Command options

-q

Do not show the message of the day or update reminders.

Examples

View or set the API endpoint and API version for the service.

ibmcloud ks api \
  --endpoint ENDPOINT \
  --insecure INSECURE \
  --skip-ssl-validation IP_ADDRESS

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View information about the API key owner for a cluster.

ibmcloud ks api-key info --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

-f

Force the command to run without user prompts.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target.

Examples

Replace the API key for all clusters in the specified region and targeted resource group.

ibmcloud ks api-key reset --output json --region REGION -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The Red Hat Advanced Cluster Management add-on.

ibmcloud ks cluster addon disable acm --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Kubernetes Service Cluster Autoscaler.

ibmcloud ks cluster addon disable cluster-autoscaler --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Kubernetes Service Diagnostics and Debug Tool.

ibmcloud ks cluster addon disable debug-tool --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud HPCS Router Operator add-on for Red Hat OpenShift on IBM Cloud.

ibmcloud ks cluster addon disable hpcs-router --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Storage operator add-on.

ibmcloud ks cluster addon disable ibm-storage-operator \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Image Key Synchronizer add-on.

ibmcloud ks cluster addon disable image-key-synchronizer \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The Knative serverless framework.

ibmcloud ks cluster addon disable knative --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Kubernetes Service web terminal.

ibmcloud ks cluster addon disable kube-terminal --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The Red Hat OpenShift Data Foundation on IBM Cloud add-on.

ibmcloud ks cluster addon disable openshift-data-foundation \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud Kubernetes Service static route add-on.

ibmcloud ks cluster addon disable static-route --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

The IBM Cloud VPC Block Storage CSI Driver.

ibmcloud ks cluster addon disable vpc-block-csi-driver \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--param PARAM

Specify installation options for the add-on. If no parameters are specified, the default values are used. Review the available options with the ibmcloud ks cluster addon options command.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The Red Hat Advanced Cluster Management add-on.

ibmcloud ks cluster addon enable acm \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service Cluster Autoscaler.

ibmcloud ks cluster addon enable cluster-autoscaler \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service Diagnostics and Debug Tool.

ibmcloud ks cluster addon enable debug-tool \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud HPCS Router Operator add-on for Red Hat OpenShift on IBM Cloud.

ibmcloud ks cluster addon enable hpcs-router \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud Storage operator add-on.

ibmcloud ks cluster addon enable ibm-storage-operator \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud Image Key Synchronizer add-on.

ibmcloud ks cluster addon enable image-key-synchronizer \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

Extra components for Istio, including Grafana, Jaeger, and Kiali.

ibmcloud ks cluster addon enable istio-extras \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The BookInfo sample application for Istio.

ibmcloud ks cluster addon enable istio-sample-bookinfo \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--param PARAM

Specify installation options for the add-on. If no parameters are specified, the default values are used. Review the available options with the ibmcloud ks cluster addon options command.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The Red Hat OpenShift Data Foundation on IBM Cloud add-on.

ibmcloud ks cluster addon enable openshift-data-foundation \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Enable all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service static route add-on.

ibmcloud ks cluster addon enable static-route \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--addon ADDON

The add-on name or ID.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View details of an installed add-on.

ibmcloud ks cluster addon get --cluster CLUSTER_NAME_OR_ID --addon ADDON --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List enabled add-ons.

ibmcloud ks cluster addon ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--addon ADDON

The add-on name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify an add-on version to display options for. If no version is specified, the default version's options are displayed.

Examples

View installation options for an add-on.

ibmcloud ks cluster addon options --addon ADDON --version VERSION --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The Red Hat Advanced Cluster Management add-on.

ibmcloud ks cluster addon update acm \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service ALB OAuth Proxy add-on.

ibmcloud ks cluster addon update alb-oauth-proxy \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service Cluster Autoscaler.

ibmcloud ks cluster addon update cluster-autoscaler \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service Diagnostics and Debug Tool.

ibmcloud ks cluster addon update debug-tool \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service Headlamp add-on.

ibmcloud ks cluster addon update headlamp \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud HPCS Router Operator add-on for Red Hat OpenShift on IBM Cloud.

ibmcloud ks cluster addon update hpcs-router \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Storage operator add-on.

ibmcloud ks cluster addon update ibm-storage-operator \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Image Key Synchronizer add-on.

ibmcloud ks cluster addon update image-key-synchronizer \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The managed Istio service mesh.

ibmcloud ks cluster addon update istio \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

Extra components for Istio, including Grafana, Jaeger, and Kiali.

ibmcloud ks cluster addon update istio-extras \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The BookInfo sample application for Istio.

ibmcloud ks cluster addon update istio-sample-bookinfo \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The Knative serverless framework.

ibmcloud ks cluster addon update knative \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service web terminal.

ibmcloud ks cluster addon update kube-terminal \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The Red Hat OpenShift Data Foundation on IBM Cloud add-on.

ibmcloud ks cluster addon update openshift-data-foundation \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud Kubernetes Service static route add-on.

ibmcloud ks cluster addon update static-route \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the version of the add-on to install. If no version is specified, the default version is installed.

-y

Update all add-on dependencies.

Examples

The IBM Cloud VPC Block Storage CSI Driver.

ibmcloud ks cluster addon update vpc-block-csi-driver \
  --cluster CLUSTER_NAME_OR_ID \
  -y Y \
  --version VERSION

Command options

--addon ADDON

Specify an add-on name to filter versions for.

--offering OFFERING

Specify an offering to filter versions for. Accepted values: kubernetes, openshift, openshift-vs

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-defaults

Show the default version columns in the output.

Examples

List supported versions for managed add-ons.

ibmcloud ks cluster addon versions \
  --output json \
  --addon ADDON \
  --show-defaults SHOW-DEFAULTS

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Create a CA certificate for your cluster.

ibmcloud ks cluster ca create --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of a cluster's CA certificate.

ibmcloud ks cluster ca get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Rotate the CA certificates of a cluster, which requires that you previously created CA certificates.

ibmcloud ks cluster ca rotate --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

View the rotation status of CA certificates for a cluster.

ibmcloud ks cluster ca status --cluster CLUSTER_NAME_OR_ID -q

Command options

--admin

Retrieve administrator certificates and PEM keys.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--endpoint ENDPOINT

The server URL to use for the cluster context. If you do not include this flag, the default cluster service endpoint is used. For more info, see https://ibm.biz/context-kube for Kubernetes or https://ibm.biz/context-ocp for OpenShift clusters. Accepted values: private, link, vpe

--network

Retrieve the Calico network config with the Admin config.

--output OUTPUT

Prints the command output in the provided format and skips kubeconfig merges. A zip output does not contain a refresh token. Accepted values: json, yaml, zip

-q

Do not show the message of the day or update reminders.

--skip-rbac

Skip adding RBAC roles. Include this option only if you manage your own Kubernetes RBAC roles. If you use IAM service access roles to manage all your RBAC users, do not include this option.

Examples

Download the Kubernetes configuration files and certificates to connect to your cluster by using kubectl commands.

ibmcloud ks cluster config --cluster CLUSTER_NAME_OR_ID --admin --network

Command options

--disable-disk-encrypt

Disable encryption on a worker node.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--hardware HARDWARE

The level of hardware isolation for your worker node. Use dedicated to have available physical resources dedicated to you only, or shared to allow physical resources to be shared with other IBM customers. For IBM Cloud Public accounts, the default value is shared. For IBM Cloud Dedicated accounts, dedicated is the only available option.

--location LOCATION

Deprecated Flag maintained for compatibility with an earlier version. Use the --zone flag instead.

--name NAME

Enter a name for the cluster.

--no-subnet

Prevent the creation of a portable subnet when creating the cluster. By default, both a public and a private portable subnet are created on the associated VLAN, and this flag prevents that behavior. To add a subnet to the cluster later, run ibmcloud ks cluster subnet add.

--operating-system SYSTEM

Specify the name of the operating system.

--pod-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-classic

--private-only

Use this flag to prevent a public VLAN from being created. Required only when you specify the --private-vlan flag without specifying the --public-vlan flag.

--private-service-endpoint

Enable the private service endpoint to make the master privately accessible.

--private-vlan VLAN

Conditional: Specify the ID of the private VLAN. To see available VLANs, run ibmcloud ks vlan ls --zone <zone name>. If you do not have a private VLAN yet, do not specify this option because one will be automatically created for you. When you specify a private VLAN, you must also specify either the --public-vlan flag or the --private-only flag.

--public-service-endpoint

Enable the public service endpoint to make the master publicly accessible.

--public-vlan VLAN

Conditional: Specify the ID of the public VLAN. To see available VLANs, run ibmcloud ks vlan ls --zone <zone name>. If you do not have a public VLAN yet, do not specify this option because one will be automatically created for you.

-q

Do not show the message of the day or update reminders.

--service-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-classic. Default value: 172.21.0.0/16

--skip-advance-permissions-check

Skip checking for infrastructure permissions before completing this action. Note that if you do not have the correct infrastructure permissions, this action might only partially succeed.

--sm-group GROUP

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance INSTANCE

The CRN of the IBM Cloud Secrets Manager instance.

