az aks create
Create a new managed Kubernetes cluster. Azure CLI reference
199 options Its page in the Azure CLI reference
Options
Show its 199 options
--aad-admin-group-object-idsComma-separated list of aad group object IDs that will be set as cluster admin.--aad-tenant-idThe ID of an Azure Active Directory tenant.--aci-subnet-nameThe name of a subnet in an existing VNet into which to deploy the virtual nodes.--acns-advanced-networkpoliciesEnable advanced network policies (None, FQDN or L7) on a cluster when enabling advanced networking features with "--enable-acns".--acns-datapath-acceleration-modeSet the datapath acceleration mode for Azure Container Networking Solution (ACNS) Performance.--acns-transit-encryption-typeSet transit encryption type for ACNS security.--admin-username, -uUser account to create on node VMs for SSH access.--aks-custom-headersComma-separated key-value pairs to specify custom headers.--ampls-resource-idResource ID of Azure Monitor Private Link scope for Monitoring Addon.--api-server-authorized-ip-rangesComma-separated list of authorized apiserver IP ranges.--apiserver-subnet-idThe ID of a subnet in an existing VNet into which to assign control plane apiserver pods(requires --enable-apiserver-vnet-integration)--app-routing-default-nginx-controller, --ardncConfigure default nginx ingress controller type.--appgw-idResource Id of an existing Application Gateway to use with AGIC.--appgw-nameName of the application gateway to create/use in the node resource group.--appgw-subnet-cidrSubnet CIDR to use for a new subnet created to deploy the Application Gateway.--appgw-subnet-idResource Id of an existing Subnet used to deploy the Application Gateway.--appgw-watch-namespaceSpecify the namespace, which AGIC should watch.--assign-identitySpecify an existing user assigned identity for control plane's usage in order to manage cluster resource group.--assign-kubelet-identitySpecify an existing user assigned identity for kubelet's usage, which is typically used to pull image from ACR.--attach-acrGrant the 'acrpull' role assignment to the ACR specified by name or resource ID.--auto-upgrade-channelSpecify the upgrade channel for autoupgrade.--azure-keyvault-kms-key-idIdentifier of Azure Key Vault key.--azure-keyvault-kms-key-vault-network-accessNetwork Access of Azure Key Vault.--azure-keyvault-kms-key-vault-resource-idResource ID of Azure Key Vault.--azure-monitor-workspace-resource-idResource ID of the Azure Monitor Workspace--bootstrap-artifact-sourceConfigure artifact source when bootstraping the cluster.--bootstrap-container-registry-resource-idConfigure container registry resource ID.--client-secretSecret associated with the service principal.--cluster-autoscaler-profile, --ca-profileComma-separated list of key=value pairs for configuring cluster autoscaler.--container-storage-versionset azure container storage version, the latest version will be installed by default--crg-idThe crg id used to associate the new cluster with the existed Capacity Reservation Group resource.--custom-ca-trust-certificates, --ca-certsPath to a file containing up to 10 blank line separated certificates.--data-collection-settingsPath to JSON file containing data collection settings for Monitoring addon.--defender-configPath to JSON file containing Microsoft Defender profile configurations.--disable-acns-observabilityUsed to disable advanced networking observability features on a clusters when enabling advanced networking features with "--enable-acns".--disable-acns-securityUsed to disable advanced networking security features on a clusters when enabling advanced networking features with "--enable-acns".--disable-disk-driverDisable AzureDisk CSI Driver.--disable-file-driverDisable AzureFile CSI Driver.--disable-local-accountsIf set to true, getting static credential will be disabled for this cluster.--disable-opentelemetry-logs-tracesDisable the OpenTelemetry (OTLP) logs and traces receiver.--disable-opentelemetry-metricsDisable the OpenTelemetry (OTLP) metrics receiver.--disable-prometheus-metrics-scrapingDisable Prometheus metrics scraping by the Azure Monitor agent.--disable-public-fqdnDisable public fqdn feature for private cluster.