Skip to content

ksail cluster create

Create a Kubernetes cluster as defined by configuration.
Usage:
ksail cluster create [flags]
Flags:
--allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24
--cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)
--cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)
--cni CNI Container Network Interface (CNI) to use
-c, --context string Kubernetes context of cluster
--control-planes int32 Number of control-plane nodes (default 1)
--csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)
-d, --distribution Distribution Kubernetes distribution to use
--distribution-config string Configuration file for the distribution
--distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.
--drain-timeout duration Per-node pod-eviction budget for rolling node drains during cluster update (default 10m when unset). Increase it for stateful workloads that need longer to evict gracefully (e.g. Longhorn rebuilds, database failovers). On timeout the update aborts; re-run with --force-drain to delete pods bypassing PodDisruptionBudgets. Talos only.
-g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)
--import-images string Path to tar archive with container images to import after cluster creation but before component installation
-k, --kubeconfig string Path to kubeconfig file (default "~/.kube/config")
--kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.
--load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)
--local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)
--metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)
--mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'
-n, --name string Cluster name used for container names, registry names, and kubeconfig context
--node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)
--node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)
--oidc-ca-file string Path to CA certificate for self-signed OIDC providers
--oidc-client-id string OIDC client ID for kubectl authentication
--oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)
--oidc-groups-claim string JWT claim for Kubernetes groups (default "groups")
--oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default "oidc:")
--oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)
--oidc-username-claim string JWT claim for Kubernetes username (default "email")
--oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default "oidc:")
--policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)
-p, --provider Provider Infrastructure provider backend (e.g., Docker)
--ttl string Auto-destroy cluster after duration (e.g. 1h, 30m, 2h30m). If not set, cluster persists indefinitely.
--workers int32 Number of worker nodes
Global Flags:
--benchmark Show per-activity benchmark output
--config string Path to config file (default: ksail.yaml found via directory traversal)
--experimental Enable experimental (unstable) commands and features