--version VERSION

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--workers COUNT

The number of cluster worker nodes. Defaults to 1.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on classic infrastructure.

ibmcloud ks cluster create classic \
  --private-only \
  --name NAME \
  --zone ZONE \
  --private-vlan VLAN_ID

Command options

--enable-config-admin

Grant cluster admin access to Satellite Config to manage Kubernetes resources.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--host-label LABEL, --hl LABEL

Enter any labels as key-value pairs to identify the host to assign to your Satellite control plane or Red Hat OpenShift cluster. The first host that has this label and is unassigned is automatically assigned to the control plane or cluster. To find available host labels, run ibmcloud sat host get --host <host_name_or_ID> --location <location_name_or_ID>.

--infrastructure-topology TOPOLOGY

Specify whether the cluster should run a single worker node or the default number of worker nodes. To create a single-node cluster, specify single-replica. To create a default cluster with multiple worker nodes, specify highly-available. The highly-available option is applied by default. Accepted values: single-replica, highly-available

--location LOCATION

The name or ID of the Satellite location. To find the location ID or name, run ibmcloud sat location ls.

--name NAME

Enter a name for the cluster.

--operating-system SYSTEM

Specify the name of the operating system.

--pod-network-interface-selection SELECTION

The method for selecting the node network interface for the internal pod network. This option can be used only if the Satellite location that you specify has Red Hat CoreOS enabled. To provide a direct URL or IP address, specify can-reach=<url> or can-reach=<ip_address>. To choose a network interface, specify interface=<network_interface>.

--pod-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-satellite. Default value: 172.30.0.0/16

--pull-secret SECRET

Specify an existing OpenShift entitlement for this cluster's worker nodes by providing your Red Hat account pull secret.

-q

Do not show the message of the day or update reminders.

--service-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-satellite. Default value: 172.21.0.0/16

--sm-group GROUP

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance INSTANCE

The CRN of the IBM Cloud Secrets Manager instance.

--version VERSION

The Red Hat OpenShift on IBM Cloud version, including at least the major.minor version. To see available versions, run ibmcloud ks versions.

--workers COUNT

The number of worker nodes per zone in the default worker pool. Required when --host-label is specified.

--zone ZONE

The zone for the default worker pool in a multizone cluster. To list zones for your location, run ibmcloud sat location get.

Examples

Create an IBM Cloud Satellite cluster on your own infrastructure.

ibmcloud ks cluster create satellite \
  --workers COUNT \
  --host-label HOSTNAME \
  --location LOCATION \
  --name NAME

Command options

--disable-public-service-endpoint

Disable the public service endpoint to prevent public access to the master.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--name NAME

Enter a name for the cluster.

--operating-system SYSTEM

Specify the name of the operating system.

--pod-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-vpc

-q

Do not show the message of the day or update reminders.

--service-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-vpc. Default value: 172.21.0.0/16

--sm-group GROUP

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance INSTANCE

The CRN of the IBM Cloud Secrets Manager instance.

--subnet-id ID

The VPC subnet to assign the cluster. To list available subnets, run ibmcloud ks subnets --provider vpc-classic --vpc-id <vpc-id> --zone <vpc-zone>.

--version VERSION

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--vpc-id ID

The ID of the VPC in which to create the worker nodes. To list available IDs, run ibmcloud ks vpcs.

--workers COUNT

The number of worker nodes per zone in the default worker pool. For OpenShift clusters, you must set this value to at least 2. For Kubernetes clusters, this value is optional.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on Virtual Private Cloud (VPC) Gen 1 infrastructure.

ibmcloud ks cluster create vpc-classic --name NAME --zone ZONE --vpc-id VPC_ID

Command options

--cluster-security-group GROUP

Optional. Specify one or more security group IDs to apply to all workers on the cluster. For OpenShift version 4.15 and Kubernetes version 1.30 and later, these security groups are applied in addition to the IBM-managed kube-clusterID security group. For earlier cluster versions, specify the --cluster-security-group cluster option to apply the kube-clusterID security group. If no value is specified, a default set of security groups including kube-clusterID are applied.

--cni CNI

Set the network plugin for the cluster. Calico is set by default. Accepted values: Calico, OVNKubernetes

--cos-instance INSTANCE

Required for OpenShift clusters only. The CRN for the standard cloud object storage instance to back up the internal registry in your OpenShift cluster. To list the CRNs of your cloud object storage instances, run ibmcloud resource service-instances --long --service-name cloud-object-storage.

--crk CRK

The ID of the root key in your KMS instance to use for local disk encryption. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance>.

--disable-outbound-traffic-protection

Include this option to allow public outbound access from the cluster workers. By default, public outbound access is blocked in OpenShift versions 4.15 and later and Kubernetes versions 1.30 and later.

--disable-public-service-endpoint

Disable the public service endpoint to prevent public access to the master.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--kms-account-id ID

The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--kms-instance INSTANCE

The ID of the KMS instance to use for local disk encryption. To list available KMS instances, run ibmcloud ks kms instance ls.

--name NAME

Enter a name for the cluster.

--offering OFFERING

Specify the cluster offering. Accepted values: kubernetes, openshift, openshift-vs

--operating-system SYSTEM

Specify the name of the operating system.

--pod-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for pods. The subnet must be at least /23 or larger. For more info, see https://ibm.biz/cluster-create-vpc

-q

Do not show the message of the day or update reminders.

--secondary-storage STORAGE

The secondary storage option for the flavor. To view the secondary storage options that are available for a flavor, run ibmcloud ks flavor get --provider vpc-gen2 --zone <zone name>.

--service-subnet SUBNET

Specify a custom subnet CIDR to provide private IP addresses for services. The subnet must be at least /24 or larger. For more info, see https://ibm.biz/cluster-create-vpc. Default value: 172.21.0.0/16

--sm-group GROUP

The Secret Group ID of the IBM Cloud Secrets Manager instance where your secrets are persisted.

--sm-instance INSTANCE

The CRN of the IBM Cloud Secrets Manager instance.

--subnet-id ID

The VPC subnet to assign the cluster. To list available subnets, run ibmcloud ks subnets --provider vpc-gen2 --vpc-id <vpc-id> --zone <vpc-zone>.

--version VERSION

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

--vpc-id ID

The ID of the VPC in which to create the worker nodes. To list available IDs, run ibmcloud ks vpcs.

--workers COUNT

The number of worker nodes per zone in the default worker pool. For OpenShift clusters, you must set this value to at least 2. For Kubernetes clusters, this value is optional.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create a cluster with worker nodes on Virtual Private Cloud (VPC) Gen 2 infrastructure.

ibmcloud ks cluster create vpc-gen2 \
  --cos-instance INSTANCE_ID \
  --name NAME \
  --zone ZONE \
  --vpc-id VPC_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-resources

Show additional cluster resources such as add-ons, VLANs, and subnets.

Examples

Get the details of a registered cluster.

ibmcloud sat cluster get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable image security enforcement in your cluster.

ibmcloud ks cluster image-security disable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable image security enforcement in your cluster.

ibmcloud ks cluster image-security enable --cluster CLUSTER_NAME_OR_ID -f -q

Command options

-l LOCATION, --location LOCATION

A location to filter for. To list available locations, run ibmcloud ks locations.

--output OUTPUT

Prints the command output in the provided format. If you do not include the provider flag, only classic clusters are returned. Accepted values: json

--provider PROVIDER

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

Examples

List all registered clusters in your IBM Cloud account.

ibmcloud sat cluster ls --filter FILTER --limit LIMIT --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the OpenShift web console and OAuth server access type.

ibmcloud ks cluster master console-oauth-access get \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--type TYPE

Specify the OpenShift web console and OAuth server access type. Accepted values: vpe-gateway, legacy

Examples

Set the OpenShift web console and OAuth server access type.

ibmcloud ks cluster master console-oauth-access set \
  --cluster CLUSTER_NAME_OR_ID \
  --type TYPE \
  -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the PodSecurity admission configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security get \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable PodSecurityPolicy for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security policy disable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable PodSecurityPolicy for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security policy enable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the PodSecurityPolicy configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security policy get \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--config-file FILE

The filepath of a custom PodSecurity configuration. If not specified, the Kubernetes defaults are applied. For more information, see https://ibm.biz/BdPtUB

-q

Do not show the message of the day or update reminders.

Examples

Set and enable the PodSecurity admission configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security set \
  --cluster CLUSTER_NAME_OR_ID \
  --config-file FILE_PATH \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Remove the PodSecurity admission configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security unset --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet SUBNET

Specify the subnet CIDR.

Examples

Add subnets to a cluster's private service endpoint allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist add \
  --cluster CLUSTER_NAME_OR_ID \
  --subnet SUBNET_CIDR \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist disable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist enable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Get a cluster's private service endpoint allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist get \
  --cluster CLUSTER_NAME_OR_ID \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet SUBNET

Specify the subnet CIDR.

Examples

Remove subnets from a cluster's private service endpoint allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist rm \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  --subnet SUBNET_CIDR

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Enable the private service endpoint to make the master privately accessible.

ibmcloud ks cluster master private-service-endpoint enable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -y Y

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Disable the public service endpoint to make the master only privately accessible.

ibmcloud ks cluster master public-service-endpoint disable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -y Y

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

-y

If the feature requires further action, such as reloading workers or refreshing the cluster master, then perform those actions with no user prompts.

