fm kubernetes
Reference for the fm kubernetes command group (auto-generated from fm kubernetes --help).
fm kubernetes
text
Manage managed Kubernetes clusters (RKE2 on Nova).
fm kubernetes cluster create --name my-cluster --vpc vpc-123 --subnet subnet-456 --node-flavor k8s.gp1.medium
fm kubernetes cluster list
fm kubernetes cluster kubeconfig <cluster-id> > ~/.kube/frostmoln
fm kubernetes node-pool create <cluster-id> --flavor k8s.gp1.large --node-count 3
Discover valid flavors, control-plane tiers, versions, and addons:
fm kubernetes flavor list
fm kubernetes tier list
fm kubernetes version list
fm kubernetes addon list
Usage:
fm kubernetes [command]
Aliases:
kubernetes, k8s
Available Commands:
addon View Kubernetes cluster addons
cluster Manage Kubernetes clusters
flavor View Kubernetes node flavors
node-pool Manage cluster node pools
tier View Kubernetes control-plane tiers
version View Kubernetes versions
workload-identity Manage Workload Identity Federation for managed Kubernetes
Flags:
-h, --help help for kubernetes
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes [command] --help" for more information about a command.fm kubernetes addon
text
List available cluster addons.
Usage:
fm kubernetes addon [command]
Aliases:
addon, addons
Available Commands:
list List cluster addons
Flags:
-h, --help help for addon
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes addon [command] --help" for more information about a command.fm kubernetes addon list
text
List cluster addons
Usage:
fm kubernetes addon list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster
text
Manage managed Kubernetes clusters.
Usage:
fm kubernetes cluster [command]
Aliases:
cluster, clusters
Available Commands:
create Create a Kubernetes cluster
delete Delete a Kubernetes cluster
get Get Kubernetes cluster details
kubeconfig Fetch a cluster's kubeconfig
list List Kubernetes clusters
rename Rename a Kubernetes cluster
Flags:
-h, --help help for cluster
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes cluster [command] --help" for more information about a command.fm kubernetes cluster create
text
Create a managed Kubernetes cluster with an initial node pool.
--version, --tier and --region are optional; when omitted the server applies its
defaults (discover valid values with 'fm kubernetes version list' / 'tier list').
Addons: by default the server applies the catalog's default addons. Use --addons
to select an explicit set, or --no-addons to create the cluster with none.
Examples:
fm kubernetes cluster create --name prod --vpc vpc-123 --subnet subnet-456 --node-flavor k8s.gp1.medium
fm kubernetes cluster create --name prod --vpc vpc-123 --subnet subnet-456 \
--node-flavor k8s.gp1.large --node-count 3 --tier production --version 1.35 --addons external-secrets
Usage:
fm kubernetes cluster create [flags]
Flags:
--addons strings explicit addon keys (comma-separated; see 'addon list'). Omit for catalog defaults
-h, --help help for create
--name string cluster name (required)
--no-addons create the cluster with no addons (mutually exclusive with --addons)
--no-wait return immediately instead of waiting for the cluster to become ready
--node-count int number of nodes in the initial node pool (default 1)
--node-flavor string flavor ID for the initial node pool (required, e.g. k8s.gp1.medium — see 'flavor list')
--node-pool-name string name for the initial node pool (server-generated when empty)
--public-ip string bring-your-own public IP ID for the API server
--region string region ID (server default when empty)
--subnet string subnet ID (required)
--tier string control-plane tier key (server default when empty — see 'tier list')
--version string Kubernetes version (server default when empty — see 'version list')
--vpc string VPC ID (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster delete
text
Delete a managed Kubernetes cluster and all of its node pools.
Usage:
fm kubernetes cluster delete <cluster-id> [flags]
Flags:
--force skip the confirmation prompt
-h, --help help for delete
--wait wait for the deletion to complete before returning
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster get
text
Get detailed information about a specific Kubernetes cluster.
Usage:
fm kubernetes cluster get <cluster-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster kubeconfig
text
Fetch the kubeconfig for a Kubernetes cluster.
