--show-os

List supported operating systems.

--show-storage

Show additional storage drives.

--zone

Specify the zone to list available flavors for. To list available zones, run ibmcloud ks zone ls.

Examples

List available flavors for a zone

ibmcloud ks flavor ls --zone ZONE

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target. If a region is not already targeted, this argument must be specified. To check if a region is targeted, run ibmcloud target.

Examples

Check whether the credentials that allow access to the IBM Cloud classic infrastructure portfolio for the targeted resource group are missing suggested or required infrastructure permissions

ibmcloud ks infra-permissions get

Examples

Show help

ibmcloud ks infra-permissions help

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

See autoscaling status and configuration for Ingress ALBs

ibmcloud ks ingress alb autoscale get --alb ALB --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress alb autoscale help

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

--cpu-average-utilization

Average CPU utilization threshold. Used to dynamically calculate the number of replicas.

--custom-metrics-file

Path for the custom metric file. See https://ibm.biz/iks-ingress-custom-metrics for more details.

--max-replicas

The maximum replicas for the given ALB. Ensure you have enough workers.

--min-replicas

The minimum replicas for the given ALB. Must be greater or equal to 1. (Recommended minimum is 2 for high availability purposes.)

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Configure autoscaling for Ingress ALBs

ibmcloud ks ingress alb autoscale set \
  --alb ALB \
  --cluster CLUSTER \
  --max-replicas REPLICAS \
  --min-replicas REPLICAS \
  --cpu-average-utilization PERCENT

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Delete the autoscaling configuration for Ingress ALBs

ibmcloud ks ingress alb autoscale unset --alb ALB --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable automatic updates of all Ingress ALB pods in a cluster

ibmcloud ks ingress alb autoupdate disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable automatic updates of all Ingress ALB pods in a cluster

ibmcloud ks ingress alb autoupdate enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View whether the Ingress ALB pods in a cluster are set to automatically update and whether ALB pods are at the latest version

ibmcloud ks ingress alb autoupdate get --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress alb autoupdate help

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

Specify a portable public or private IP address that is available on the vlan and in the zone of the ALB to be created or enabled.

-q

Do not show the message of the day or update reminders.

--type

Specify the type of ALB. Available options: public, private

--version

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

--vlan

The VLAN ID. This VLAN must match the ALB type and must be in the same zone as the ALB that you want to create.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create and enable an Ingress ALB in a classic cluster

ibmcloud ks ingress alb create classic --cluster CLUSTER --type TYPE --vlan VLAN --zone ZONE

Examples

Show help

ibmcloud ks ingress alb create help

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--type

Specify the type of ALB. Available options: public, private

--version

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create and enable an Ingress ALB in a VPC Gen 2 cluster

ibmcloud ks ingress alb create vpc-gen2 --cluster CLUSTER --type TYPE --zone ZONE

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable an Ingress ALB in a cluster

ibmcloud ks ingress alb disable --alb ALB --cluster CLUSTER

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

--ip

Specify a portable public or private IP address that is available on the vlan and in the zone of the ALB to be created or enabled.

-q

Do not show the message of the day or update reminders.

--version

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Enable an Ingress ALB in a classic cluster

ibmcloud ks ingress alb enable classic --alb ALB --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress alb enable help

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Enable an Ingress ALB in a VPC Gen 2 cluster

ibmcloud ks ingress alb enable vpc-gen2 --alb ALB --cluster CLUSTER

Command options

--alb

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress ALB in a cluster

ibmcloud ks ingress alb get --alb ALB --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Ingress health checker

ibmcloud ks ingress alb health-checker disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable the Ingress health checker

ibmcloud ks ingress alb health-checker enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View status of the Ingress health checker

ibmcloud ks ingress alb health-checker get --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress alb health-checker help

Examples

Show help

ibmcloud ks ingress alb help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List all Ingress ALB IDs in a cluster and whether ALB pods are at the latest version

ibmcloud ks ingress alb ls --cluster CLUSTER

Command options

--alb

To update a specific ALB, specify the ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls. To update more than one ALB, specify one ALB ID in each flag, such as --alb ID_1 --alb ID_2. To update all ALBs, do not include this flag.

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--version

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Force a one-time update of the pods for individual or all ALBs in the cluster

ibmcloud ks ingress alb update --cluster CLUSTER

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target.

Examples

List Ingress ALB image versions that are available

ibmcloud ks ingress alb versions

Command options

-c, --cluster

Specify the cluster name or ID.

