# kubeadm init phase

kubeadm init phasekubeadm init phase enables you to invoke atomic steps of the bootstrap process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm init phase is consistent with the kubeadm init workflow, and behind the scene both use the same code.kubeadm init phase preflightUsing this command you can execute preflight checks on a control-plane node.SynopsisRun pre-flight checks for kubeadm init.kubeadm init phase preflight [flags] Examples # Run pre-flight checks for kubeadm init using a config file. kubeadm init phase preflight --config kubeadm-config.yaml Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images fromOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase kubelet-startThis phase will write the kubelet configuration file and environment file and then start the kubelet.Write kubelet settings and (re)start the kubeletSynopsisWrite a file with KubeletConfiguration and an environment file with node specific kubelet settings, and then (re)start kubelet.kubeadm init phase kubelet-start [flags] Examples # Writes a dynamic environment file with kubelet flags from a InitConfiguration file. kubeadm init phase kubelet-start --config config.yaml Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubelet-start--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--node-name stringSpecify the node name.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase certsCan be used to create all required certificates by kubeadm.SynopsisCertificate generationkubeadm init phase certs [flags] Options-h, --helphelp for certsOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate all certificateskubeadm init phase certs all [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-cert-extra-sans stringsOptional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for all--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.--service-dns-domain string Default: "cluster.local"Use alternative domain for services, e.g. "myorg.internal".Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the self-signed Kubernetes CA to provision identities for other Kubernetes components, and save them into ca.crt and ca.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs ca [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for ca--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for serving the Kubernetes API, and save them into apiserver.crt and apiserver.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs apiserver [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-cert-extra-sans stringsOptional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for apiserver--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.--service-dns-domain string Default: "cluster.local"Use alternative domain for services, e.g. "myorg.internal".Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for the API server to connect to kubelet, and save them into apiserver-kubelet-client.crt and apiserver-kubelet-client.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs apiserver-kubelet-client [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for apiserver-kubelet-client--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the self-signed CA to provision identities for front proxy, and save them into front-proxy-ca.crt and front-proxy-ca.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs front-proxy-ca [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for front-proxy-ca--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for the front proxy client, and save them into front-proxy-client.crt and front-proxy-client.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs front-proxy-client [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for front-proxy-client--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the self-signed CA to provision identities for etcd, and save them into etcd/ca.crt and etcd/ca.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs etcd-ca [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for etcd-ca--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for serving etcd, and save them into etcd/server.crt and etcd/server.key files.Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs etcd-server [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for etcd-server--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for etcd nodes to communicate with each other, and save them into etcd/peer.crt and etcd/peer.key files.Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs etcd-peer [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for etcd-peer--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate for liveness probes to healthcheck etcd, and save them into etcd/healthcheck-client.crt and etcd/healthcheck-client.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs etcd-healthcheck-client [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for etcd-healthcheck-client--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificate the apiserver uses to access etcd, and save them into apiserver-etcd-client.crt and apiserver-etcd-client.key files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs apiserver-etcd-client [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for apiserver-etcd-client--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Generate a private key for signing service account tokens along with its public keySynopsisGenerate the private key for signing service account tokens along with its public key, and save them into sa.key and sa.pub files.If both files already exist, kubeadm skips the generation step and existing files will be used.kubeadm init phase certs sa [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for sa--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase kubeconfigYou can create all required kubeconfig files by calling the all subcommand or call them individually.SynopsisGenerate all kubeconfig files necessary to establish the control plane and the admin kubeconfig filekubeadm init phase kubeconfig [flags] Options-h, --helphelp for kubeconfigOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate all kubeconfig fileskubeadm init phase kubeconfig all [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for all--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--node-name stringSpecify the node name.