Examples

Enable the public service endpoint to make the master publicly accessible.

ibmcloud ks cluster master public-service-endpoint enable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -y Y

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Restart the cluster master nodes to apply new Kubernetes API configuration changes.

ibmcloud ks cluster master refresh --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet SUBNET

Specify the subnet CIDR.

Examples

Add subnets to a cluster's satellite service endpoint allowlist.

ibmcloud ks cluster master satellite-service-endpoint allowlist add \
  --cluster CLUSTER_NAME_OR_ID \
  --subnet SUBNET_CIDR \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the satellite service endpoint allowlist.

ibmcloud ks cluster master satellite-service-endpoint allowlist disable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the satellite service endpoint allowlist.

ibmcloud ks cluster master satellite-service-endpoint allowlist enable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Get a cluster's satellite service endpoint allowlist.

ibmcloud ks cluster master satellite-service-endpoint allowlist get \
  --cluster CLUSTER_NAME_OR_ID \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet SUBNET

Specify the subnet CIDR.

Examples

Remove subnets from a cluster's satellite service endpoint allowlist.

ibmcloud ks cluster master satellite-service-endpoint allowlist rm \
  --cluster CLUSTER_NAME_OR_ID \
  --subnet SUBNET_CIDR \
  -f \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--force-update

Attempt the update even if the change is greater than two minor versions from the worker node's current version.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the Kubernetes or OpenShift version, including at least the major.minor version. If you do not include this flag, the default version is used. To see available versions, run ibmcloud ks versions.

Examples

Update the cluster master to the latest version.

ibmcloud ks cluster master update \
  --cluster CLUSTER_NAME_OR_ID \
  --force-update FORCE-UPDATE \
  -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Generate a new image pull secret that stores IAM credentials for the cluster to access images in IBM Cloud Container Reg.

ibmcloud ks cluster pull-secret apply --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--delete-openshift-registry-cos-bucket

Remove the COS bucket and the associated service key that holds the OpenShift registry backups on ROKS clusters

--delete-storage

Force the removal of the cluster's persistent storage. Deleted data cannot be recovered.

-f

Force the command to run without user prompts. The cluster's persistent storage is not deleted unless the delete-storage option is also provided. The COS bucket and it's associated service key is not deleted unless the delete-openshift-registry-cos-bucket option is also provided.

-q

Do not show the message of the day or update reminders.

--skip-advance-permissions-check

Skip checking for infrastructure permissions before completing this action. Note that if you do not have the correct infrastructure permissions, this action might only partially succeed.

Examples

Delete a cluster.

ibmcloud ks cluster rm --cluster CLUSTER_NAME_OR_ID -f --delete-storage DELETE-STORAGE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--key KEY

Specify the name or GUID of an existing service key. If you define a service key, you cannot set the --role option at the same time.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

--role ROLE

Specify the IAM role for the service key. This flag does not work if you specify an existing key to use or for services that are not IAM-enabled, such as Cloud Foundry services.

--service SERVICE

Specify the name of the service instance. To see a list of available service instances, run ibmcloud service list for Cloud Foundry services, or ibmcloud resource service-instances for IAM-enabled services.

Examples

Add an IBM Cloud service to a cluster by binding the service instance to a Kubernetes namespace.

ibmcloud ks cluster service bind \
  --cluster CLUSTER_NAME_OR_ID \
  --namespace NAME \
  --key KEY

Command options

--all-namespaces

Include all Kubernetes namespaces.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--namespace NAMESPACE, -n NAMESPACE

The Kubernetes namespace. Will use the default namespace if not specified.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List services bound to a Kubernetes namespace.

ibmcloud ks cluster service ls \
  --cluster CLUSTER_NAME_OR_ID \
  --namespace NAME \
  --all-namespaces NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

--service SERVICE

Specify the name of the service instance. To see a list of available service instances, run ibmcloud service list for Cloud Foundry services, or ibmcloud resource service-instances for IAM-enabled services.

Examples

Remove an IBM Cloud service from a cluster by unbinding it from a Kubernetes namespace.

ibmcloud ks cluster service unbind \
  --cluster CLUSTER_NAME_OR_ID \
  --namespace NAME \
  --service SERVICE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--subnet-id ID

Specify the subnet ID.

Examples

Make an existing public or private portable subnet in your IBM Cloud infrastructure account available to a classic clust.

ibmcloud ks cluster subnet add --cluster CLUSTER_NAME_OR_ID --subnet-id SUBNET_CIDR -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--size SIZE

Specify the size of the portable subnet. The size must be one of 8, 16, 32, 64.

--vlan VLAN

Specify the public or private VLAN ID.

Examples

Create a portable subnet on your public or private VLAN and make it available to a classic cluster.

ibmcloud ks cluster subnet create \
  --cluster CLUSTER_NAME_OR_ID \
  --size SIZE \
  --vlan VLAN_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--subnet-id ID

Specify the subnet ID.

Examples

Detach an existing public or private portable subnet from a classic cluster.

ibmcloud ks cluster subnet detach \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  --subnet-id SUBNET_CIDR

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target.

Examples

If you set up your IBM Cloud account to use different credentials to access the IBM Cloud classic infrastructure portfol.

ibmcloud ks credential get --output json --region REGION -q

Command options

--infrastructure-api-key KEY

The API key of your IBM Cloud classic infrastructure account.

--infrastructure-username USERNAME

The user name of your IBM Cloud classic infrastructure account.

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target.

Examples

Set credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud account.

ibmcloud ks credential set classic \
  --infrastructure-username NAME \
  --infrastructure-api-key INFRASTRUCTURE-API-KEY \
  --region REGION

Command options

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target.

Examples

Remove the credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud ac.

ibmcloud ks credential unset --region REGION -q

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

The region where the resource-group is located.

--resource-group GROUP

The resource-group whose default trusted profile is to be retrieved.

Examples

Get the default trusted profile for clusters created in a resource-group.

ibmcloud ks experimental trusted-profile default get \
  --resource-group RESOURCE_GROUP \
  --region REGION \
  --output json

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

The region where the resource group is located.

--resource-group GROUP

The resource group ID to set the trusted profile on.

--trusted-profile PROFILE

The trusted profile ID.

Examples

Set the default trusted profile for clusters created in a resource-group.

ibmcloud ks experimental trusted-profile default set \
  --resource-group RESOURCE_GROUP \
  --trusted-profile FILE_PATH \
  --region REGION

Command options

--cluster CLUSTER

The cluster ID to retrieve the trusted profile for.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get trusted profile for a cluster.

ibmcloud ks experimental trusted-profile get \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  -q

Command options

--cluster CLUSTER

The cluster ID to set the the trusted profile on.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--trusted-profile PROFILE

The trusted profile ID.

Examples

Set trusted profile on a cluster.

ibmcloud ks experimental trusted-profile set \
  --cluster CLUSTER_NAME_OR_ID \
  --trusted-profile FILE_PATH \
  --output json

Command options

--auto-delete

Automatically delete the VNI when it is removed from the cluster.

--cluster-id ID, -c ID

The ID of the cluster.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vlan VLAN

The VLAN ID for the bare metal node attachment. Must be unique for each VPC subnet. Multiple VNIs from the same subnet can reuse the VLAN ID. Valid range: 1-500.

--vni VNI

The ID of the Virtual Network Interface to attach. You must specify VNIs without any current target resource. To list all the VNIs, run ibmcloud is vnis. To check if a specific VNI is already attached to a resource, check for the "Target" field in 'ibmcloud is vni <VNI_ID>.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

Attach a Virtual Network Interface to a bare metal worker node or cluster.

ibmcloud ks experimental vni attach baremetal \
  --cluster-id CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --vni VNI

Command options

--auto-delete

Automatically delete the VNI when it is removed from the cluster.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vni VNI

The ID of the Virtual Network Interface to attach. You must specify VNIs without any current target resource. To list all the VNIs, run ibmcloud is vnis. To check if a specific VNI is already attached to a resource, check for the "Target" field in 'ibmcloud is vni <VNI_ID>.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

Attach a Virtual Network Interface to a virtual worker node.

ibmcloud ks experimental vni attach virtual \
  --vni VNI \
  --worker WORKER_ID \
  --auto-delete AUTO-DELETE

Command options

--cluster-id ID, -c ID

The ID of the cluster.

-f

Force the command to run without user prompts.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vni VNI

The ID of the Virtual Network Interface to detach.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

Detach a Virtual Network Interface from a worker node or cluster.

ibmcloud ks experimental vni detach \
  --cluster-id CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --vni VNI

Command options

--after AFTER

Show Virtual Network Interfaces after the given cursor.

--cluster-id ID, -c ID

The ID of the cluster.

--first FIRST

View the next Virtual Network Interfaces, up to the first number of VNIs.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

List Virtual Network Interfaces attached to a cluster.

ibmcloud ks experimental vni ls --cluster-id ID

List Virtual Network Interfaces attached to a worker node.

ibmcloud ks experimental vni ls --worker WORKER

Command options

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

Specify a provider. Available options are classic, vpc-classic and vpc-gen2.

-q

Do not show the message of the day or update reminders.

--zone ZONE

Specify the zone to list available flavors for. To list available zones, run ibmcloud ks zone ls.