By default the raw kubeconfig YAML is written to stdout (redirect it or use
--file). With -o json|yaml the full {endpoint, kubeconfig} object is printed.
The kubeconfig is only available once the cluster is running.
Examples:
fm kubernetes cluster kubeconfig <cluster-id> > ~/.kube/frostmoln
fm kubernetes cluster kubeconfig <cluster-id> --file ./kubeconfig.yaml
KUBECONFIG=$(fm kubernetes cluster kubeconfig <cluster-id> --file /dev/stdout) kubectl get nodes
Usage:
fm kubernetes cluster kubeconfig <cluster-id> [flags]
Flags:
--file string write the kubeconfig to this file instead of stdout
-h, --help help for kubeconfig
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster list
text
List all managed Kubernetes clusters in the active tenant.
Usage:
fm kubernetes cluster list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes cluster rename
text
Rename a managed Kubernetes cluster.
Usage:
fm kubernetes cluster rename <cluster-id> [flags]
Flags:
-h, --help help for rename
--name string new cluster name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes flavor
text
List available node flavors (instance sizes) for Kubernetes clusters, or get one by ID.
Usage:
fm kubernetes flavor [command]
Aliases:
flavor, flavors
Available Commands:
get Get node flavor details
list List node flavors
Flags:
-h, --help help for flavor
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes flavor [command] --help" for more information about a command.fm kubernetes flavor get
text
Get detailed information about a specific Kubernetes node flavor.
Usage:
fm kubernetes flavor get <flavor-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes flavor list
text
List node flavors
Usage:
fm kubernetes flavor list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes node-pool
text
Manage node pools for a Kubernetes cluster.
Usage:
fm kubernetes node-pool [command]
Aliases:
node-pool, node-pools, nodepool, np
Available Commands:
create Create a node pool
delete Delete a node pool
get Get node pool details
list List a cluster's node pools
scale Scale a node pool
Flags:
-h, --help help for node-pool
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes node-pool [command] --help" for more information about a command.fm kubernetes node-pool create
text
Add a node pool to a Kubernetes cluster.
Example:
fm kubernetes node-pool create <cluster-id> --flavor k8s.gp1.large --node-count 3 --name workers
Usage:
fm kubernetes node-pool create <cluster-id> [flags]
Flags:
--flavor string flavor ID (required, e.g. k8s.gp1.large — see 'flavor list')
-h, --help help for create
--name string node pool name (server-generated when empty)
--no-wait return immediately instead of waiting for the pool to become active
--node-count int number of nodes (default 1)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes node-pool delete
text
Delete a node pool from a Kubernetes cluster.
Usage:
fm kubernetes node-pool delete <cluster-id> <pool-id> [flags]
Flags:
--force skip the confirmation prompt
-h, --help help for delete
--wait wait for the deletion to complete before returning
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes node-pool get
text
Get detailed information about a specific node pool.
Usage:
fm kubernetes node-pool get <cluster-id> <pool-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes node-pool list
text
List all node pools for a Kubernetes cluster.
Usage:
fm kubernetes node-pool list <cluster-id> [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes node-pool scale
text
Change the number of nodes in a node pool.
Example:
fm kubernetes node-pool scale <cluster-id> <pool-id> --node-count 5
Usage:
fm kubernetes node-pool scale <cluster-id> <pool-id> [flags]
Flags:
-h, --help help for scale
--no-wait return immediately instead of waiting for the scale to complete
--node-count int target number of nodes (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes tier
text
List available control-plane tiers for Kubernetes clusters.
Usage:
fm kubernetes tier [command]
Aliases:
tier, tiers
Available Commands:
list List control-plane tiers
Flags:
-h, --help help for tier
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes tier [command] --help" for more information about a command.fm kubernetes tier list
text
List control-plane tiers
Usage:
fm kubernetes tier list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes version
text
List available Kubernetes versions.
Usage:
fm kubernetes version [command]
Aliases:
version, versions
Available Commands:
list List Kubernetes versions
Flags:
-h, --help help for version
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes version [command] --help" for more information about a command.fm kubernetes version list
text
List Kubernetes versions
Usage:
fm kubernetes version list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes workload-identity
text
Manage Workload Identity Federation bindings (ADR-0095).