--crn

The CRN for the IBM CIS instance.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--domain-provider

The DNS provider. The default DNS provider is our internal one. For supported providers see our documentation: https://ibm.biz/containers-ingress-domains

--domain-zone

The ZoneID for CIS.

--hostname

For VPC clusters. The hostname to register for the domain.

--ip

The IP addresses to register for the domain.

--is-default

Include this option to set the relevant domain as the default domain for cluster.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace

The namespace that the TLS secret is created in.

Examples

Create an Ingress domain for a cluster

ibmcloud ks ingress domain create --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress domain default help

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-q

Do not show the message of the day or update reminders.

Examples

Change a cluster's default Ingress domain

ibmcloud ks ingress domain default replace --cluster CLUSTER --domain DOMAIN

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress domain

ibmcloud ks ingress domain get --cluster CLUSTER --domain DOMAIN

Examples

Show help

ibmcloud ks ingress domain help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List all Ingress domains for a cluster

ibmcloud ks ingress domain ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Remove an Ingress domain from a cluster

ibmcloud ks ingress domain rm --cluster CLUSTER --domain DOMAIN

Examples

Show help

ibmcloud ks ingress domain secret help

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Regenerate the certificate for an Ingress domain

ibmcloud ks ingress domain secret regenerate --cluster CLUSTER --domain DOMAIN

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-f

Force the command to run without user prompts.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Delete a secret for an Ingress domain and prevent future renewal of the certificate

ibmcloud ks ingress domain secret rm --cluster CLUSTER --domain DOMAIN

Command options

-c, --cluster

Specify the cluster name or ID.

--domain

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--hostname

For VPC clusters. The hostname to register for the domain.

--ip

The IP addresses to register for the domain.

-q

Do not show the message of the day or update reminders.

Examples

Update an Ingress domain for a cluster

ibmcloud ks ingress domain update --cluster CLUSTER --domain DOMAIN

Examples

Show help

ibmcloud ks ingress help

Examples

Show help

ibmcloud ks ingress instance default help

Command options

-c, --cluster

Specify the cluster name or ID.

--name

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

--secret-group

Secret Group ID of the IBM Cloud Secret Manager instance where the secrets are persisted.

Examples

Set a registered IBM Cloud Secrets Manager instance as the default

ibmcloud ks ingress instance default set --cluster CLUSTER --name NAME

Command options

-c, --cluster

Specify the cluster name or ID.

--name

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

Examples

Unset a registered IBM Cloud Secrets Manager instance from default

ibmcloud ks ingress instance default unset --cluster CLUSTER --name NAME

Command options

-c, --cluster

Specify the cluster name or ID.

--name

The name of the registered IBM Cloud Secret Manager instance.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View details of an IBM Cloud Secrets Manager instance registered to a cluster

ibmcloud ks ingress instance get --cluster CLUSTER --name NAME

Examples

Show help

ibmcloud ks ingress instance help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-deleted

Show IBM Cloud Secret Manager instances that were unregistered from the cluster.

Examples

List IBM Cloud Secrets Manager instances registered to a cluster

ibmcloud ks ingress instance ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--crn

CRN of the IBM Cloud Secret Manager instance.

--is-default

Set the IBM Cloud Secrets Manager instance as the default. If an existing default instance exists, it is unset.

-q

Do not show the message of the day or update reminders.

--secret-group

Secret Group ID of the IBM Cloud Secret Manager instance where the secrets are persisted.

Examples

Register an IBM Cloud Secrets Manager instance to a cluster

ibmcloud ks ingress instance register --cluster CLUSTER --crn CRN

Command options

-c, --cluster

Specify the cluster name or ID.

--name

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

Examples

Unregister an IBM Cloud Secrets Manager instance from a cluster

ibmcloud ks ingress instance unregister --cluster CLUSTER --name NAME

Examples

Show help

ibmcloud ks ingress load-balancer backend help

Command options

-c, --cluster

Specify the cluster name or ID.

--private-backend

Backend for private load balancer

--public-backend

Backend for public load balancer

-q

Do not show the message of the day or update reminders.

Examples

Set the private and/or public backend for the VPC ALB load balancer that exposes the Ingress controller for a cluster

ibmcloud ks ingress load-balancer backend set --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the configuration of load balancers that expose Ingress ALBs in your cluster

ibmcloud ks ingress load-balancer get --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress load-balancer help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the PROXY protocol on Ingress ALBs

ibmcloud ks ingress load-balancer proxy-protocol disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--cidr

The IP address ranges of your load balancers in CIDR format. PROXY headers that are forwarded by load balancers in other IP ranges are not processed.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the PROXY protocol so that client connection information is passed in request headers to ALBs

ibmcloud ks ingress load-balancer proxy-protocol enable --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress load-balancer proxy-protocol help

Command options

-c, --cluster

Specify the cluster name or ID.