Examples

Get the information of a flavor for a zone and provider.

ibmcloud ks flavor get --zone ZONE --provider PROVIDER_ID --flavor FLAVOR

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

The provider type to get the flavors for. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--show-os

List supported operating systems.

--show-storage

Show additional storage drives.

--zone ZONE

Specify the zone to list available flavors for. To list available zones, run ibmcloud ks zone ls.

Examples

List available flavors for a zone.

ibmcloud ks flavor ls --zone ZONE --show-storage SHOW-STORAGE --show-os SHOW-OS

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target. If a region is not already targeted, this argument must be specified. To check if a region is targeted, run ibmcloud target.

Examples

Check whether the credentials that allow access to the IBM Cloud classic infrastructure portfolio for the targeted resou.

ibmcloud ks infra-permissions get --output json --region REGION -q

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

See autoscaling status and configuration for Ingress ALBs.

ibmcloud ks ingress alb autoscale get \
  --cluster CLUSTER_NAME_OR_ID \
  --alb ALB_ID \
  --output json

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--cpu-average-utilization PERCENT

Average CPU utilization threshold. Used to dynamically calculate the number of replicas.

--custom-metrics-file FILE

Path for the custom metric file. See https://ibm.biz/iks-ingress-custom-metrics for more details.

--max-replicas REPLICAS

The maximum replicas for the given ALB. Ensure you have enough workers.

--min-replicas REPLICAS

The minimum replicas for the given ALB. Must be greater or equal to 1. (Recommended minimum is 2 for high availability purposes.)

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Configure autoscaling for Ingress ALBs.

ibmcloud ks ingress alb autoscale set \
  --cluster CLUSTER_NAME_OR_ID \
  --alb ALB_ID \
  --max-replicas MAX-REPLICAS

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Delete the autoscaling configuration for Ingress ALBs.

ibmcloud ks ingress alb autoscale unset --cluster CLUSTER_NAME_OR_ID --alb ALB_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable automatic updates of all Ingress ALB pods in a cluster.

ibmcloud ks ingress alb autoupdate disable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable automatic updates of all Ingress ALB pods in a cluster.

ibmcloud ks ingress alb autoupdate enable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View whether the Ingress ALB pods in a cluster are set to automatically update and whether ALB pods are at the latest ve.

ibmcloud ks ingress alb autoupdate get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

Specify a portable public or private IP address that is available on the vlan and in the zone of the ALB to be created or enabled.

-q

Do not show the message of the day or update reminders.

--type TYPE

Specify the type of ALB. Available options: public, private

--version VERSION

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

--vlan VLAN

The VLAN ID. This VLAN must match the ALB type and must be in the same zone as the ALB that you want to create.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create and enable an Ingress ALB in a classic cluster.

ibmcloud ks ingress alb create classic \
  --cluster CLUSTER_NAME_OR_ID \
  --zone ZONE \
  --type TYPE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--type TYPE

Specify the type of ALB. Available options: public, private

--version VERSION

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Create and enable an Ingress ALB in a VPC Gen 2 cluster.

ibmcloud ks ingress alb create vpc-gen2 \
  --cluster CLUSTER_NAME_OR_ID \
  --zone ZONE \
  --type TYPE

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable an Ingress ALB in a cluster.

ibmcloud ks ingress alb disable --cluster CLUSTER_NAME_OR_ID --alb ALB_ID -q

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

Specify a portable public or private IP address that is available on the vlan and in the zone of the ALB to be created or enabled.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Enable an Ingress ALB in a classic cluster.

ibmcloud ks ingress alb enable classic \
  --cluster CLUSTER_NAME_OR_ID \
  --alb ALB_ID \
  --version VERSION

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Enable an Ingress ALB in a VPC Gen 2 cluster.

ibmcloud ks ingress alb enable vpc-gen2 \
  --cluster CLUSTER_NAME_OR_ID \
  --alb ALB_ID \
  --version VERSION

Command options

--alb ALB

The ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress ALB in a cluster.

ibmcloud ks ingress alb get --cluster CLUSTER_NAME_OR_ID --alb ALB_ID --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable the Ingress health checker.

ibmcloud ks ingress alb health-checker disable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable the Ingress health checker.

ibmcloud ks ingress alb health-checker enable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View status of the Ingress health checker.

ibmcloud ks ingress alb health-checker get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List all Ingress ALB IDs in a cluster and whether ALB pods are at the latest version.

ibmcloud ks ingress alb ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--alb ALB

To update a specific ALB, specify the ALB ID. To see available ALB IDs, run ibmcloud ks ingress alb ls. To update more than one ALB, specify one ALB ID in each flag, such as --alb ID_1 --alb ID_2. To update all ALBs, do not include this flag.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--version VERSION

Specify the ALB image version. To see supported image versions, run ibmcloud ks ingress alb versions.

Examples

Force a one-time update of the pods for individual or all ALBs in the cluster.

ibmcloud ks ingress alb update \
  --cluster CLUSTER_NAME_OR_ID \
  --version VERSION \
  --alb ALB_ID

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target.

Examples

List Ingress ALB image versions that are available.

ibmcloud ks ingress alb versions --region REGION --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--crn CRN

The CRN for the IBM CIS instance.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--domain-provider PROVIDER

The DNS provider. The default DNS provider is our internal one. For supported providers see our documentation: https://ibm.biz/containers-ingress-domains

--domain-zone ZONE

The ZoneID for CIS.

--hostname HOSTNAME

For VPC clusters. The hostname to register for the domain.

--ip IP

The IP addresses to register for the domain.

--is-default

Include this option to set the relevant domain as the default domain for cluster.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace NAMESPACE

The namespace that the TLS secret is created in.

Examples

Create an Ingress domain for a cluster.

ibmcloud ks ingress domain create \
  --cluster CLUSTER_NAME_OR_ID \
  --domain DOMAIN \
  --domain-provider DOMAIN

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-q

Do not show the message of the day or update reminders.

Examples

Change a cluster's default Ingress domain.

ibmcloud ks ingress domain default replace \
  --cluster CLUSTER_NAME_OR_ID \
  --domain DOMAIN \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress domain.

ibmcloud ks ingress domain get \
  --cluster CLUSTER_NAME_OR_ID \
  --domain DOMAIN \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List all Ingress domains for a cluster.

ibmcloud ks ingress domain ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Remove an Ingress domain from a cluster.

ibmcloud ks ingress domain rm --cluster CLUSTER_NAME_OR_ID --domain DOMAIN -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Regenerate the certificate for an Ingress domain.

ibmcloud ks ingress domain secret regenerate \
  --cluster CLUSTER_NAME_OR_ID \
  --domain DOMAIN \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

-f

Force the command to run without user prompts.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Delete a secret for an Ingress domain and prevent future renewal of the certificate.

ibmcloud ks ingress domain secret rm --cluster CLUSTER_NAME_OR_ID --domain DOMAIN -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--domain DOMAIN

The Ingress domain. To see existing domains, run ibmcloud ks ingress domain ls.

--hostname HOSTNAME

For VPC clusters. The hostname to register for the domain.

--ip IP

The IP addresses to register for the domain.

-q

Do not show the message of the day or update reminders.

Examples

Update an Ingress domain for a cluster.

ibmcloud ks ingress domain update \
  --cluster CLUSTER_NAME_OR_ID \
  --domain DOMAIN \
  --ip IP_ADDRESS

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

--secret-group GROUP

Secret Group ID of the IBM Cloud Secret Manager instance where the secrets are persisted.

Examples

Set a registered IBM Cloud Secrets Manager instance as the default.

ibmcloud ks ingress instance default set \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --secret-group GROUP

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

Examples

Unset a registered IBM Cloud Secrets Manager instance from default.

ibmcloud ks ingress instance default unset --cluster CLUSTER_NAME_OR_ID --name NAME -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

The name of the registered IBM Cloud Secret Manager instance.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an IBM Cloud Secrets Manager instance.

ibmcloud ks ingress instance get \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-deleted

Show IBM Cloud Secret Manager instances that were unregistered from the cluster.

Examples

List all instances of the IBM Cloud Secrets Manager.

ibmcloud ks ingress instance ls \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  --show-deleted

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--crn CRN

CRN of the IBM Cloud Secret Manager instance.

--is-default

Set the IBM Cloud Secrets Manager instance as the default. If an existing default instance exists, it is unset.

-q

Do not show the message of the day or update reminders.

--secret-group GROUP

Secret Group ID of the IBM Cloud Secret Manager instance where the secrets are persisted.

Examples

Register an IBM Cloud Secrets Manager instance to a cluster.

ibmcloud ks ingress instance register \
  --cluster CLUSTER_NAME_OR_ID \
  --crn CRN \
  --is-default IS-DEFAULT

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

The name of the registered IBM Cloud Secret Manager instance.

-q

Do not show the message of the day or update reminders.

Examples

Unregister an IBM Cloud Secrets Manager instance from a cluster.

ibmcloud ks ingress instance unregister --cluster CLUSTER_NAME_OR_ID --name NAME -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--private-backend BACKEND

Backend for private load balancer

--public-backend BACKEND

Backend for public load balancer

-q

Do not show the message of the day or update reminders.