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Generate a kubeconfig file for the admin to use and for kubeadm itselfSynopsisGenerate the kubeconfig file for the admin and for kubeadm itself, and save it to admin.conf file.kubeadm init phase kubeconfig admin [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for admin--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Generate a kubeconfig file for the kubelet to use only for cluster bootstrapping purposesSynopsisGenerate the kubeconfig file for the kubelet to use and save it to kubelet.conf file.Please note that this should only be used for cluster bootstrapping purposes. After your control plane is up, you should request all kubelet credentials from the CSR API.kubeadm init phase kubeconfig kubelet [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubelet--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--node-name stringSpecify the node name.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Generate a kubeconfig file for the controller manager to useSynopsisGenerate the kubeconfig file for the controller manager to use and save it to controller-manager.conf filekubeadm init phase kubeconfig controller-manager [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for controller-manager--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Generate a kubeconfig file for the scheduler to useSynopsisGenerate the kubeconfig file for the scheduler to use and save it to scheduler.conf file.kubeadm init phase kubeconfig scheduler [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for scheduler--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate a kubeconfig file for the super-admin, and save it to super-admin.conf file.kubeadm init phase kubeconfig super-admin [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for super-admin--kubeconfig-dir string Default: "/etc/kubernetes"The path where to save the kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase control-planeUsing this phase you can create all required static Pod files for the control plane components.SynopsisGenerate all static Pod manifest files necessary to establish the control planekubeadm init phase control-plane [flags] Options-h, --helphelp for control-planeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate all static Pod manifest fileskubeadm init phase control-plane all [flags] Examples # Generates all static Pod manifest files for control plane components, # functionally equivalent to what is generated by kubeadm init. kubeadm init phase control-plane all # Generates all static Pod manifest files using options read from a configuration file. kubeadm init phase control-plane all --config config.yaml Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.--feature-gates stringA set of key=value pairs that describe feature gates for various features. Options are:ControlPlaneKubeletLocalMode=true|false (BETA - default=true)NodeLocalCRISocket=true|false (BETA - default=true)PublicKeysECDSA=true|false (DEPRECATED - default=false)RootlessControlPlane=true|false (ALPHA - default=false)WaitForAllControlPlaneComponents=true|false (default=true)-h, --helphelp for all--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.--pod-network-cidr stringSpecify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerates the kube-apiserver static Pod manifestkubeadm init phase control-plane apiserver [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.--feature-gates stringA set of key=value pairs that describe feature gates for various features. Options are:ControlPlaneKubeletLocalMode=true|false (BETA - default=true)NodeLocalCRISocket=true|false (BETA - default=true)PublicKeysECDSA=true|false (DEPRECATED - default=false)RootlessControlPlane=true|false (ALPHA - default=false)WaitForAllControlPlaneComponents=true|false (default=true)-h, --helphelp for apiserver--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerates the kube-controller-manager static Pod manifestkubeadm init phase control-plane controller-manager [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for controller-manager--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.--pod-network-cidr stringSpecify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerates the kube-scheduler static Pod manifestkubeadm init phase control-plane scheduler [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for scheduler--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase etcdUse the following phase to create a local etcd instance based on a static Pod file.SynopsisGenerate static Pod manifest file for local etcdkubeadm init phase etcd [flags] Options-h, --helphelp for etcdOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the static Pod manifest file for a local, single-node local etcd instancekubeadm init phase etcd local [flags] Examples # Generates the static Pod manifest file for etcd, functionally # equivalent to what is generated by kubeadm init. kubeadm init phase etcd local # Generates the static Pod manifest file for etcd using options # read from a configuration file. kubeadm init phase etcd local --config config.yaml Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for local--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase upload-configYou can use this command to upload the kubeadm configuration to your cluster. Alternatively, you can use kubeadm config.SynopsisUpload the kubeadm and kubelet configuration to a ConfigMapkubeadm init phase upload-config [flags] Options-h, --helphelp for upload-configOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisUpload all configuration to a config mapkubeadm init phase upload-config all [flags] Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for all--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisUpload the kubeadm ClusterConfiguration to a ConfigMap called kubeadm-config in the kube-system namespace. This enables correct configuration of system components and a seamless user experience when upgrading.Alternatively, you can use kubeadm config.kubeadm init phase upload-config kubeadm [flags] Examples # upload the configuration of your cluster kubeadm init phase upload-config kubeadm --config=myConfig.yaml Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubeadm--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Upload the kubelet component config to a ConfigMapSynopsisUpload the kubelet configuration extracted from the kubeadm InitConfiguration object to a kubelet-config ConfigMap in the clusterkubeadm init phase upload-config kubelet [flags] Examples # Upload the kubelet configuration from the kubeadm Config file to a ConfigMap in the cluster. kubeadm init phase upload-config kubelet --config kubeadm.yaml Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubelet--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase upload-certsUse the following phase to upload control-plane certificates to the cluster. By default the certs and encryption key expire after two hours.Upload certificates to kubeadm-certsSynopsisUpload control plane certificates to the kubeadm-certs Secretkubeadm init phase upload-certs [flags] Options--certificate-key stringKey used to encrypt the control-plane certificates in the kubeadm-certs Secret. The certificate key is a hex encoded string that is an AES key of size 32 bytes.