--cert-crn

The certificate CRN.

--field

The secret CRN to include as a field. To pull in the secret without specifying the name, use --field <crn>. To specify the field name, use --field name=<crn>. To use the IBM Cloud Secrets Manager secret as the prefix, use --field prefix=<crn>.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

--persist

Persist the secret in the cluster so that it cannot be deleted.

-q

Do not show the message of the day or update reminders.

--type

The Ingress secret type. Can be TLS or Opaque. If no option is specified, TLS is applied by default.

Examples

Create an Ingress secret in a cluster for a secret stored in IBM Cloud Secret Manager

ibmcloud ks ingress secret create --cluster CLUSTER --name NAME

Command options

-c, --cluster

Specify the cluster name or ID.

--field

The secret CRN to include as a field. To pull in the secret without specifying the name, use --field <crn>. To specify the field name, use --field name=<crn>. To use the IBM Cloud Secrets Manager secret as the prefix, use --field prefix=<crn>.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

-q

Do not show the message of the day or update reminders.

Examples

Add fields to an existing Ingress secret

ibmcloud ks ingress secret field add --cluster CLUSTER --name NAME --namespace NAMESPACE

Examples

Show help

ibmcloud ks ingress secret field help

Command options

-c, --cluster

Specify the cluster name or ID.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-crn

Show CRN value of secret.

Examples

View the fields of an Ingress secret

ibmcloud ks ingress secret field ls --cluster CLUSTER --name NAME --namespace NAMESPACE

Command options

-c, --cluster

Specify the cluster name or ID.

--field-name

The name of the field to remove from the secret.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

-q

Do not show the message of the day or update reminders.

Examples

Remove fields from an existing Ingress secret

ibmcloud ks ingress secret field rm --cluster CLUSTER --name NAME --namespace NAMESPACE

Command options

-c, --cluster

Specify the cluster name or ID.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress secret

ibmcloud ks ingress secret get --cluster CLUSTER --name NAME --namespace NAMESPACE

Examples

Show help

ibmcloud ks ingress secret help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-crn

Show CRN value of secret.

--show-deleted

Show secrets that were deleted from the cluster.

Examples

List all Ingress secrets in a cluster

ibmcloud ks ingress secret ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

-q

Do not show the message of the day or update reminders.

Examples

Remove an Ingress secret from a cluster

ibmcloud ks ingress secret rm --cluster CLUSTER --name NAME --namespace NAMESPACE

Command options

-c, --cluster

Specify the cluster name or ID.

--cert-crn

The certificate CRN.

-n, --namespace

Specify the Kubernetes namespace.

--name

A name for the Ingress secret that is created in the cluster.

-q

Do not show the message of the day or update reminders.

Examples

Update an existing Ingress secret

ibmcloud ks ingress secret update --cluster CLUSTER --name NAME --namespace NAMESPACE

Examples

Show help

ibmcloud ks ingress security help

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the usage of port 80 in your cluster

ibmcloud ks ingress security port80 disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the usage of port 80 in your cluster

ibmcloud ks ingress security port80 enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the security configuration of port 80 in your cluster

ibmcloud ks ingress security port80 get --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress security port80 help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Disable status reporting for Ingress components in a cluster

ibmcloud ks ingress status-report disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Enable status reporting for Ingress components in a cluster

ibmcloud ks ingress status-report enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the status report for Ingress components in a cluster

ibmcloud ks ingress status-report get --cluster CLUSTER

Examples

Show help

ibmcloud ks ingress status-report help

Command options

-c, --cluster

Specify the cluster name or ID.

--code

Code of the warning to be ignored.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Suppress warnings from Ingress status reports for a cluster

ibmcloud ks ingress status-report ignored-errors add --cluster CLUSTER --code CODE

Examples

Show help

ibmcloud ks ingress status-report ignored-errors help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List warnings that are currently ignored by Ingress status for a cluster

ibmcloud ks ingress status-report ignored-errors ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--code

Code of the warning to be removed.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove warnings that are currently ignored by Ingress status for a cluster

ibmcloud ks ingress status-report ignored-errors rm --cluster CLUSTER --code CODE

Examples

Show help

ibmcloud ks kms crk help

Command options

--instance-id

KMS instance ID. To see available KMS instances, run ibmcloud ks kms instance ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List available root keys for a Key Management Service instance

ibmcloud ks kms crk ls --instance-id ID

Command options

-c, --cluster

Specify the cluster name or ID.