Examples

Set the Ingress controller currently exposed by the VPC ALB load balancer.

ibmcloud ks ingress load-balancer backend set \
  --cluster CLUSTER_NAME_OR_ID \
  --private-backend PRIVATE-BACKEND \
  --public-backend PUBLIC-BACKEND

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the configuration of load balancers that expose Ingress ALBs in your cluster.

ibmcloud ks ingress load-balancer get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the PROXY protocol so that client connection information is no longer passed in request headers to ALBs.

ibmcloud ks ingress load-balancer proxy-protocol disable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  -q

Command options

--cidr CIDR

The IP address ranges of your load balancers in CIDR format. PROXY headers that are forwarded by load balancers in other IP ranges are not processed.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the PROXY protocol so that client connection information is passed in request headers to ALBs.

ibmcloud ks ingress load-balancer proxy-protocol enable \
  --cluster CLUSTER_NAME_OR_ID \
  --cidr CIDR_ID \
  -f

Command options

--cert-crn CRN

The certificate CRN.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--field FIELD

The secret CRN to include as a field. To pull in the secret without specifying the name, use --field <crn>. To specify the field name, use --field name=<crn>. To use the IBM Cloud Secrets Manager secret as the prefix, use --field prefix=<crn>.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

--persist

Persist the secret in the cluster so that it cannot be deleted.

-q

Do not show the message of the day or update reminders.

--type TYPE

The Ingress secret type. Can be TLS or Opaque. If no option is specified, TLS is applied by default.

Examples

Create an Ingress secret in a cluster for a secret stored in IBM Cloud Secret Manager.

ibmcloud ks ingress secret create \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--field FIELD

The secret CRN to include as a field. To pull in the secret without specifying the name, use --field <crn>. To specify the field name, use --field name=<crn>. To use the IBM Cloud Secrets Manager secret as the prefix, use --field prefix=<crn>.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

Examples

Add fields to an existing Ingress secret.

ibmcloud ks ingress secret field add \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-crn

Show CRN value of secret.

Examples

View the fields of an Ingress secret.

ibmcloud ks ingress secret field ls \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--field-name NAME

The name of the field to remove from the secret.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

Examples

Remove fields from an existing Ingress secret.

ibmcloud ks ingress secret field rm \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of an Ingress secret.

ibmcloud ks ingress secret get \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-crn

Show CRN value of secret.

--show-deleted

Show secrets that were deleted from the cluster.

Examples

List all Ingress secrets in a cluster.

ibmcloud ks ingress secret ls --cluster CLUSTER_NAME_OR_ID --show-deleted --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

Examples

Remove an Ingress secret from a cluster.

ibmcloud ks ingress secret rm \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cert-crn CRN

The certificate CRN.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--name NAME

A name for the Ingress secret that is created in the cluster.

--namespace NAMESPACE, -n NAMESPACE

Specify the Kubernetes namespace.

-q

Do not show the message of the day or update reminders.

Examples

Update an existing Ingress secret.

ibmcloud ks ingress secret update \
  --cluster CLUSTER_NAME_OR_ID \
  --name NAME \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable the usage of port 80 in your cluster.

ibmcloud ks ingress security port80 disable --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable the usage of port 80 in your cluster.

ibmcloud ks ingress security port80 enable --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the security configuration of port 80 in your cluster.

ibmcloud ks ingress security port80 get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Disable status reporting for Ingress components in a cluster.

ibmcloud ks ingress status-report disable --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Enable status reporting for Ingress components in a cluster.

ibmcloud ks ingress status-report enable --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Get the status report for Ingress components in a cluster.

ibmcloud ks ingress status-report get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--code CODE

Code of the warning to be ignored.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Add warnings to be ignored by Ingress status for a cluster.

ibmcloud ks ingress status-report ignored-errors add \
  --code CODE \
  --cluster CLUSTER_NAME_OR_ID \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List warnings that are currently ignored by Ingress status for a cluster.

ibmcloud ks ingress status-report ignored-errors ls \
  --cluster CLUSTER_NAME_OR_ID \
  --output json \
  -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--code CODE

Code of the warning to be removed.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove warnings that are currently ignored by Ingress status for a cluster.

ibmcloud ks ingress status-report ignored-errors rm \
  --code CODE \
  --cluster CLUSTER_NAME_OR_ID \
  --output json

Command options

--instance-id ID

KMS instance ID. To see available KMS instances, run ibmcloud ks kms instance ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List available root keys for a Key Management Service instance.

ibmcloud ks kms crk ls --output json --instance-id INSTANCE_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--crk CRK

A root key ID in your KMS instance. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance>.

--instance-id ID

KMS instance ID. To see available KMS instances, run ibmcloud ks kms instance ls.

--kms-account-id ID

The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--public-endpoint

Specify this option to use the KMS public service endpoint. Otherwise the KMS private service endpoint is used.

-q

Do not show the message of the day or update reminders.

Examples

Enable a key management service (KMS) in your cluster to encrypt your secrets.

ibmcloud ks kms enable \
  --cluster CLUSTER_NAME_OR_ID \
  --instance-id INSTANCE_ID \
  --crk CRK

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List available Key Management Service instances.

ibmcloud ks kms instance ls --output json -q

Command options

--output

Prints the command output in the provided format. Accepted values: json

--provider

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--show-flavors

Show the available worker node flavors in the zone for VPC.

Examples

List supported IBM Cloud Kubernetes Service locations.

ibmcloud ks locations --provider PROVIDER_ID --show-flavors FLAVOR --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Disable automatic updates of all Fluentd pods in a cluster.

ibmcloud ks logging autoupdate disable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

Examples

Enable automatic updates of all Fluentd pods in a cluster.

ibmcloud ks logging autoupdate enable --cluster CLUSTER_NAME_OR_ID -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View whether your Fluentd pods are set to automatically update in a cluster.

ibmcloud ks logging autoupdate get --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

-C CONTAINER, --app-container CONTAINER

Specify the containers that you want to collect logs for. To specify more than one path, use multiple flags, such as -C container1 -C container2. This option is required for the application log source. If not provided, logs are collected from all containers from the application log paths passed in.

--ca-cert CERT

When the logging type is syslog and the protocol is tls, the Kubernetes secret name that contains the Certificate Authority certificate.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--hostname HOSTNAME

When logging type is syslog, the hostname or IP address of the log collector. When logging type is ibm (deprecated), the logging ingest endpoint. If you do not provide the logging ingest endpoint, then the current region's endpoint is used.

--logsource LOGSOURCE

The source of the logs to forward. Supported values are container, application, ingress, worker, storage, and kubernetes. This argument supports a comma separated list of log sources. If you do not provide a log source, logs for container and ingress are forwarded.

--namespace NAMESPACE, -n NAMESPACE

The namespace you want to apply the log forwarding configuration to. Only use this flag with the container log source or if you do not specify a log source. If you do not specify a namespace, then all namespaces use this configuration.

--org ORG

Deprecated The org name to send logs to. This flag is only valid when the logging type is ibm. The org name is required when you specify a space name. If you do not specify a space name, then logs are forwarded at the account level.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-p PATH, --app-path PATH

Specify the absolute file path to collect logs from inside the container. To specify more than one path, use multiple flags, such as -p path1 -p path2. Required parameter when specifying application for the log source. Wildcards such as /var/log/*.log are accepted but recursive globs such are /var/log/**/test.log are not.

--port PORT

The port of the log collector. If you do not specify a port, the default port for the ingestion endpoint is used for ibm (deprecated) and 514 is used for syslog.

-q

Do not show the message of the day or update reminders.

--skip-validation

Skips validation of the org and space names when they are specified. This can result in a broken logging config if the values are invalid but will take less time to process.

--space SPACE

Deprecated The space name to send logs to. This flag is only valid when the logging type is ibm. The space name is required when you specify an org name. If you do not specify a space name, then logs are forwarded at the account level.

--syslog-protocol PROTOCOL

When the logging type is syslog, the transport layer protocol. Supported values are tls, tcp and the default udp. When forwarding to an rsyslog server with the UDP protocol, logs that are over 1KB are truncated.

--type TYPE

The log forwarding protocol that you want to use. The only supported value is syslog.

--verify-mode MODE

When the logging type is syslog and the protocol is tls, the verification mode. Supported values are verify-peer and the default verify-none.

Examples

Create a logging configuration.

ibmcloud ks logging config create \
  --org ORG \
  --space SPACE \
  -C C \
  -p POOL_NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --namespace NAME \
  --logsource LOGSOURCE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--logsource LOGSOURCE

The kind of log source you want to filter for. Accepted values are container, application, ingress, worker, storage and kubernetes. If you do not pass a log source, all logging configurations for the cluster are returned.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View log forwarding configurations for a cluster.

ibmcloud ks logging config get \
  --cluster CLUSTER_NAME_OR_ID \
  --logsource LOGSOURCE \
  --output json

Command options

--all

Remove all log forwarding configurations.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id ID

Specify the ID of the logging configuration.

--namespace NAMESPACE, -n NAMESPACE

The namespace you want to remove the log forwarding configuration from. If there is more than one config for the same namespace, use the --id <logging configuration ID> flag instead.

-q

Do not show the message of the day or update reminders.

Examples

Delete a log forwarding configuration from a cluster.

ibmcloud ks logging config rm --cluster CLUSTER_NAME_OR_ID --namespace NAME

Command options

-C CONTAINER, --app-container CONTAINER

Specify the containers that you want to collect logs for. To specify more than one path, use multiple flags, such as -C container1 -C container2. This option is required for the application log source. If not provided, logs are collected from all containers from the application log paths passed in.