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for upload-certs--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.--skip-certificate-key-printDon't print the key used to encrypt the control-plane certificates.--upload-certsUpload control-plane certificates to the kubeadm-certs Secret.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase mark-control-planeUse the following phase to label and taint the node as a control plane node.SynopsisMark a node as a control-planekubeadm init phase mark-control-plane [flags] Examples # Applies control-plane label and taint to the current node, functionally equivalent to what executed by kubeadm init. kubeadm init phase mark-control-plane --config config.yaml # Applies control-plane label and taint to a specific node kubeadm init phase mark-control-plane --node-name myNode Options--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for mark-control-plane--node-name stringSpecify the node name.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase bootstrap-tokenUse the following phase to configure bootstrap tokens.Generates bootstrap tokens used to join a node to a clusterSynopsisBootstrap tokens are used for establishing bidirectional trust between a node joining the cluster and a control-plane node.This command makes all the configurations required to make bootstrap tokens works and then creates an initial token.kubeadm init phase bootstrap-token [flags] Examples # Make all the bootstrap token configurations and create an initial token, functionally # equivalent to what generated by kubeadm init. kubeadm init phase bootstrap-token Options--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for bootstrap-token--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.--skip-token-printSkip printing of the default bootstrap token generated by 'kubeadm init'.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase kubelet-finalizeUse the following phase to update settings relevant to the kubelet after TLS bootstrap. You can use the all subcommand to run all kubelet-finalize phases.SynopsisUpdates settings relevant to the kubelet after TLS bootstrapkubeadm init phase kubelet-finalize [flags] Examples # Updates settings relevant to the kubelet after TLS bootstrap" kubeadm init phase kubelet-finalize all --config Options-h, --helphelp for kubelet-finalizeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisRun all kubelet-finalize phaseskubeadm init phase kubelet-finalize all [flags] Examples # Updates settings relevant to the kubelet after TLS bootstrap" kubeadm init phase kubelet-finalize all --config Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for allOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisEnable kubelet client certificate rotationkubeadm init phase kubelet-finalize enable-client-cert-rotation [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path where to save and store the certificates.--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for enable-client-cert-rotationOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm init phase addonYou can install all the available addons with the all subcommand, or install them selectively.SynopsisInstall required addons for passing conformance testskubeadm init phase addon [flags] Options-h, --helphelp for addonOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisInstall all the addonskubeadm init phase addon all [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.--feature-gates stringA set of key=value pairs that describe feature gates for various features. Options are:ControlPlaneKubeletLocalMode=true|false (BETA - default=true)NodeLocalCRISocket=true|false (BETA - default=true)PublicKeysECDSA=true|false (DEPRECATED - default=false)RootlessControlPlane=true|false (ALPHA - default=false)WaitForAllControlPlaneComponents=true|false (default=true)-h, --helphelp for all--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--pod-network-cidr stringSpecify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.--service-dns-domain string Default: "cluster.local"Use alternative domain for services, e.g. "myorg.internal".Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Install the CoreDNS addon to a Kubernetes clusterSynopsisInstall the CoreDNS addon components via the API server. Please note that although the DNS server is deployed, it will not be scheduled until CNI is installed.kubeadm init phase addon coredns [flags] Options--config stringPath to a kubeadm configuration file.--dry-runDon't apply any changes; just output what would be done.--feature-gates stringA set of key=value pairs that describe feature gates for various features. Options are:ControlPlaneKubeletLocalMode=true|false (BETA - default=true)NodeLocalCRISocket=true|false (BETA - default=true)PublicKeysECDSA=true|false (DEPRECATED - default=false)RootlessControlPlane=true|false (ALPHA - default=false)WaitForAllControlPlaneComponents=true|false (default=true)-h, --helphelp for coredns--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--print-manifestPrint the addon manifests to STDOUT instead of installing them--service-cidr string Default: "10.96.0.0/12"Use alternative range of IP address for service VIPs.--service-dns-domain string Default: "cluster.local"Use alternative domain for services, e.g. "myorg.internal".Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.Install the kube-proxy addon to a Kubernetes clusterSynopsisInstall the kube-proxy addon components via the API server.kubeadm init phase addon kube-proxy [flags] Options--apiserver-advertise-address stringThe IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443Port for the API Server to bind to.--config stringPath to a kubeadm configuration file.--control-plane-endpoint stringSpecify a stable IP address or DNS name for the control plane.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kube-proxy--image-repository string Default: "registry.k8s.io"Choose a container registry to pull control plane images from--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.--kubernetes-version string Default: "stable-1"Choose a specific Kubernetes version for the control plane.--pod-network-cidr stringSpecify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.--print-manifestPrint the addon manifests to STDOUT instead of installing themOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.For more details on each field in the v1beta4 configuration you can navigate to our API reference pages.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to revert any changes made to this host by kubeadm init or kubeadm joinkubeadm alpha to try experimental functionality