--crk

A root key ID in your KMS instance. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance>.

--instance-id

KMS instance ID. To see available KMS instances, run ibmcloud ks kms instance ls.

--kms-account-id

The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--public-endpoint

Specify this option to use the KMS public service endpoint. Otherwise the KMS private service endpoint is used.

-q

Do not show the message of the day or update reminders.

Examples

Enable a key management service (KMS) in your cluster to encrypt your secrets

ibmcloud ks kms enable --cluster CLUSTER --crk CRK --instance-id ID

Examples

Show help

ibmcloud ks kms help

Examples

Show help

ibmcloud ks kms instance help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List available Key Management Service instances

ibmcloud ks kms instance ls

Command options

--output

Prints the command output in the provided format. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--show-flavors

Show the available worker node flavors in the zone for VPC.

Examples

List supported IBM Cloud Kubernetes Service locations

ibmcloud ks locations

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable automatic updates of all Fluentd pods in a cluster

ibmcloud ks logging autoupdate disable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable automatic updates of all Fluentd pods in a cluster

ibmcloud ks logging autoupdate enable --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View whether your Fluentd pods are set to automatically update in a cluster

ibmcloud ks logging autoupdate get --cluster CLUSTER

Examples

Show help

ibmcloud ks logging autoupdate help

Command options

-C, --app-container

Specify the containers that you want to collect logs for. To specify more than one path, use multiple flags, such as -C container1 -C container2. This option is required for the application log source. If not provided, logs are collected from all containers from the application log paths passed in.

-c, --cluster

Specify the cluster name or ID.

--ca-cert

When the logging type is syslog and the protocol is tls, the Kubernetes secret name that contains the Certificate Authority certificate.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--hostname

When logging type is syslog, the hostname or IP address of the log collector. When logging type is ibm (deprecated), the logging ingest endpoint. If you do not provide the logging ingest endpoint, then the current region's endpoint is used.

--logsource

The source of the logs to forward. Supported values are container, application, ingress, worker, storage, and kubernetes. This argument supports a comma separated list of log sources. If you do not provide a log source, logs for container and ingress are forwarded.

-n, --namespace

The namespace you want to apply the log forwarding configuration to. Only use this flag with the container log source or if you do not specify a log source. If you do not specify a namespace, then all namespaces use this configuration.

--org

Deprecated The org name to send logs to. This flag is only valid when the logging type is ibm. The org name is required when you specify a space name. If you do not specify a space name, then logs are forwarded at the account level.

--output

Prints the command output in the provided format. Accepted values: json

-p, --app-path

Specify the absolute file path to collect logs from inside the container. To specify more than one path, use multiple flags, such as -p path1 -p path2. Required parameter when specifying application for the log source. Wildcards such as /var/log/*.log are accepted but recursive globs such are /var/log/**/test.log are not.

--port

The port of the log collector. If you do not specify a port, the default port for the ingestion endpoint is used for ibm (deprecated) and 514 is used for syslog.

-q

Do not show the message of the day or update reminders.

--skip-validation

Skips validation of the org and space names when they are specified. This can result in a broken logging config if the values are invalid but will take less time to process.

--space

Deprecated The space name to send logs to. This flag is only valid when the logging type is ibm. The space name is required when you specify an org name. If you do not specify a space name, then logs are forwarded at the account level.

--syslog-protocol

When the logging type is syslog, the transport layer protocol. Supported values are tls, tcp and the default udp. When forwarding to an rsyslog server with the UDP protocol, logs that are over 1KB are truncated.

--type

The log forwarding protocol that you want to use. The only supported value is syslog.

--verify-mode

When the logging type is syslog and the protocol is tls, the verification mode. Supported values are verify-peer and the default verify-none.

Examples

Create a logging configuration

ibmcloud ks logging config create \
  --cluster CLUSTER \
  --logsource LOGSOURCE \
  --type TYPE \
  --ca-cert CERT \
  --syslog-protocol PROTOCOL \
  --verify-mode MODE \
  --namespace NAMESPACE

Command options

-c, --cluster

Specify the cluster name or ID.