--disable-rbacDisable Kubernetes Role-Based Access Control.--disable-run-commandDisable Run command feature for the cluster.--disable-snapshot-controllerDisable CSI Snapshot Controller.--dns-name-prefix, -pPrefix for hostnames that are created.--dns-service-ipAn IP address assigned to the Kubernetes DNS service.--docker-bridge-addressA specific IP address and netmask for the Docker bridge, using standard CIDR notation.--edge-zoneThe name of the Edge Zone.--enable-aadEnable managed AAD feature for cluster.--enable-acnsEnable advanced network functionalities on a cluster.--enable-addons, -aEnable the Kubernetes addons in a comma-separated list.--enable-ahubEnable Azure Hybrid User Benefits (AHUB) for Windows VMs.--enable-ai-toolchain-operatorEnable AI toolchain operator to the cluster.--enable-apiserver-vnet-integrationEnable integration of user vnet with control plane apiserver pods.--enable-app-routing-istio, --enable-ariEnable Gateway API based ingress on App Routing via Istio without service mesh functionality.--enable-app-routingEnable Application Routing addon.--enable-azure-container-storageenable azure container storage.--enable-azure-keyvault-kmsEnable Azure KeyVault Key Management Service.--enable-azure-monitor-app-monitoringEnable Azure Monitor Application Monitoring auto-instrumentation for a Kubernetes cluster.--enable-azure-monitor-logsEnable Azure Monitor logs (Container Insights) for the cluster using managed identity authentication.--enable-azure-monitor-metricsEnable a kubernetes cluster with the Azure Monitor managed service for Prometheus integration.--enable-azure-rbacEnable Azure RBAC to control authorization checks on cluster.--enable-azure-service-mesh, --enable-asmEnable Azure Service Mesh addon.--enable-blob-driverEnable AzureBlob CSI Driver.--enable-cluster-autoscalerEnable cluster autoscaler, default value is false.--enable-container-network-logsEnable container network log collection functionalities on a cluster.--enable-control-plane-metrics, --enable-cp-metricsEnable collection of Azure Monitor managed Prometheus control plane metrics for managed cluster components (controlplane-apiserver and controlplane-etcd targets by default).--enable-cost-analysisEnable exporting Kubernetes Namespace and Deployment details to the Cost Analysis views in the Azure portal.--enable-defenderEnable Microsoft Defender security profile.--enable-encryption-at-hostEnable EncryptionAtHost, default value is false.--enable-fips-imageUse FIPS-enabled OS on agent nodes.--enable-gateway-apiEnable managed installation of Gateway API CRDs from the standard release channel.--enable-high-log-scale-modeEnable High Log Scale Mode for Container Logs.--enable-hosted-system(Automatic SKU) Explicitly opt in to a Managed System Pool for the Automatic cluster.--enable-image-cleanerEnable ImageCleaner Service.--enable-kedaEnable KEDA workload auto-scaler.--enable-managed-identityUsing a system assigned managed identity to manage cluster resource group.--enable-msi-auth-for-monitoringEnable Managed Identity Auth for Monitoring addon.--enable-node-public-ipEnable VMSS or VMs node public IP.--enable-oidc-issuerEnable OIDC issuer.--enable-opentelemetry-logs-tracesEnable the OpenTelemetry (OTLP) logs and traces receiver.--enable-opentelemetry-metricsEnable the OpenTelemetry (OTLP) metrics receiver.--enable-private-clusterEnable private cluster.--enable-prometheus-metrics-scrapingEnable Prometheus metrics scraping by the Azure Monitor agent.--enable-secret-rotationEnable secret rotation.--enable-secure-bootEnable Secure Boot on all node pools in the cluster.--enable-sgxquotehelperEnable SGX quote helper for confcom addon.--enable-static-egress-gatewayEnable Static Egress Gateway addon to the cluster.--enable-syslogEnable syslog data collection for Monitoring addon--enable-ultra-ssdEnable UltraSSD, default value is false.--enable-upstream-kubescheduler-user-configurationEnable user-defined scheduler configuration for kube-scheduler upstream on the cluster.--enable-vpaEnable vertical pod autoscaler for cluster.--enable-vtpmEnable vTPM on all node pools in the cluster.--enable-windows-gmsaEnable Windows gmsa.