--ca-cert CERT

When the logging type is syslog and the protocol is tls, the Kubernetes secret name that contains the Certificate Authority certificate.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--hostname HOSTNAME

When logging type is syslog, the hostname or IP address of the log collector. When logging type is ibm (deprecated), the logging ingest endpoint. If you do not provide the logging ingest endpoint, then the current region's endpoint is used.

--id ID

Specify the ID of the logging configuration.

--logsource LOGSOURCE

The source of the logs to forward. Supported values are container, application, ingress, worker, storage, and kubernetes. This argument supports a comma separated list of log sources. If you do not provide a log source, logs for container and ingress are forwarded.

--namespace NAMESPACE, -n NAMESPACE

The namespace you want to apply the log forwarding configuration to. Only use this flag with the container log source or if you do not specify a log source. If you do not specify a namespace, then all namespaces use this configuration.

--org ORG

Deprecated The org name to send logs to. This flag is only valid when the logging type is ibm. The org name is required when you specify a space name. If you do not specify a space name, then logs are forwarded at the account level.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-p PATH, --app-path PATH

Specify the absolute file path to collect logs from inside the container. To specify more than one path, use multiple flags, such as -p path1 -p path2. Required parameter when specifying application for the log source. Wildcards such as /var/log/*.log are accepted but recursive globs such are /var/log/**/test.log are not.

--port PORT

The port of the log collector. If you do not specify a port, the default port for the ingestion endpoint is used for ibm (deprecated) and 514 is used for syslog.

-q

Do not show the message of the day or update reminders.

--skip-validation

Skips validation of the org and space names when they are specified. This can result in a broken logging config if the values are invalid but will take less time to process.

--space SPACE

Deprecated The space name to send logs to. This flag is only valid when the logging type is ibm. The space name is required when you specify an org name. If you do not specify a space name, then logs are forwarded at the account level.

--syslog-protocol PROTOCOL

When the logging type is syslog, the transport layer protocol. Supported values are tls, tcp and the default udp. When forwarding to an rsyslog server with the UDP protocol, logs that are over 1KB are truncated.

--type TYPE

The log forwarding protocol that you want to use. The only supported value is syslog.

--verify-mode MODE

When the logging type is syslog and the protocol is tls, the verification mode. Supported values are verify-peer and the default verify-none.

Examples

Update a log forwarding configuration for a cluster.

ibmcloud ks logging config update \
  --org ORG \
  --space SPACE \
  -C C \
  -p POOL_NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --id <_id> \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--container CONTAINER

The name of the container from which you want to filter out logs. This flag applies only when you are using log type container.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--lc LOGGING-CONFIG, --logging-config LOGGING-CONFIG

A logging configuration ID. If not provided, the filter is applied to all the cluster logging configurations that are passed to the filter. You can view log configurations that match the filter by using the --show-matching-configs flag with the command.

--level LEVEL

Filters out logs that are at the specified level and less. Acceptable values in their canonical order are fatal, error, warn/warning, info, debug, and trace. As an example, if you filtered logs at the info level, debug, and trace are also filtered. Note: You can use this flag only when log messages are in JSON format and contain a level field. Example output: {"log": "hello", "level": "info"}

--message MESSAGE

Filters out any logs that contain a specified message anywhere in the log. The message is matched literally and not as an expression. Example: The messages "Hello", "!", and "Hello, World!", would apply to the log "Hello, World!".

--namespace NAMESPACE, -n NAMESPACE

The Kubernetes namespace from which you want to filter logs.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--regex-message MESSAGE

Filters out any logs that contain a specified message regex pattern in the log. The message is matched as a regular expression. Example: The pattern "hello [0-9]" would apply to "hello 1", "hello 2", "hello 9"

--type TYPE

The type of logs that you want to apply the filter to. Currently all, container, and host are supported.

Examples

Filter out logs that are forwarded by your logging configuration.

ibmcloud ks logging filter create \
  --cluster CLUSTER_NAME_OR_ID \
  --type TYPE \
  --namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--id ID

Specify the ID of the logging filter.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-covering-filters

Show the logging filters that render previous filters obsolete.

--show-matching-configs

Show the logging configurations that match the configuration that you're viewing.

Examples

View a logging filter configuration.

ibmcloud ks logging filter get \
  --cluster CLUSTER_NAME_OR_ID \
  --id <_id> \
  --show-matching-configs SHOW-MATCHING-CONFIGS

Command options

--all

Delete all log forwarding filters.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id ID

Specify the ID of the logging filter.

-q

Do not show the message of the day or update reminders.

Examples

Delete a logging filter.

ibmcloud ks logging filter rm --cluster CLUSTER_NAME_OR_ID --id FILTER_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--container CONTAINER

The name of the container from which you want to filter out logs. This flag applies only when you are using log type container.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

--id ID

Specify the ID of the logging filter.

--lc LOGGING-CONFIG, --logging-config LOGGING-CONFIG

A logging configuration ID. If not provided, the filter is applied to all the cluster logging configurations that are passed to the filter. You can view log configurations that match the filter by using the --show-matching-configs flag with the command.

--level LEVEL

Filters out logs that are at the specified level and less. Acceptable values in their canonical order are fatal, error, warn/warning, info, debug, and trace. As an example, if you filtered logs at the info level, debug, and trace are also filtered. Note: You can use this flag only when log messages are in JSON format and contain a level field. Example output: {"log": "hello", "level": "info"}

--message MESSAGE

Filters out any logs that contain a specified message anywhere in the log. The message is matched literally and not as an expression. Example: The messages "Hello", "!", and "Hello, World!", would apply to the log "Hello, World!".

--namespace NAMESPACE, -n NAMESPACE

The Kubernetes namespace from which you want to filter logs.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--regex-message MESSAGE

Filters out any logs that contain a specified message regex pattern in the log. The message is matched as a regular expression. Example: The pattern "hello [0-9]" would apply to "hello 1", "hello 2", "hello 9"

--type TYPE

The type of logs that you want to apply the filter to. Currently all, container, and host are supported.

Examples

Update a logging filter.

ibmcloud ks logging filter update --cluster CLUSTER_NAME_OR_ID --id FILTER_ID --type TYPE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--force-update

Force an update of the Fluentd pods in the cluster to the latest version.

-q

Do not show the message of the day or update reminders.

Examples

Refresh the logging configuration for a cluster.

ibmcloud ks logging refresh \
  --cluster CLUSTER_NAME_OR_ID \
  --force-update FORCE-UPDATE \
  -q

Command options

-q

Do not show the message of the day or update reminders.

Examples

View the current user messages.

ibmcloud sat messages -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Add an NLB IP to an existing host name that you created with ibmcloud ks nlb-dns create.

ibmcloud ks nlb-dns add \
  --cluster CLUSTER_NAME_OR_ID \
  --ip IP_ADDRESS \
  --nlb-host HOSTNAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace NAMESPACE

The namespace that the SSL secret is created in. If this flag is not specified, the secret is created in default.

Examples

Create a DNS host name to register one or more NLB IPs in a classic cluster.

ibmcloud ks nlb-dns create classic \
  --cluster CLUSTER_NAME_OR_ID \
  --ip IP_ADDRESS \
  --secret-namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

One or more NLB IP addresses. To see load balancer IPs, run kubectl get svc -n <namespace>.

--lb-host HOST

The VPC load balancer host name. To see load balancer host names, run kubectl get svc -n <namespace>.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secret-namespace NAMESPACE

The namespace that the SSL secret is created in. If this flag is not specified, the secret is created in default.

Examples

Create a DNS record to register a load balancer host name or load balancer IP addresses in a VPC cluster.

ibmcloud ks nlb-dns create vpc-gen2 \
  --cluster CLUSTER_NAME_OR_ID \
  --lb-host HOSTNAME \
  --secret-namespace NAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--nlb-subdomain SUBDOMAIN

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the details of a registered NLB host name in a cluster.

ibmcloud ks nlb-dns get \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-subdomain DOMAIN \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List the registered NLB host names and IP addresses in a cluster.

ibmcloud ks nlb-dns ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--enable

Enable the health check monitor for the host name.

--header HEADER

HTTP request headers for the health check are limited to the Host header. This flag is valid only for type HTTP or HTTPS. This flag accepts values in the following format: --header Header-Name=value. When updating a monitor, the existing headers are replaced by the ones you specify. To delete all existing headers specify the flag with an empty value --header "".

--interval INTERVAL

The interval, in seconds, between each health check. Short intervals might improve failover time but increase load on the IPs. Must be in the range [60, 300]. Default: 60

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--path PATH

The endpoint path to health check against. This flag is valid only for type HTTP or HTTPS. Default: /

--port PORT

The port number to connect to for the health check. When type is TCP, this flag is required. When type is HTTP or HTTPS, use this flag only for ports other than 80 for HTTP or 443 for HTTPS. HTTP default: 80. HTTPS default: 443.

-q

Do not show the message of the day or update reminders.