--logsource

The kind of log source you want to filter for. Accepted values are container, application, ingress, worker, storage and kubernetes. If you do not pass a log source, all logging configurations for the cluster are returned.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View log forwarding configurations for a cluster

ibmcloud ks logging config get --cluster CLUSTER

Examples

Show help

ibmcloud ks logging config help

Command options

--all

Remove all log forwarding configurations.

-c, --cluster

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id

Specify the ID of the logging configuration.

-n, --namespace

The namespace you want to remove the log forwarding configuration from. If there is more than one config for the same namespace, use the --id <logging configuration ID> flag instead.

-q

Do not show the message of the day or update reminders.

Examples

Delete a log forwarding configuration from a cluster

ibmcloud ks logging config rm --cluster CLUSTER --all

Command options

-C, --app-container

Specify the containers that you want to collect logs for. To specify more than one path, use multiple flags, such as -C container1 -C container2. This option is required for the application log source. If not provided, logs are collected from all containers from the application log paths passed in.

-c, --cluster

Specify the cluster name or ID.

--ca-cert

When the logging type is syslog and the protocol is tls, the Kubernetes secret name that contains the Certificate Authority certificate.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--hostname

When logging type is syslog, the hostname or IP address of the log collector. When logging type is ibm (deprecated), the logging ingest endpoint. If you do not provide the logging ingest endpoint, then the current region's endpoint is used.

--id

Specify the ID of the logging configuration.

--logsource

The source of the logs to forward. Supported values are container, application, ingress, worker, storage, and kubernetes. This argument supports a comma separated list of log sources. If you do not provide a log source, logs for container and ingress are forwarded.

-n, --namespace

The namespace you want to apply the log forwarding configuration to. Only use this flag with the container log source or if you do not specify a log source. If you do not specify a namespace, then all namespaces use this configuration.

--org

Deprecated The org name to send logs to. This flag is only valid when the logging type is ibm. The org name is required when you specify a space name. If you do not specify a space name, then logs are forwarded at the account level.

--output

Prints the command output in the provided format. Accepted values: json

-p, --app-path

Specify the absolute file path to collect logs from inside the container. To specify more than one path, use multiple flags, such as -p path1 -p path2. Required parameter when specifying application for the log source. Wildcards such as /var/log/*.log are accepted but recursive globs such are /var/log/**/test.log are not.

--port

The port of the log collector. If you do not specify a port, the default port for the ingestion endpoint is used for ibm (deprecated) and 514 is used for syslog.

-q

Do not show the message of the day or update reminders.

--skip-validation

Skips validation of the org and space names when they are specified. This can result in a broken logging config if the values are invalid but will take less time to process.

--space

Deprecated The space name to send logs to. This flag is only valid when the logging type is ibm. The space name is required when you specify an org name. If you do not specify a space name, then logs are forwarded at the account level.

--syslog-protocol

When the logging type is syslog, the transport layer protocol. Supported values are tls, tcp and the default udp. When forwarding to an rsyslog server with the UDP protocol, logs that are over 1KB are truncated.

--type

The log forwarding protocol that you want to use. The only supported value is syslog.

--verify-mode

When the logging type is syslog and the protocol is tls, the verification mode. Supported values are verify-peer and the default verify-none.

Examples

Update a log forwarding configuration for a cluster

ibmcloud ks logging config update \
  --cluster CLUSTER \
  --id ID \
  --logsource LOGSOURCE \
  --type TYPE \
  --ca-cert CERT \
  --syslog-protocol PROTOCOL \
  --verify-mode MODE \
  --namespace NAMESPACE

Command options

-c, --cluster

Specify the cluster name or ID.

--container

The name of the container from which you want to filter out logs. This flag applies only when you are using log type container.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--lc, --logging-config

A logging configuration ID. If not provided, the filter is applied to all the cluster logging configurations that are passed to the filter. You can view log configurations that match the filter by using the --show-matching-configs flag with the command.

--level

Filters out logs that are at the specified level and less. Acceptable values in their canonical order are fatal, error, warn/warning, info, debug, and trace. As an example, if you filtered logs at the info level, debug, and trace are also filtered. Note: You can use this flag only when log messages are in JSON format and contain a level field. Example output: {"log": "hello", "level": "info"}

--message

Filters out any logs that contain a specified message anywhere in the log. The message is matched literally and not as an expression. Example: The messages "Hello", "!", and "Hello, World!", would apply to the log "Hello, World!".

-n, --namespace

The Kubernetes namespace from which you want to filter logs.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--regex-message

Filters out any logs that contain a specified message regex pattern in the log. The message is matched as a regular expression. Example: The pattern "hello [0-9]" would apply to "hello 1", "hello 2", "hello 9"

--type

The type of logs that you want to apply the filter to. Currently all, container, and host are supported.

