KUBERNETES(1)(kubernetes) KUBERNETES(1)(kubernetes) Eric Paris Jan 2015 (NAME) kube-apiserver - API (SYNOPSIS) kube-apiserver [OPTIONS] (DESCRIPTION) API API pod service replicationcontroller . REST . (OPTIONS) --admission-control=[] (Admission) . (mutating) . (validating) . . . : AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, JobValidation, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionPolicy, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeDeclaredFeatureValidator, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodGroupProtection, PodGroupWorkloadExists, PodNodeSelector, PodResizeValidator, PodSecurity, PodTolerationRestriction, PodTopologyLabels, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. --admission-control-config-file="" (admission control). --advertise-address= IP apiserver . . --bind- address . --bind- address . --aggregator-reject-forwarding-redirect=true (redirect) Aggregator . --allow-metric-labels=[] (metric-label) . , . ,... : metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'. --allow-metric-labels-manifest="" . --allow-metric-labels : allowListMapping: "metric1,label1": "value11,value12" "metric2,label2": "" --allow-metric-labels . --allow-privileged=false true (privileged) . [=false] --anonymous-auth=true () API . . system:anonymous system:unauthenticated . --api-audiences=[] API. ServiceAccount API (audiences) . --service-account-issuer (issuer URL) . --apiserver-count=1 apiserver . ( --endpoint-reconciler- type=master-count .) --audit-log-batch-buffer-size=10000 . batch . --audit-log-batch-max-size=1 (batch). batch . --audit-log-batch-max-wait=0s . batch . --audit-log-batch-throttle-burst=0 ThrottleQPS . batch . --audit-log-batch-throttle-enable=false (throttling) . batch . --audit-log-batch-throttle-qps=0 . batch . --audit-log-compress=false (rotated) gzip . --audit-log-format="json" . "legacy" . "json" json . legacy json. --audit-log-maxage=366 . 0 . --audit-log-maxbackup=100 . 0 . --audit-log-maxsize=100 (rotate) . 0 ( ). --audit-log-mode="blocking" . blocking (block) . batch . batch blocking blocking-strict. --audit-log-path="" apiserver . '-' . --audit-log-truncate-enabled=false . --audit-log-truncate-max-batch-size=10485760 . . . --audit-log-truncate-max-event-size=102400 . . --audit-log-version="audit.k8s.io/v1" API . --audit-policy-file="" (audit policy) . --audit-webhook-batch-buffer-size=10000 . batch . --audit-webhook-batch-initial-backoff=10s . --audit-webhook-batch-max-size=400 . batch . --audit-webhook-batch-max-wait=30s . batch . --audit-webhook-batch-throttle-burst=15 ThrottleQPS . batch . --audit-webhook-batch-throttle-enable=true (throttling) . batch . --audit-webhook-batch-throttle-qps=10 . batch . --audit-webhook-config-file="" kubeconfig (audit webhook) . --audit-webhook-initial-backoff=10s . --audit-webhook-mode="batch" . blocking . batch . batch blocking blocking-strict. --audit-webhook-truncate-enabled=false ..PP --audit- webhook-truncate-max-batch-size=10485760 (batch) backend . . . --audit-webhook-truncate-max-event-size=102400 (audit event) backend . ( ). --audit-webhook-version="audit.k8s.io/v1" API webhook. --authentication-config="" (Authentication Configuration) JWT (anonymous). feature gate StructuredAuthenticationConfiguration . JWT --oidc-* . Anonymous --anonymous-auth . --authentication-token-webhook-cache-ttl=2m0s webhook. --authentication-token-webhook-config-file="" webhook kubeconfig. API (bearer tokens) . --authentication-token-webhook-version="v1beta1" API authentication.k8s.io TokenReview webhook. --authorization-config="" (Authorization Configuration) . --authorization-mode --authorization- webhook-* . --authorization-mode=[] . --authorization-config AlwaysAllow . : AlwaysAllow,AlwaysDeny,ABAC,Webhook,RBAC,Node. --authorization-policy-file="" json --authorization-mode=ABAC . --authorization-webhook-cache-authorized-ttl=5m0s <<>> (authorized) webhook. --authorization-webhook-cache-unauthorized-ttl=30s <<>> (unauthorized) webhook. --authorization-webhook-config-file="" webhook kubeconfig --authorization-mode=Webhook. API API server . --authorization-webhook-version="v1beta1" API authorization.k8s.io SubjectAccessReview webhook. --bind-address=0.0.0.0 IP --secure-port. () CLI/ . (0.0.0.0 ::) IP . --cert-dir="/var/run/kubernetes" TLS . --tls-cert-file --tls-private-key-file . --client-ca-file="" (authorities) client-ca-file CommonName . --contention-profiling=false (block profiling) --coordinated-leadership-lease-duration=15s (lease) Coordinated Leader Election. --coordinated-leadership-renew-deadline=10s Coordinated Leader Election. --coordinated-leadership-retry-period=2s Coordinated Leader Election. --cors-allowed-origins=[] CORS . (regular expression) . CORS . '^' '//' '$' ':' . '//example.com(:|$)' '^https://example.com(:|$)' --debug-socket-path="" ( authn/authz) --default-not-ready-toleration-seconds=300 tolerationSeconds (toleration) notReady:NoExecute pod . --default-unreachable-toleration-seconds=300 tolerationSeconds (toleration) unreachable:NoExecute pod . --default-watch-cache-size=100 (watch cache). . --delete-collection-workers=1 (workers) DeleteCollection. namespace . --disable-admission-plugins=[] (admission plugins) (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PodGroupProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, PodTopologyLabels, PodGroupWorkloadExists, NodeDeclaredFeatureValidator, JobValidation, PodResizeValidator, MutatingAdmissionPolicy, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). : AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, JobValidation, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionPolicy, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeDeclaredFeatureValidator, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodGroupProtection, PodGroupWorkloadExists, PodNodeSelector, PodResizeValidator, PodSecurity, PodTolerationRestriction, PodTopologyLabels, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. . --disable-http2-serving=false true HTTP2 [=false] --disabled-metrics=[] (metrics) . (fully qualified) . : . --egress-selector-config-file="" egress selector apiserver. --emulated-version=[] (API ...) . . major.minor : '--emulated- version=wardle=1.2,kube=1.31'. : kube=1.33..1.36(:1.36) "kube" --emulation-forward-compatible=false true API (+beta) --runtime-config / . true . --enable-admission-plugins=[] (admission plugins) (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PodGroupProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, PodTopologyLabels, PodGroupWorkloadExists, NodeDeclaredFeatureValidator, JobValidation, PodResizeValidator, MutatingAdmissionPolicy, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). : AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, JobValidation, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionPolicy, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeDeclaredFeatureValidator, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodGroupProtection, PodGroupWorkloadExists, PodNodeSelector, PodResizeValidator, PodSecurity, PodTolerationRestriction, PodTopologyLabels, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. . --enable-aggregator-routing=false (aggregator routing) IP IP (endpoints