--timeout TIMEOUT

The timeout, in seconds, before the IP is considered unhealthy. Must be in the range [1, 60]. Default: 5

--type TYPE

The protocol to use for the health check. Accepted values: http, https, tcp

Examples

Configure a health check monitor for an existing NLB host name in a cluster.

ibmcloud ks nlb-dns monitor configure \
  --port PORT \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-host HOSTNAME \
  --type TYPE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Disable an existing health check monitor for a NLB host name in a cluster.

ibmcloud ks nlb-dns monitor disable \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-host HOSTNAME \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Enable a health check monitor for an NLB host name in a cluster.

ibmcloud ks nlb-dns monitor enable \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-host HOSTNAME \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

View the settings for an existing health check monitor.

ibmcloud ks nlb-dns monitor get \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-host HOSTNAME \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List the health check monitor settings for each NLB host name in a cluster.

ibmcloud ks nlb-dns monitor ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--lb-host HOST

The VPC load balancer host name. To see load balancer host names, run kubectl get svc -n <namespace>.

--nlb-subdomain SUBDOMAIN

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Update an existing DNS host name by replacing the load balancer hostname associated with it in a VPC cluster.

ibmcloud ks nlb-dns replace \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-subdomain DOMAIN \
  --lb-host HOSTNAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

One NLB IP address. To see NLB IPs associated with the host name, run ibmcloud ks nlb-dns ls.

--nlb-host HOST

The host name. To see existing host names, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove an NLB IP address from an NLB host name.

ibmcloud ks nlb-dns rm classic \
  --cluster CLUSTER_NAME_OR_ID \
  --ip IP_ADDRESS \
  --nlb-host HOSTNAME

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--ip IP

One NLB IP address. To see NLB IPs associated with the host name, run ibmcloud ks nlb-dns ls.

--nlb-subdomain SUBDOMAIN

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Remove a load balancer host name or IP address from a DNS record in a VPC cluster.

ibmcloud ks nlb-dns rm vpc-gen2 \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-subdomain DOMAIN \
  --ip IP_ADDRESS

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--nlb-subdomain SUBDOMAIN

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Regenerate the certificate and secret for an NLB subdomain.

ibmcloud ks nlb-dns secret regenerate \
  --cluster CLUSTER_NAME_OR_ID \
  --nlb-subdomain DOMAIN \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--nlb-subdomain SUBDOMAIN

The subdomain. To see existing subdomains, run ibmcloud ks nlb-dns ls.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

Delete a secret from an NLB subdomain and prevent future renewal of the certificate.

ibmcloud ks nlb-dns secret rm --cluster CLUSTER_NAME_OR_ID --nlb-subdomain DOMAIN -f

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

Examples

List all quota and limits for cluster-related resources in your IBM Cloud account.

ibmcloud ks quota ls --output json --provider PROVIDER_ID -q

Command options

--in-place FILE FILE

Rewrite the source file with the updated command structure.

-q

Do not show the message of the day or update reminders.

Examples

Rewrite scripts that call IBM Cloud Kubernetes Service plug-in commands.

ibmcloud ks script update --in-place IN-PLACE -q

Command options

--attached-to ATTACHED

Filter the security groups by the components they are attached to. Accepted values: cluster, load-balancer, vpc, vpe-gateway, worker-pool

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--managed-by MANAGER

Specify user to return the security groups created by user. Specify ibm to return only the security groups managed by IBM. Accepted values: ibm, user

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--scope SCOPE

Specify cluster to return security groups scoped to the cluster. Specify vpc to return security groups scoped to the entire VPC. Accepted values: cluster, vpc

Examples

List all security groups associated with a cluster.

ibmcloud ks security-group ls \
  --cluster CLUSTER_NAME_OR_ID \
  --attached-to ATTACHED-TO \
  --scope SCOPE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--security-group GROUP, --sg GROUP

Specify security group ID.

Examples

Deletes all existing security group rules, and reapplies default rules.

ibmcloud ks security-group reset \
  --cluster CLUSTER_NAME_OR_ID \
  --security-group GROUP \
  -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--security-group GROUP, --sg GROUP

Specify security group ID.

Examples

Reapplies default security group rules that do not exist.

ibmcloud ks security-group sync --cluster CLUSTER_NAME_OR_ID --security-group GROUP -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--volume VOLUME

Specify the volume ID. To list available volumes, run ibmcloud ks storage volume ls.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Attach a storage volume to a worker node.

ibmcloud ks storage attachment create \
  --cluster CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --volume VOLUME

Command options

--attachment ATTACHMENT

Specify the volume attachment ID. To list available attachments, run ibmcloud ks storage attachment ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Get the details of a volume attachment in a cluster.

ibmcloud ks storage attachment get \
  --cluster CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --attachment ATTACHMENT

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

List all storage volume attachments of a worker in a cluster.

ibmcloud ks storage attachment ls \
  --cluster CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --output json

Command options

--attachment ATTACHMENT

Specify the volume attachment ID. To list available attachments, run ibmcloud ks storage attachment ls.

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Delete a volume attachment from a worker node.

ibmcloud ks storage attachment rm \
  --cluster CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --attachment ATTACHMENT

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--volume VOLUME

Specify the volume ID. To list available volumes, run ibmcloud ks storage volume ls.

Examples

Get the details of a volume.

ibmcloud ks storage volume get --volume VOLUME --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

Filter the list for a specific infrastructure provider. Accepted values: classic, vpc-classic, vpc-gen2, satellite

-q

Do not show the message of the day or update reminders.

--zone ZONE

A zone to filter for. To list available zones, run ibmcloud ks locations.

Examples

List the details of volumes.

ibmcloud ks storage volume ls \
  --cluster CLUSTER_NAME_OR_ID \
  --provider PROVIDER_ID \
  --zone ZONE

Command options

-l LOCATION, --location LOCATION

A location to filter for. To list available locations, run ibmcloud ks locations.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

Filter the list for a specific infrastructure provider. Available options: classic, vpc-classic, vpc-gen2

-q

Do not show the message of the day or update reminders.

--vpc-id ID

Required for provider types vpc-classic and vpc-gen2: The ID of the VPC to list subnets for. To list VPC IDs, run ibmcloud ks vpcs.

--zone ZONE

Required for provider types vpc-classic and vpc-gen2: The zone to list VPC subnets for. To list available zones, run ibmcloud ks zone ls --provider vpc-classic|vpc-gen2.

Examples

List available portable subnets in your IBM Cloud infrastructure account.

ibmcloud ks subnets \
  --vpc-id VPC_ID \
  --zone ZONE \
  --output json \
  --provider PROVIDER_ID \
  -l L

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-version VERSION

Show only the versions for the specified container platform. Accepted values: OpenShift, Kubernetes

Examples

List all the container platform versions that are available for IBM Cloud Kubernetes Service clusters.

ibmcloud ks versions --output json --show-version VERSION -q

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

List available public and private VLANs for a zone.

ibmcloud ks vlan ls --zone ZONE --output json -q

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--region REGION

Specify the region to target. If a region is not already targeted, this argument must be specified. To check if a region is targeted, run ibmcloud target.

Examples

View the VLAN spanning status for your IBM Cloud classic infrastructure account.

ibmcloud ks vlan spanning get --output json --region REGION -q

Command options

--auto-delete

Automatically delete the VNI when it is removed from the cluster.

--cluster-id ID, -c ID

The ID of the cluster.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vlan VLAN

The VLAN ID for the bare metal node attachment. Must be unique for each VPC subnet. Multiple VNIs from the same subnet can reuse the VLAN ID. Valid range: 1-500.

--vni VNI

The ID of the Virtual Network Interface to attach. You must specify VNIs without any current target resource. To list all the VNIs, run ibmcloud is vnis. To check if a specific VNI is already attached to a resource, check for the "Target" field in 'ibmcloud is vni <VNI_ID>.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

Attach a Virtual Network Interface to a bare metal worker node or cluster.

ibmcloud ks vni attach baremetal \
  --cluster-id CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --vni VNI

Command options

--cluster-id ID, -c ID

The ID of the cluster.

-f

Force the command to run without user prompts.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--vni VNI

The ID of the Virtual Network Interface to detach.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

Detach a Virtual Network Interface from a worker node or cluster.

ibmcloud ks vni detach --cluster-id CLUSTER_NAME_OR_ID --worker WORKER_ID --vni VNI

Command options

--after AFTER

Show Virtual Network Interfaces after the given cursor.

--cluster-id ID, -c ID

The ID of the cluster.

--first FIRST

View the next Virtual Network Interfaces, up to the first number of VNIs.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

The ID of the worker node.

Examples

List Virtual Network Interfaces attached to a cluster.

ibmcloud ks vni ls --cluster-id ID

List Virtual Network Interfaces attached to a worker node.

ibmcloud ks vni ls --worker WORKER

Command options

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

--provider PROVIDER

The VPC infrastructure provider type. Supported values are vpc-classic and vpc-gen2. By default, VPCs of all provider types are returned.

-q

Do not show the message of the day or update reminders.