Examples

Create a filter to exclude log lines from forwarding

ibmcloud ks logging filter create --cluster CLUSTER --message MESSAGE

Command options

-c, --cluster

Specify the cluster name or ID.

--id

Specify the ID of the logging filter.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-covering-filters

Show the logging filters that render previous filters obsolete.

--show-matching-configs

Show the logging configurations that match the configuration that you're viewing.

Examples

View a logging filter configuration

ibmcloud ks logging filter get --cluster CLUSTER

Examples

Show help

ibmcloud ks logging filter help

Command options

--all

Delete all log forwarding filters.

-c, --cluster

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id

Specify the ID of the logging filter.

-q

Do not show the message of the day or update reminders.

Examples

Delete a logging filter

ibmcloud ks logging filter rm --cluster CLUSTER --all

Command options

-c, --cluster

Specify the cluster name or ID.

--container

The name of the container from which you want to filter out logs. This flag applies only when you are using log type container.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id

Specify the ID of the logging filter.

--lc, --logging-config

A logging configuration ID. If not provided, the filter is applied to all the cluster logging configurations that are passed to the filter. You can view log configurations that match the filter by using the --show-matching-configs flag with the command.

--level

Filters out logs that are at the specified level and less. Acceptable values in their canonical order are fatal, error, warn/warning, info, debug, and trace. As an example, if you filtered logs at the info level, debug, and trace are also filtered. Note: You can use this flag only when log messages are in JSON format and contain a level field. Example output: {"log": "hello", "level": "info"}

--message

Filters out any logs that contain a specified message anywhere in the log. The message is matched literally and not as an expression. Example: The messages "Hello", "!", and "Hello, World!", would apply to the log "Hello, World!".

-n, --namespace

The Kubernetes namespace from which you want to filter logs.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--regex-message

Filters out any logs that contain a specified message regex pattern in the log. The message is matched as a regular expression. Example: The pattern "hello [0-9]" would apply to "hello 1", "hello 2", "hello 9"

--type

The type of logs that you want to apply the filter to. Currently all, container, and host are supported.

Examples

Update a logging filter

ibmcloud ks logging filter update --cluster CLUSTER --id ID --message MESSAGE

Examples

Show help

ibmcloud ks logging help

Command options

-c, --cluster

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

-q

Do not show the message of the day or update reminders.

Examples

Refresh the logging configuration for a cluster

ibmcloud ks logging refresh --cluster CLUSTER

Command options

-q

Do not show the message of the day or update reminders.

Examples

View the current user messages

ibmcloud ks messages

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Add an NLB IP to an existing host name that you created with ibmcloud ks nlb-dns create

ibmcloud ks nlb-dns add --cluster CLUSTER --ip IP --nlb-host HOST

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace

The namespace that the SSL secret is created in. If this flag is not specified, the secret is created in default.

Examples

Create a DNS host name to register one or more NLB IPs in a classic cluster

ibmcloud ks nlb-dns create classic --cluster CLUSTER --ip IP

Examples

Show help

ibmcloud ks nlb-dns create help

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--lb-host

The VPC load balancer host name. To see load balancer host names, run kubectl get svc -n <namespace>.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace

The namespace that the SSL secret is created in. If this flag is not specified, the secret is created in default.

Examples

Create a DNS record to register a load balancer host name or load balancer IP addresses in a VPC cluster

ibmcloud ks nlb-dns create vpc-gen2 --cluster CLUSTER --ip IP

Command options

-c, --cluster

Specify the cluster name or ID.

--nlb-subdomain

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of a registered NLB host name in a cluster

ibmcloud ks nlb-dns get --cluster CLUSTER --nlb-subdomain SUBDOMAIN

Examples

Show help

ibmcloud ks nlb-dns help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List the registered NLB host names and IP addresses in a cluster

ibmcloud ks nlb-dns ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--enable

Enable the health check monitor for the host name.

--header

HTTP request headers for the health check are limited to the Host header. This flag is valid only for type HTTP or HTTPS. This flag accepts values in the following format: --header Header-Name=value. When updating a monitor, the existing headers are replaced by the ones you specify. To delete all existing headers specify the flag with an empty value --header "".