--enable-windows-recording-rulesEnable Windows Recording Rules when enabling the Azure Monitor Metrics addon--enable-workload-identityEnable workload identity addon.--ephemeral-disk-nvme-perf-tier, --ephemeral-disk-volume-typeset ephemeral disk volume type for azure container storage--fqdn-subdomainPrefix for FQDN that is created for private cluster with custom private dns zone scenario.--generate-ssh-keysGenerate SSH public and private key files if missing.--gmsa-dns-serverSpecify DNS server for Windows gmsa for this cluster.--gmsa-root-domain-nameSpecify root domain name for Windows gmsa for this cluster.--gpu-instance-profileGPU instance profile to partition multi-gpu Nvidia GPUs.--grafana-resource-idResource ID of the Azure Managed Grafana Workspace--host-group-idThe fully qualified dedicated host group id used to provision agent node pool.--http-proxy-configHTTP Proxy configuration for this cluster.--if-matchThe value provided will be compared to the ETag of the managed cluster, if it matches the operation will proceed.--if-none-matchSet to '*' to allow a new cluster to be created, but to prevent updating an existing cluster.--image-cleaner-interval-hoursImageCleaner scanning interval.--ip-familiesA comma-separated list of IP versions to use for cluster networking.--k8s-support-planChoose from "KubernetesOfficial" or "AKSLongTermSupport", with "AKSLongTermSupport" you get 1 extra year of CVE patchs.--kms-infrastructure-encryptionEnable encryption at rest of Kubernetes resource objects using service-managed keys.--ksm-metric-annotations-allow-list, --ksm-metric-labels-allow-listComma-separated list of additional Kubernetes label keys that will be used in the resource' labels metric.--kubelet-configPath to JSON file containing Kubelet configurations for agent nodes.--kubernetes-version, -kVersion of Kubernetes to use for creating the cluster, such as "1.16.9".--linux-os-configPath to JSON file containing OS configurations for Linux agent nodes.--load-balancer-backend-pool-typeLoad balancer backend pool type.--load-balancer-idle-timeoutLoad balancer idle timeout in minutes.--load-balancer-managed-outbound-ip-countLoad balancer managed outbound IP count.--load-balancer-managed-outbound-ipv6-countLoad balancer managed outbound IPv6 IP count.--load-balancer-outbound-ip-prefixesLoad balancer outbound IP prefix resource IDs.--load-balancer-outbound-ipsLoad balancer outbound IP resource IDs.--load-balancer-outbound-portsLoad balancer outbound allocated ports.--load-balancer-skuAzure Load Balancer SKU selection for your cluster.--max-countMaximum nodes count used for autoscaler, when "--enable-cluster-autoscaler" specified.--max-pods, -mThe maximum number of pods deployable to a node.--message-of-the-dayPath to a file containing the desired message of the day.--min-countMinimum nodes count used for autoscaler, when "--enable-cluster-autoscaler" specified.--name--nat-gateway-idle-timeoutNAT gateway idle timeout in minutes.--nat-gateway-managed-outbound-ip-countNAT gateway managed outbound IP count.--nat-gateway-managed-outbound-ipv6-count, --nat-gw-ipv6-countNAT gateway managed outbound IPv6 count.--nat-gateway-outbound-ip-prefixes, --nat-gw-prefixesComma-separated public IP prefix resource IDs for the cluster NAT gateway.--nat-gateway-outbound-ips, --nat-gw-ipsComma-separated public IP resource IDs for the cluster NAT gateway.--network-dataplaneThe network dataplane to use.--network-plugin-modeThe network plugin mode to use.--network-pluginThe Kubernetes network plugin to use.--network-policyNetwork Policy Engine to use.--no-ssh-key, -xDo not use or create a local SSH key.--node-count, -cNumber of nodes in the Kubernetes node pool.--node-os-upgrade-channelManner in which the OS on your nodes is updated.--node-osdisk-diskencryptionset-id, -dResourceId of the disk encryption set to use for enabling encryption at rest on agent node os disk.--node-osdisk-sizeSize in GiB of the OS disk for each node in the node pool.--node-osdisk-typeOS disk type to be used for machines in a given agent pool: Ephemeral or Managed.--node-provisioning-default-poolsThe set of default Karpenter NodePools configured for node provisioning.