Examples

List all VPCs in the targeted resource group.

ibmcloud ks vpc ls --provider PROVIDER_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Disable outbound traffic protection for a Secure By Default VPC cluster.

ibmcloud ks vpc outbound-traffic-protection disable --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable outbound traffic protection for a Secure By Default VPC cluster.

ibmcloud ks vpc outbound-traffic-protection enable --cluster CLUSTER_NAME_OR_ID -f -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--disable-outbound-traffic-protection

Include this option to allow public outbound access from the cluster workers. By default, public outbound access is blocked.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

Examples

Enable Secure By Default VPC Networking for a VPC cluster using legacy Security Groups.

ibmcloud ks vpc secure-by-default enable \
  --cluster CLUSTER_NAME_OR_ID \
  -f \
  --disable-outbound-traffic-protection DISABLE-OUTBOUND-TRAFFIC-PROTECTION

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--level LEVEL

Set the notification level. Accepted values are Normal or Warning. The default is Warning.

-q

Do not show the message of the day or update reminders.

--type TYPE

The type of webhook that you want to use. Currently slack is supported.

--url URL

The webhook URL.

Examples

Register a webhook in a cluster.

ibmcloud ks webhook-create --cluster CLUSTER_NAME_OR_ID --type TYPE --url URL

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

View the details of a worker node.

ibmcloud ks worker get --cluster CLUSTER_NAME_OR_ID --worker WORKER_ID --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--show-delete-reason

Show the reason for worker node deletion.

--show-deleted

Show worker nodes that were deleted from the cluster.

--show-pools

See the worker pool that each worker belongs to.

--worker-pool POOL, -p POOL

Show only worker nodes that belong to the worker pool you specify.

Examples

List all worker nodes in a cluster.

ibmcloud ks worker ls \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  --show-pools

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--hard

Force a hard restart of a worker node by cutting off power to the worker node. Use this option if the worker node is unresponsive or the worker node has a Docker hang.

-q

Do not show the message of the day or update reminders.

--skip-master-health

Skips checking of master health before initiating action.

--worker WORKER, -w WORKER

Specify one or more worker IDs.

Examples

Restart a worker node.

ibmcloud ks worker reboot \
  --cluster CLUSTER_NAME_OR_ID \
  --hard HARD \
  --skip-master-health IP_ADDRESS

Command options

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--skip-master-health

Skips checking of master health before initiating action.

--worker WORKER, -w WORKER

Specify one or more worker IDs.

Examples

Delete the data, reimage, and reinstall Kubernetes with the latest patch version on one or more worker nodes.

ibmcloud ks worker reload --skip-master-health IP_ADDRESS -f --worker WORKER_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--update

Update the worker node to the same major and minor version of the master and the latest patch. Also updates the operating system if the worker pool operating system has been updated.

--worker WORKER, -w WORKER

Specify the worker ID. To list available workers, run ibmcloud ks workers.

Examples

Delete a worker node and replace it with a new worker node in the same worker pool.

ibmcloud ks worker replace \
  --cluster CLUSTER_NAME_OR_ID \
  --worker WORKER_ID \
  --update UPDATE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify one or more worker IDs.

Examples

Remove a worker node from a cluster.

ibmcloud ks worker rm --cluster CLUSTER_NAME_OR_ID -f --worker WORKER_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker WORKER, -w WORKER

Specify one or more worker IDs.

Examples

Update one or more worker nodes in a classic cluster to a new Kubernetes version.

ibmcloud ks worker update --cluster CLUSTER_NAME_OR_ID -f --worker WORKER_ID

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--disable-disk-encrypt

Disable encryption on a worker node.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--hardware HARDWARE

The level of hardware isolation for your worker node. Use dedicated to have available physical resources dedicated to you only, or shared to allow physical resources to be shared with other IBM customers. For IBM Cloud Public accounts, the default value is shared. For IBM Cloud Dedicated accounts, dedicated is the only available option.

--label LABEL, -l LABEL

Sets labels on all the workers in the worker pool.

--name NAME

Enter a name for the worker pool.

--operating-system SYSTEM

Specify the name of the operating system.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--size-per-zone SIZE

Specify the desired number of workers per zone in this worker pool.

Examples

Add a worker pool to a classic cluster.

ibmcloud ks worker-pool create classic \
  --name NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --size-per-zone ZONE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--host-label LABEL, --hl LABEL

Enter any labels as key-value pairs to identify the host to assign to your Satellite control plane or Red Hat OpenShift cluster. The first host that has this label and is unassigned is automatically assigned to the control plane or cluster. To find available host labels, run ibmcloud sat host get --host <host_name_or_ID> --location <location_name_or_ID>.

--label LABEL, -l LABEL

Sets labels on all the workers in the worker pool.

--name NAME

Enter a name for the worker pool.

--operating-system SYSTEM

Specify the name of the operating system.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--size-per-zone SIZE

Specify the desired number of workers per zone in this worker pool.

--zone ZONE

Specify the zone for the worker pool in a multizone cluster. To list available zones, run ibmcloud ks zone ls.

Examples

Add a worker pool to an IBM Cloud Satellite cluster.

ibmcloud ks worker-pool create satellite \
  --name NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --zone ZONE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--label LABEL, -l LABEL

Sets labels on all the workers in the worker pool.

--name NAME

Enter a name for the worker pool.

--operating-system SYSTEM

Specify the name of the operating system.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--size-per-zone SIZE

Specify the desired number of workers per zone in this worker pool.

--vpc-id ID

The ID of the VPC in which to create the worker nodes, which must match the VPC that the cluster is in. To list the cluster's VPC ID, run ibmcloud ks cluster get -c <cluster_name_or_ID>. If this flag is not provided, then the worker pool defaults to the VPC ID of existing worker pools in the cluster.

Examples

Add a worker pool to a VPC Gen 1 cluster.

ibmcloud ks worker-pool create vpc-classic \
  --name NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --flavor FLAVOR

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--crk CRK

The ID of the root key in your KMS instance to use for local disk encryption. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance>.

--disable-disk-encrypt

Disable encryption on a worker node.

--entitlement ENTITLEMENT

Set this flag to ocp_entitled only if you use this cluster with a license such as a Cloud Pak that has an OpenShift entitlement.

--flavor FLAVOR

The flavor of a worker node. To see available flavors, run ibmcloud ks flavor ls --zone <zone name> (for public IBM Cloud accounts) or ibmcloud ks flavor ls (for IBM Cloud Dedicated accounts).

--kms-account-id ID

The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--kms-instance INSTANCE

The ID of the KMS instance to use for local disk encryption. To list available KMS instances, run ibmcloud ks kms instance ls.

--label LABEL, -l LABEL

Sets labels on all the workers in the worker pool.

--name NAME

Enter a name for the worker pool.

--operating-system SYSTEM

Specify the name of the operating system.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--secondary-storage STORAGE

The secondary storage option for the flavor. To view the secondary storage options that are available for a flavor, run ibmcloud ks flavor get --provider vpc-gen2 --zone <zone name>.

--security-group GROUP

Optional. Specify up to five security group IDs to apply to all workers in the worker pool.

--size-per-zone SIZE

Specify the desired number of workers per zone in this worker pool.

--vpc-id ID

The ID of the VPC in which to create the worker nodes, which must match the VPC that the cluster is in. To list the cluster's VPC ID, run ibmcloud ks cluster get -c <cluster_name_or_ID>. If this flag is not provided, then the worker pool defaults to the VPC ID of existing worker pools in the cluster.

Examples

Add a worker pool to a VPC Gen 2 cluster.

ibmcloud ks worker-pool create vpc-gen2 \
  --name NAME \
  --cluster CLUSTER_NAME_OR_ID \
  --flavor FLAVOR

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

List the details of a worker pool.

ibmcloud ks worker-pool get \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  --output json

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Remove all custom Kubernetes labels from all worker nodes in a worker pool.

ibmcloud ks worker-pool label rm \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

--label LABEL, -l LABEL

Set custom Kubernetes labels in the format key=value for all the worker nodes in the worker pool. For multiple labels, repeat this flag. To keep any existing custom labels on the worker pool, include those labels with this flag.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Set custom Kubernetes labels for all worker nodes in a worker pool.

ibmcloud ks worker-pool label set \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  --label <key=value>

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--output OUTPUT

Prints the command output in the provided format. Accepted values: json

-q

Do not show the message of the day or update reminders.

Examples

List all worker pools in a cluster.

ibmcloud ks worker-pool ls --cluster CLUSTER_NAME_OR_ID --output json -q

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

--operating-system SYSTEM

Specify the name of the operating system.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Set the operating system.

ibmcloud ks worker-pool operating-system set \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  --operating-system OS

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Rebalance a worker pool in a cluster.

ibmcloud ks worker-pool rebalance \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-q

Do not show the message of the day or update reminders.

--size-per-zone SIZE

Specify the desired number of workers per zone in this worker pool.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Resize the worker pool to the number of workers per zone that you specify.

ibmcloud ks worker-pool resize \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  --size-per-zone ZONE

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Remove a worker pool from a cluster.

ibmcloud ks worker-pool rm --cluster CLUSTER_NAME_OR_ID --worker-pool POOL_NAME -f

Command options

--cluster CLUSTER, -c CLUSTER

Specify the cluster name or ID.

-f

Force the command to run without user prompts.

-q

Do not show the message of the day or update reminders.

--worker-pool POOL, -p POOL

Specify a worker pool.

Examples

Remove all Kubernetes taints from all worker nodes in a worker pool.

ibmcloud ks worker-pool taint rm \
  --cluster CLUSTER_NAME_OR_ID \
  --worker-pool POOL_NAME \
  -f