--interval

The interval, in seconds, between each health check. Short intervals might improve failover time but increase load on the IPs. Must be in the range [60, 300]. Default: 60

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

--path

The endpoint path to health check against. This flag is valid only for type HTTP or HTTPS. Default: /

--port

The port number to connect to for the health check. When type is TCP, this flag is required. When type is HTTP or HTTPS, use this flag only for ports other than 80 for HTTP or 443 for HTTPS. HTTP default: 80. HTTPS default: 443.

-q

Do not show the message of the day or update reminders.

--timeout

The timeout, in seconds, before the IP is considered unhealthy. Must be in the range [1, 60]. Default: 5

--type

The protocol to use for the health check. Accepted values: http, https, tcp

Examples

Configure a health check monitor for an existing NLB host name in a cluster

ibmcloud ks nlb-dns monitor configure --cluster CLUSTER --nlb-host HOST

Command options

-c, --cluster

Specify the cluster name or ID.

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Disable an existing health check monitor for a NLB host name in a cluster

ibmcloud ks nlb-dns monitor disable --cluster CLUSTER --nlb-host HOST

Command options

-c, --cluster

Specify the cluster name or ID.

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Enable a health check monitor for an NLB host name in a cluster

ibmcloud ks nlb-dns monitor enable --cluster CLUSTER --nlb-host HOST

Command options

-c, --cluster

Specify the cluster name or ID.

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the settings for an existing health check monitor

ibmcloud ks nlb-dns monitor get --cluster CLUSTER --nlb-host HOST

Examples

Show help

ibmcloud ks nlb-dns monitor help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List the health check monitor settings for each NLB host name in a cluster

ibmcloud ks nlb-dns monitor ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

--lb-host

The VPC load balancer host name. To see load balancer host names, run kubectl get svc -n <namespace>.

--nlb-subdomain

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Update an existing DNS host name by replacing the load balancer hostname associated with it in a VPC cluster

ibmcloud ks nlb-dns replace --cluster CLUSTER --lb-host HOST --nlb-subdomain SUBDOMAIN

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

One NLB IP address. To see NLB IPs associated with the host name, run ibmcloud ks nlb-dns ls.

--nlb-host

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove an NLB IP address from an NLB host name

ibmcloud ks nlb-dns rm classic --cluster CLUSTER --ip IP --nlb-host HOST

Examples

Show help

ibmcloud ks nlb-dns rm help

Command options

-c, --cluster

Specify the cluster name or ID.

--ip

One NLB IP address. To see NLB IPs associated with the host name, run ibmcloud ks nlb-dns ls.

--nlb-subdomain

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove a load balancer host name or IP address from a DNS record in a VPC cluster

ibmcloud ks nlb-dns rm vpc-gen2 --cluster CLUSTER --nlb-subdomain SUBDOMAIN

Examples

Show help

ibmcloud ks nlb-dns secret help

Command options

-c, --cluster

Specify the cluster name or ID.

--nlb-subdomain

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Regenerate the certificate and secret for an NLB subdomain

ibmcloud ks nlb-dns secret regenerate --cluster CLUSTER --nlb-subdomain SUBDOMAIN

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--nlb-subdomain

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Delete a secret from an NLB subdomain and prevent future renewal of the certificate

ibmcloud ks nlb-dns secret rm --cluster CLUSTER --nlb-subdomain SUBDOMAIN

Examples

Show help

ibmcloud ks quota help

Command options

--output

Prints the command output in the provided format. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

Examples

List all quota and limits for cluster-related resources in your IBM Cloud account

ibmcloud ks quota ls

Examples

Show help

ibmcloud ks script help

Command options

--in-place

Rewrite the source file with the updated command structure.

-q

Do not show the message of the day or update reminders.

Examples

Rewrite scripts that call IBM Cloud Kubernetes Service plug-in commands

ibmcloud ks script update FILE

Examples

Show help

ibmcloud ks security-group help

Command options

--attached-to

Filter the security groups by the components they are attached to. Accepted values: cluster, load-balancer, vpc, vpe-gateway, worker-pool

-c, --cluster

Specify the cluster name or ID.

--managed-by

Specify user to return the security groups created by user. Specify ibm to return only the security groups managed by IBM. Accepted values: ibm, user

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--scope

Specify cluster to return security groups scoped to the cluster. Specify vpc to return security groups scoped to the entire VPC. Accepted values: cluster, vpc

Examples

List all security groups associated with a cluster

ibmcloud ks security-group ls --cluster CLUSTER

Command options

-c, --cluster

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--security-group, --sg

Specify security group ID.

Examples

Deletes all existing security group rules, and reapplies default rules

ibmcloud ks security-group reset --cluster CLUSTER --security-group GROUP

Command options

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--security-group, --sg

Specify security group ID.