IP) . --enable-bootstrap-token-auth=false secret 'bootstrap.kubernetes.io/token' namespace 'kube-system' TLS bootstrapping. --enable-garbage-collector=true (garbage collector) . kube-controller-manager . --enable-logs-handler=false true /logs apiserver . --enable-priority-and-fairness=true true max-in-flight --encryption-provider-config="" (encryption providers) secret etcd --encryption-provider-config-automatic-reload=false --encryption-provider-config . true KMS healthz API . --endpoint-reconciler-type="lease" (endpoint reconciler) (master- count, lease, none) master-count . --etcd-cafile="" SSL (SSL Certificate Authority) etcd. --etcd-certfile="" SSL etcd..PP --etcd-compaction-interval=5m0s (compaction). 0 apiserver . --etcd-count-metric-poll-period=1m0s etcd . 0 . --etcd-db-metric-poll-interval=30s etcd . 0 . --etcd-healthcheck-timeout=2s (timeout) etcd. --etcd-keyfile="" SSL etcd. --etcd-prefix="/registry" etcd . --etcd-readycheck-timeout=2s (timeout) etcd. --etcd-servers=[] etcd (scheme://ip:port) . --etcd-servers-overrides=[] etcd . : group/resource#servers servers (URLs) . . : "/pods#http://etcd4:2379;http://etcd5:2379,/events#http://etcd6:2379" --event-ttl=1h0m0s . --external-hostname="" (hostname) URL ( Swagger API Docs OpenID Discovery). --feature-gates= component:key=value (feature gates) / . "kube" . . : --feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature- gates 'kube:featureC=true' : kube:APIResponseCompression=true|false (BETA - default=true) kube:APIServerIdentity=true|false (BETA - default=true) kube:APIServingWithRoutine=true|false (ALPHA - default=false) kube:AllAlpha=true|false (ALPHA - default=false) kube:AllBeta=true|false (BETA - default=false) kube:AllowParsingUserUIDFromCertAuth=true|false (BETA - default=true) kube:AllowUnsafeMalformedObjectDeletion=true|false (ALPHA - default=false) kube:AtomicFIFO=true|false (BETA - default=true) kube:AuthorizePodWebsocketUpgradeCreatePermission=true|false (BETA - default=true) kube:CBORServingAndStorage=true|false (ALPHA - default=false) kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false) kube:CPUManagerPolicyBetaOptions=true|false (BETA - default=true) kube:CRDObservedGenerationTracking=true|false (BETA - default=true) kube:CRIListStreaming=true|false (ALPHA - default=false) kube:CSIVolumeHealth=true|false (ALPHA - default=false) kube:ClearingNominatedNodeNameAfterBinding=true|false (BETA - default=true) kube:ClientsAllowCARotation=true|false (BETA - default=true) kube:ClientsAllowCBOR=true|false (ALPHA - default=false) kube:ClientsAllowTLSCacheGC=true|false (BETA - default=true) kube:ClientsPreferCBOR=true|false (ALPHA - default=false) kube:CloudControllerManagerWatchBasedRoutesReconciliation=true|false (ALPHA - default=false) kube:CloudControllerManagerWebhook=true|false (ALPHA - default=false) kube:ClusterTrustBundle=true|false (BETA - default=false) kube:ClusterTrustBundleProjection=true|false (BETA - default=false) kube:ComponentFlagz=true|false (BETA - default=true) kube:ComponentStatusz=true|false (BETA - default=true) kube:ConcurrentWatchObjectDecode=true|false (BETA - default=false) kube:ConstrainedImpersonation=true|false (BETA - default=true) kube:ContainerCheckpoint=true|false (BETA - default=true) kube:ContainerRestartRules=true|false (BETA - default=true) kube:ContainerStopSignals=true|false (ALPHA - default=false) kube:ContextualLogging=true|false (BETA - default=true) kube:ControllerManagerReleaseLeaderElectionLockOnExit=true|false (ALPHA - default=false) kube:CoordinatedLeaderElection=true|false (BETA - default=false) kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false) kube:DRAConsumableCapacity=true|false (BETA - default=true) kube:DRADeviceBindingConditions=true|false (BETA - default=true) kube:DRADeviceTaintRules=true|false (BETA - default=false) kube:DRADeviceTaints=true|false (BETA - default=true) kube:DRAExtendedResource=true|false (BETA - default=true) kube:DRAListTypeAttributes=true|false (ALPHA - default=false) kube:DRANodeAllocatableResources=true|false (ALPHA - default=false) kube:DRAPartitionableDevices=true|false (BETA - default=true) kube:DRAResourceClaimDeviceStatus=true|false (BETA - default=true) kube:DRAResourceClaimGranularStatusAuthorization=true|false (BETA - default=true) kube:DRAResourcePoolStatus=true|false (ALPHA - default=false) kube:DRASchedulerFilterTimeout=true|false (BETA - default=true) kube:DRAWorkloadResourceClaims=true|false (ALPHA - default=false) kube:DeclarativeValidationBeta=true|false (BETA - default=true) kube:DeploymentReplicaSetTerminatingReplicas=true|false (BETA - default=true) kube:DetectCacheInconsistency=true|false (BETA - default=true) kube:EnvFiles=true|false (BETA - default=true) kube:EventedPLEG=true|false (ALPHA - default=false) kube:ExtendWebSocketsToKubelet=true|false (BETA - default=true) kube:GangScheduling=true|false (ALPHA - default=false) kube:GenericWorkload=true|false (ALPHA - default=false) kube:GracefulNodeShutdown=true|false (BETA - default=true) kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true) kube:HPAConfigurableTolerance=true|false (BETA - default=true) kube:HPAScaleToZero=true|false (ALPHA - default=false) kube:HostnameOverride=true|false (BETA - default=true) kube:ImageVolumeWithDigest=true|false (ALPHA - default=false) kube:InOrderInformersBatchProcess=true|false (BETA - default=true) kube:InPlacePodLevelResourcesVerticalScaling=true|false (BETA - default=true) kube:InPlacePodVerticalScalingExclusiveCPUs=true|false (ALPHA - default=false) kube:InPlacePodVerticalScalingExclusiveMemory=true|false (ALPHA - default=false) kube:InPlacePodVerticalScalingInitContainers=true|false (BETA - default=true) kube:KubeletCrashLoopBackOffMax=true|false (BETA - default=true) kube:KubeletEnsureSecretPulledImages=true|false (BETA - default=true) kube:KubeletInUserNamespace=true|false (ALPHA - default=false) kube:KubeletSeparateDiskGC=true|false (BETA - default=true) kube:KubeletServiceAccountTokenForCredentialProviders=true|false (BETA - default=true) kube:ListFromCacheSnapshot=true|false (BETA - default=true) kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false) kube:LoggingAlphaOptions=true|false (ALPHA - default=false) kube:LoggingBetaOptions=true|false (BETA - default=true) kube:ManifestBasedAdmissionControlConfig=true|false (ALPHA - default=false) kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true) kube:MatchLabelKeysInPodTopologySpreadSelectorMerge=true|false (BETA - default=true) kube:MaxUnavailableStatefulSet=true|false (BETA - default=false) kube:MemoryQoS=true|false (ALPHA - default=false) kube:MutablePVNodeAffinity=true|false (ALPHA - default=false) kube:MutablePodResourcesForSuspendedJobs=true|false (BETA - default=true) kube:MutableSchedulingDirectivesForSuspendedJobs=true|false (BETA - default=true) kube:NativeHistograms=true|false (ALPHA - default=false) kube:NodeDeclaredFeatures=true|false (BETA - default=true) kube:NominatedNodeNameForExpectation=true|false (BETA - default=true) kube:OpenAPIEnums=true|false (BETA - default=true) kube:OpportunisticBatching=true|false (BETA - default=true) kube:PLEGOnDemandRelist=true|false (BETA - default=true) kube:PersistentVolumeClaimUnusedSinceTime=true|false (ALPHA - default=false) kube:PodAndContainerStatsFromCRI=true|false (ALPHA - default=false) kube:PodCertificateRequest=true|false (BETA - default=false) kube:PodDeletionCost=true|false (BETA - default=true) kube:PodLevelResourceManagers=true|false (ALPHA - default=false) kube:PodLevelResources=true|false (BETA - default=true) kube:PodLogsQuerySplitStreams=true|false (ALPHA - default=false) kube:PodReadyToStartContainersCondition=true|false (BETA - default=true) kube:PodTopologyLabelsAdmission=true|false (BETA - default=true) kube:PodsAPI=true|false (ALPHA - default=false) kube:PortForwardWebsockets=true|false (BETA - default=true) kube:PreventStaticPodAPIReferences=true|false (BETA - default=true) kube:QOSReserved=true|false (ALPHA - default=false) kube:ReduceDefaultCrashLoopBackOffDecay=true|false (ALPHA - default=false) kube:RelaxedServiceNameValidation=true|false (BETA - default=true) kube:ReloadKubeletClientCAFile=true|false (BETA - default=true) kube:ReloadKubeletServerCertificateFile=true|false (BETA - default=true) kube:RemoteRequestHeaderUID=true|false (BETA - default=true) kube:ResourceHealthStatus=true|false (BETA - default=true) kube:ResourceHealthStatusMessage=true|false (BETA - default=true) kube:RestartAllContainersOnContainerExits=true|false (BETA - default=true) kube:RotateKubeletServerCertificate=true|false (BETA - default=true) kube:RuntimeClassInImageCriApi=true|false (ALPHA - default=false) kube:SELinuxMount=true|false (BETA - default=false) kube:SchedulerAsyncAPICalls=true|false (BETA - default=false) kube:SchedulerAsyncPreemption=true|false (BETA - default=true) kube:SchedulerPopFromBackoffQ=true|false (BETA - default=true) kube:ServiceAccountNodeAudienceRestriction=true|false (BETA - default=true) kube:ShardedListAndWatch=true|false (ALPHA - default=false) kube:SizeBasedListCostEstimate=true|false (BETA - default=true) kube:StaleControllerConsistencyDaemonSet=true|false (BETA - default=true) kube:StaleControllerConsistencyJob=true|false (BETA - default=true) kube:StaleControllerConsistencyReplicaSet=true|false (BETA - default=true) kube:StaleControllerConsistencyStatefulSet=true|false (BETA - default=true) kube:StatefulSetSemanticRevisionComparison=true|false (BETA - default=true) kube:StorageCapacityScoring=true|false (ALPHA - default=false) kube:StorageVersionAPI=true|false (ALPHA - default=false) kube:StorageVersionHash=true|false (BETA - default=true) kube:StorageVersionMigrator=true|false (BETA - default=false) kube:StrictIPCIDRValidation=true|false (BETA - default=true) kube:StructuredAuthenticationConfigurationEgressSelector=true|false (BETA - default=true) kube:StructuredAuthenticationConfigurationJWKSMetrics=true|false (BETA - default=true) kube:TaintTolerationComparisonOperators=true|false (ALPHA - default=false) kube:TokenRequestServiceAccountUIDValidation=true|false (BETA - default=true) kube:TopologyAwareWorkloadScheduling=true|false (ALPHA - default=false) kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false) kube:TopologyManagerPolicyBetaOptions=true|false (BETA - default=true) kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true) kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true) kube:UnknownVersionInteroperabilityProxy=true|false (BETA - default=true) kube:UnlockWhileProcessingFIFO=true|false (BETA - default=true) kube:UserNamespacesHostNetworkSupport=true|false (ALPHA - default=false) kube:VolumeLimitScaling=true|false (ALPHA - default=false) kube:WatchCacheInitializationPostStartHook=true|false (BETA - default=true) kube:WatchList=true|false (BETA - default=true) kube:WatchListClient=true|false (BETA - default=true) kube:WindowsCPUAndMemoryAffinity=true|false (ALPHA - default=false) kube:WindowsGracefulNodeShutdown=true|false (BETA - default=true) kube:WorkloadAwarePreemption=true|false (ALPHA - default=false) kube:WorkloadWithJob=true|false (ALPHA - default=false).PP --goaway- chance=0 HTTP/2 apiserver (GOAWAY). (in-flight) (load balancer) apiserver . GOAWAY . apiserver . 