1KUBERNETES(1)(kubernetes) KUBERNETES(1)(kubernetes)
2Eric Paris Jan 2015
6
9 kubectl create clusterrolebinding - Create a ClusterRoleBinding for a
10 particular ClusterRole
11
15 kubectl create clusterrolebinding [OPTIONS]
16
20 Create a ClusterRoleBinding for a particular ClusterRole.
21
25 --allow-missing-template-keys=true If true, ignore any errors in
26 templates when a field or map key is missing in the template. Only ap‐
27 plies to golang and jsonpath output formats.
28 --clusterrole="" ClusterRole this ClusterRoleBinding should refer‐
31 ence
32 --dry-run="none" Must be "none", "server", or "client". If client
35 strategy, only print the object that would be sent, without sending it.
36 If server strategy, submit server-side request without persisting the
37 resource.
38 --field-manager="kubectl-create" Name of the manager used to track
41 field ownership.
42 --group=[] Groups to bind to the clusterrole
45 -o, --output="" Output format. One of: json|yaml|name|go-tem‐
48 plate|go-template-file|template|templatefile|jsonpath|json‐
49 path-as-json|jsonpath-file.
50 --save-config=false If true, the configuration of current object
53 will be saved in its annotation. Otherwise, the annotation will be un‐
54 changed. This flag is useful when you want to perform kubectl apply on
55 this object in the future.
56 --serviceaccount=[] Service accounts to bind to the clusterrole,
59 in the format :
60 --show-managed-fields=false If true, keep the managedFields when
63 printing objects in JSON or YAML format.
64 --template="" Template string or path to template file to use when
67 -o=go-template, -o=go-template-file. The template format is golang tem‐
68 plates [http://golang.org/pkg/text/template/#pkg-overview].
69 --validate=true If true, use a schema to validate the input before
72 sending it
73
77 --add-dir-header=false If true, adds the file directory to the
78 header of the log messages
79 --alsologtostderr=false log to standard error as well as files
82 --application-metrics-count-limit=100 Max number of application
85 metrics to store (per container)
86 --as="" Username to impersonate for the operation
89 --as-group=[] Group to impersonate for the operation, this flag
92 can be repeated to specify multiple groups.
93 --azure-container-registry-config="" Path to the file containing
96 Azure container registry configuration information.
97 --boot-id-file="/proc/sys/kernel/random/boot_id" Comma-separated
100 list of files to check for boot-id. Use the first one that exists.
101 --cache-dir="/builddir/.kube/cache" Default cache directory
104 --certificate-authority="" Path to a cert file for the certificate
107 authority
108 --client-certificate="" Path to a client certificate file for TLS
111 --client-key="" Path to a client key file for TLS
114 --cloud-provider-gce-l7lb-src-cidrs=130.211.0.0/22,35.191.0.0/16
117 CIDRs opened in GCE firewall for L7 LB traffic proxy health
118 checks
119 --cloud-provider-gce-lb-src-cidrs=130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
122 CIDRs opened in GCE firewall for L4 LB traffic proxy health
123 checks
124 --cluster="" The name of the kubeconfig cluster to use
127 --container-hints="/etc/cadvisor/container_hints.json" location of
130 the container hints file
131 --containerd="/run/containerd/containerd.sock" containerd endpoint
134 --containerd-namespace="k8s.io" containerd namespace
137 --context="" The name of the kubeconfig context to use
140 --default-not-ready-toleration-seconds=300 Indicates the tolera‐
143 tionSeconds of the toleration for notReady:NoExecute that is added by
144 default to every pod that does not already have such a toleration.
145 --default-unreachable-toleration-seconds=300 Indicates the tolera‐
148 tionSeconds of the toleration for unreachable:NoExecute that is added
149 by default to every pod that does not already have such a toleration.