Examples

Reapplies default security group rules that do not exist

ibmcloud ks security-group sync --cluster CLUSTER --security-group GROUP

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--volume

Specify the volume ID. To list available volumes, run ibmcloud ks storage volume ls.

-w, --worker

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Attach a storage volume to a worker node

ibmcloud ks storage attachment create --cluster CLUSTER --volume VOLUME --worker WORKER_ID

Command options

--attachment

Specify the volume attachment ID. To list available attachments, run ibmcloud ks storage attachment ls.

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

-w, --worker

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Get the details of a volume attachment in a cluster

ibmcloud ks storage attachment get --attachment ATTACHMENT --cluster CLUSTER --worker WORKER_ID

Examples

Show help

ibmcloud ks storage attachment help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

-w, --worker

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

List all storage volume attachments of a worker in a cluster

ibmcloud ks storage attachment ls --cluster CLUSTER --worker WORKER_ID

Command options

--attachment

Specify the volume attachment ID. To list available attachments, run ibmcloud ks storage attachment ls.

-c, --cluster

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

-w, --worker

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Delete a volume attachment from a worker node

ibmcloud ks storage attachment rm --attachment ATTACHMENT --cluster CLUSTER --worker WORKER_ID

Examples

Show help

ibmcloud ks storage help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--volume

Specify the volume ID. To list available volumes, run ibmcloud ks storage volume ls.

Examples

Get the details of a volume

ibmcloud ks storage volume get --volume VOLUME

Examples

Show help

ibmcloud ks storage volume help

Command options

-c, --cluster

Specify the cluster name or ID.

--output

Prints the command output in the provided format. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--zone

A zone to filter for. To list available zones, run ibmcloud ks locations.

Examples

List the details of volumes

ibmcloud ks storage volume ls

Command options

-l, --location

A location to filter for. To list available locations, run ibmcloud ks locations.

--output

Prints the command output in the provided format. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Available options: classic, vpc-classic, vpc-gen2

-q

Do not show the message of the day or update reminders.

--vpc-id

Required for provider types vpc-classic and vpc-gen2: The ID of the VPC to list subnets for. To list VPC IDs, run ibmcloud ks vpcs.

--zone

Required for provider types vpc-classic and vpc-gen2: The zone to list VPC subnets for. To list available zones, run ibmcloud ks zone ls --provider vpc-classic|vpc-gen2.

Examples

List available portable subnets in your IBM Cloud infrastructure account

ibmcloud ks subnets --provider PROVIDER

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-version

Show only the versions for the specified container platform. Accepted values: OpenShift, Kubernetes

Examples

List all the container platform versions that are available for IBM Cloud Kubernetes Service clusters

ibmcloud ks versions

Examples

Show help

ibmcloud ks vlan help

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--zone

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

List available public and private VLANs for a zone

ibmcloud ks vlan ls --zone ZONE

Command options

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region

Specify the region to target. If a region is not already targeted, this argument must be specified. To check if a region is targeted, run ibmcloud target.

Examples

View the VLAN spanning status for your IBM Cloud classic infrastructure account

ibmcloud ks vlan spanning get

Examples

Show help

ibmcloud ks vlan spanning help

Command options

--auto-delete

Automatically delete the VNI when it is removed from the cluster.

-c, --cluster-id

The ID of the cluster.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vlan

The VLAN ID for the bare metal node attachment. Must be unique for each VPC subnet. Multiple VNIs from the same subnet can reuse the VLAN ID. Valid range: 1-500.

--vni

The ID of the Virtual Network Interface to attach. You must specify VNIs without any current target resource. To list all the VNIs, run ibmcloud is vnis. To check if a specific VNI is already attached to a resource, check for the "Target" field in 'ibmcloud is vni <VNI_ID>.

-w, --worker

The ID of the worker node.

Examples

Attach a Virtual Network Interface to a bare metal worker node or cluster

ibmcloud ks vni attach baremetal --vlan VLAN --vni VNI --cluster-id CLUSTER_NAME_OR_ID

Examples

Show help

ibmcloud ks vni attach help

Command options

-c, --cluster-id

The ID of the cluster.

-f

Force the command to run without user prompts.

--output

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vni

The ID of the Virtual Network Interface to detach.

-w, --worker

The ID of the worker node.

Examples

Detach a Virtual Network Interface from a worker node or cluster

ibmcloud ks vni detach --vni VNI --cluster-id CLUSTER_NAME_OR_ID

Examples

Show help