A binding maps a Kubernetes (namespace, serviceAccount) in one of your managed
clusters to a least-privilege Frostmoln grant. A pod running as that
ServiceAccount can then exchange its projected token for a short-lived, scoped
Frostmoln credential — no long-lived secret in the pod.
The grant is either flat scopes on the binding, or an access policy attached to
it with "fm iam policy attach --type workload_identity" (directly or through a
group). Prefer the policy: it can name individual targets, add constraints and
deny explicitly, none of which a flat scope can express.
Usage:
fm kubernetes workload-identity [command]
Aliases:
workload-identity, wi
Available Commands:
binding Manage workload identity bindings
token Exchange a ServiceAccount token for a Frostmoln workload token (debug)
Flags:
-h, --help help for workload-identity
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes workload-identity [command] --help" for more information about a command.fm kubernetes workload-identity binding
text
Manage workload identity bindings
Usage:
fm kubernetes workload-identity binding [command]
Aliases:
binding, bindings
Available Commands:
create Create a workload identity binding
delete Delete a workload identity binding
list List workload identity bindings
Flags:
-h, --help help for binding
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm kubernetes workload-identity binding [command] --help" for more information about a command.fm kubernetes workload-identity binding create
text
Create a workload identity binding.
The binding's grant is either flat --scope values or an access policy attached to
it with "fm iam policy attach". Scopes must be explicit and least-privilege:
wildcards ("*" or "<resource>:*") are rejected for workload identities.
Omit --scope entirely to create a POLICY-GRANTED binding. Prefer that — a flat
scope grants a verb across every resource of a service, while a policy names
individual targets, adds constraints and can deny explicitly. Such a binding is
INERT until a policy is attached: with no grant at all the token exchange refuses
it rather than minting a credential that grants nothing.
Examples:
fm kubernetes workload-identity binding create \
--cluster <cluster-id> \
--namespace default \
--service-account my-app \
--scope compute:read --scope storage:read
# Policy-granted: create the binding, then attach a policy to it.
fm kubernetes workload-identity binding create \
--cluster <cluster-id> --namespace ops --service-account reaper
fm iam policy attach <policy-id> --type workload_identity --id <binding-id>
Usage:
fm kubernetes workload-identity binding create [flags]
Flags:
--cluster string managed cluster id the binding applies to (required)
-h, --help help for create
--namespace string Kubernetes namespace (required)
--scope strings least-privilege scope (repeatable, e.g. compute:read); wildcards rejected. Omit for a policy-granted binding
--service-account string Kubernetes ServiceAccount name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes workload-identity binding delete
text
Delete a workload identity binding
Usage:
fm kubernetes workload-identity binding delete <id> [flags]
Flags:
--force skip confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes workload-identity binding list
text
List the current tenant's workload identity bindings.
Results are cursor-paginated: when the output includes a non-empty nextCursor,
pass it back with --cursor to fetch the next page.
Usage:
fm kubernetes workload-identity binding list [flags]
Flags:
--all fetch all pages (auto-follow nextCursor)
--cluster string filter by cluster id
--cursor string opaque pagination cursor from a previous response's nextCursor
-h, --help help for list
--limit int maximum bindings per page
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm kubernetes workload-identity token
text
Debug/support helper: exchange a raw Kubernetes ServiceAccount JWT for a
short-lived Frostmoln workload token and print it.
Pods obtain this automatically via the injected in-guest helper; use this only to
troubleshoot a binding. The subject token is a live credential, so it is read
only from a file or stdin (never a command-line argument, which would leak it to
the process list and shell history):
fm kubernetes workload-identity token --subject-token-file /var/run/secrets/.../token
cat token.jwt | fm kubernetes workload-identity token --subject-token-file -
Usage:
fm kubernetes workload-identity token [flags]
Flags:
-h, --help help for token
--subject-token-file string read the ServiceAccount JWT from a file ("-" for stdin)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)