150 --disable-root-cgroup-stats=false Disable collecting root Cgroup
153 stats
154 --docker="unix:///var/run/docker.sock" docker endpoint
157 --docker-env-metadata-whitelist="" a comma-separated list of envi‐
160 ronment variable keys matched with specified prefix that needs to be
161 collected for docker containers
162 --docker-only=false Only report docker containers in addition to
165 root stats
166 --docker-root="/var/lib/docker" DEPRECATED: docker root is read
169 from docker info (this is a fallback, default: /var/lib/docker)
170 --docker-tls=false use TLS to connect to docker
173 --docker-tls-ca="ca.pem" path to trusted CA
176 --docker-tls-cert="cert.pem" path to client certificate
179 --docker-tls-key="key.pem" path to private key
182 --enable-load-reader=false Whether to enable cpu load reader
185 --event-storage-age-limit="default=0" Max length of time for which
188 to store events (per type). Value is a comma separated list of key val‐
189 ues, where the keys are event types (e.g.: creation, oom) or "default"
190 and the value is a duration. Default is applied to all non-specified
191 event types
192 --event-storage-event-limit="default=0" Max number of events to
195 store (per type). Value is a comma separated list of key values, where
196 the keys are event types (e.g.: creation, oom) or "default" and the
197 value is an integer. Default is applied to all non-specified event
198 types
199 --global-housekeeping-interval=1m0s Interval between global house‐
202 keepings
203 --housekeeping-interval=10s Interval between container housekeep‐
206 ings
207 --insecure-skip-tls-verify=false If true, the server's certificate
210 will not be checked for validity. This will make your HTTPS connections
211 insecure
212 --kubeconfig="" Path to the kubeconfig file to use for CLI re‐
215 quests.
216 --log-backtrace-at=:0 when logging hits line file:N, emit a stack
219 trace
220 --log-cadvisor-usage=false Whether to log the usage of the cAdvi‐
223 sor container
224 --log-dir="" If non-empty, write log files in this directory
227 --log-file="" If non-empty, use this log file
230 --log-file-max-size=1800 Defines the maximum size a log file can
233 grow to. Unit is megabytes. If the value is 0, the maximum file size is
234 unlimited.
235 --log-flush-frequency=5s Maximum number of seconds between log
238 flushes
239 --logtostderr=true log to standard error instead of files
242 --machine-id-file="/etc/machine-id,/var/lib/dbus/machine-id"
245 Comma-separated list of files to check for machine-id. Use the
246 first one that exists.
247 --match-server-version=false Require server version to match
250 client version
251 -n, --namespace="" If present, the namespace scope for this CLI
254 request
255 --one-output=false If true, only write logs to their native sever‐
258 ity level (vs also writing to each lower severity level)
259 --password="" Password for basic authentication to the API server
262 --profile="none" Name of profile to capture. One of
265 (none|cpu|heap|goroutine|threadcreate|block|mutex)
266 --profile-output="profile.pprof" Name of the file to write the
269 profile to
270 --referenced-reset-interval=0 Reset interval for referenced bytes
273 (container_referenced_bytes metric), number of measurement cycles after
274 which referenced bytes are cleared, if set to 0 referenced bytes are
275 never cleared (default: 0)
276 --request-timeout="0" The length of time to wait before giving up
279 on a single server request. Non-zero values should contain a corre‐
280 sponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't time‐
281 out requests.
282 -s, --server="" The address and port of the Kubernetes API server
285 --skip-headers=false If true, avoid header prefixes in the log
288 messages
289 --skip-log-headers=false If true, avoid headers when opening log
292 files
293 --stderrthreshold=2 logs at or above this threshold go to stderr
296 --storage-driver-buffer-duration=1m0s Writes in the storage driver
299 will be buffered for this duration, and committed to the non memory
300 backends as a single transaction
301 --storage-driver-db="cadvisor" database name
304 --storage-driver-host="localhost:8086" database host:port
307 --storage-driver-password="root" database password
310 --storage-driver-secure=false use secure connection with database
313 --storage-driver-table="stats" table name
316 --storage-driver-user="root" database username
319 --tls-server-name="" Server name to use for server certificate
322 validation. If it is not provided, the hostname used to contact the
323 server is used
324 --token="" Bearer token for authentication to the API server
327 --update-machine-info-interval=5m0s Interval between machine info
330 updates.
331 --user="" The name of the kubeconfig user to use
334 --username="" Username for basic authentication to the API server
337 -v, --v=0 number for the log level verbosity
340 --version=false Print version information and quit
343 --vmodule= comma-separated list of pattern=N settings for
346 file-filtered logging
347 --warnings-as-errors=false Treat warnings received from the server
350 as errors and exit with a non-zero exit code
351
355 # Create a ClusterRoleBinding for user1, user2, and group1 using the cluster-admin ClusterRole
356 kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1
357
362 kubectl-create(1),
363
367 January 2015, Originally compiled by Eric Paris (eparis at redhat dot
368 com) based on the kubernetes source material, but hopefully they have
369 been automatically generated since!
370Manuals User KUBERNETES(1)(kubernetes)