--node-provisioning-modeSet the node provisioning mode of the cluster.--node-public-ip-prefix-idPublic IP prefix ID used to assign public IPs to VMSS or VMs nodes.--node-public-ip-tagsThe ipTags of the node public IPs.--node-resource-groupThe node resource group is the resource group where all customer's resources will be created in, such as virtual machines.--node-subnet-id(Automatic SKU) The ID of a subnet in an existing VNet to be used by user node pools in an Automatic cluster.--node-vm-size, -sSize of Virtual Machines to create as Kubernetes nodes.--nodepool-allowed-host-portsExpose host ports on the node pool.--nodepool-asg-idsThe IDs of the application security groups to which the node pool's network interface should belong.--nodepool-labelsThe node labels for all node pool.--nodepool-nameNode pool name, alphanumeric characters only.--nodepool-tagsspace-separated tags: key[=value] [key[=value] ...].--nodepool-taintsThe node taints for all node pool.--nrg-lockdown-restriction-levelRestriction level on the managed node resource group.--opentelemetry-logs-traces-port-grpcgRPC port for the OpenTelemetry logs and traces receiver.--opentelemetry-logs-traces-port-httpHTTP/protobuf port for the OpenTelemetry logs and traces receiver.--opentelemetry-metrics-port-grpcgRPC port for the OpenTelemetry metrics receiver.--opentelemetry-metrics-port-httpHTTP/protobuf port for the OpenTelemetry metrics receiver.--os-skuThe OS SKU of the agent node pool.--outbound-type-skuSKU of the managed NAT Gateway (Standard or StandardV2).--outbound-typeHow outbound traffic will be configured for a cluster.--pod-cidrA CIDR notation IP range from which to assign pod IPs when Azure CNI Overlay or Kubenet is used (On 31 March 2028, Kubenet will be retired).--pod-cidrsA comma-separated list of CIDR notation IP ranges from which to assign pod IPs when Azure CNI Overlay or Kubenet is used (On 31 March 2028, Kubenet will be retired).--pod-ip-allocation-modeSet the ip allocation mode for how Pod IPs from the Azure Pod Subnet are allocated to the nodes in the AKS cluster.--pod-subnet-idThe ID of a subnet in an existing VNet into which to assign pods in the cluster (requires azure network-plugin).--ppgThe ID of a PPG.--private-dns-zonePrivate dns zone mode for private cluster.--revisionAzure Service Mesh revision to install.--rotation-poll-intervalSet interval of rotation poll.--service-cidrA CIDR notation IP range from which to assign service cluster IPs.--service-cidrsA comma-separated list of CIDR notation IP ranges from which to assign service cluster IPs.--service-principalService principal used for authentication to Azure APIs.--skip-subnet-role-assignmentSkip role assignment for subnet (advanced networking).--skuSpecify SKU name for managed clusters.--snapshot-idThe source snapshot id used to create this cluster.--ssh-accessConfigure SSH access for the first system node pool.--ssh-key-valuePublic key path or key contents to install on node VMs for SSH access.--storage-pool-nameset storage pool name for azure container storage--storage-pool-optionset ephemeral disk storage pool option for azure container storage--storage-pool-sizeset storage pool size for azure container storage--storage-pool-skuset azure disk type storage pool sku for azure container storage--syslog-portTCP port that the Azure Monitor agent listens on for syslog data.--system-node-subnet-id(Automatic SKU) The ID of a subnet in an existing VNet to be used by the Managed System Pool in an Automatic cluster.--tagsThe tags of the managed cluster.--tierSpecify SKU tier for managed clusters.--vm-set-typeAgent pool vm set type.--vm-sizesComma-separated list of VM sizes.--vnet-subnet-idThe ID of a subnet in an existing VNet into which to deploy the cluster.--windows-admin-passwordUser account password to use on windows node VMs.--windows-admin-usernameUser account to create on windows node VMs.--workload-runtimeSet the workload runtime.--workspace-resource-idThe resource ID of an existing Log Analytics Workspace to use for storing monitoring data.--yes, -yDo not prompt for confirmation.--zones, -zAvailability zones where agent nodes will be placed.