0 () 0.02 (/ ) 0.001 (/) . -h, --help=false kube-apiserver --http2-max-streams-per-connection=0 (streams) HTTP/2 . golang . --kubelet-certificate-authority="" (certificate authority). --kubelet-client-certificate="" TLS. --kubelet-client-key="" TLS. --kubelet-port=10250 : kubelet. --kubelet-preferred-address- types=[Hostname,InternalDNS,InternalIP,ExternalDNS,ExternalIP] (NodeAddressTypes) kubelet. --kubelet-read-only-port=10255 : kubelet. --kubelet-timeout=5s kubelet. --kubernetes-service-node-port=0 Kubernetes ( apiserver / ) NodePort . Kubernetes ClusterIP . --lease-reuse-duration-seconds=60 lease . lease . . --livez-grace-period=0s apiserver (live) . apiserver /livez post-start true . --log-flush-frequency=5s (log flushes) --log-text-info-buffer-size=0 [] info . . (512) 1000 (1K) 1024 (2Ki) (3M, 4G, 5Mi, 6Gi) . LoggingAlphaOptions . --log-text-split-stream=false [] stderr info stdout . stdout . LoggingAlphaOptions . --logging-format="text" . : "text". --max-connection-bytes-per-sec=0 (throttle) . (long- running) . --max-mutating-requests-inflight=200 --enable-priority-and-fairness --max-requests-inflight ( ) . (mutating) . --max-requests-inflight=400 --enable-priority-and-fairness --max-mutating-requests-inflight ( ) . (non-mutating) . --min-compatibility-version=[] control plane . emulated- version . major.minor : '--min- compatibility-version=wardle=1.2,kube=1.31'. : kube=1.33..1.36(:1.35) "kube" --min-request-timeout=1800 (timeout) . watch . --oidc-ca-file="" OpenID oidc-ca-file CA . --oidc-client-id="" OpenID Connect oidc-issuer-url . --oidc-groups-claim="" (claim) OpenID Connect . claim . . --oidc-groups-prefix="" . --oidc-issuer-url="" (URL) OpenID HTTPS . JSON Web Token (JWT) OIDC . --oidc-required-claim= key=value claim ID Token . claim ID Token . claim . --oidc-signing-algs=[RS256] JOSE. 'alg' JWT : RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512. RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1 . --oidc-username-claim="sub" (claim) OpenID . claims ('sub') . . --oidc-username-prefix="" . 'email' URL . '-' . --peer-advertise-ip="" UnknownVersionInteroperabilityProxy IP kube-apiserver kube-apiserver kube- apiserver . kube-apiserver (high availability) . --peer-advertise-port="" UnknownVersionInteroperabilityProxy kube-apiserver kube-apiserver kube- apiserver . kube-apiserver (high availability) . --peer-ca-file="" UnknownVersionInteroperabilityProxy (serving certificates) kube- apiserver . kube-apiserver . --permit-address-sharing=false true SO_REUSEADDR . 0.0.0.0 IP TIME_WAIT . [=false] --permit-port-sharing=false true SO_REUSEPORT . [=false] --profiling=true host:port/debug/pprof/ --proxy-client-cert-file="" aggregator kube-apiserver . api-server (webhook admission plugins) . CA --requestheader-client-ca-file . CA ConfigMap 'extension-apiserver-authentication' kube-system . kube-aggregator CA TLS . --proxy-client-key-file="" aggregator kube-apiserver . api-server . --request-timeout=1m0s . --min-request-timeout . --requestheader-allowed-names=[] (common names) --requestheader-username-headers . --requestheader-client-ca-file . --requestheader-client-ca-file="" (root certificate bundle) --requestheader-username-headers. : (authorization) . --requestheader-extra-headers-prefix=[] . X-Remote-Extra- . --requestheader-group-headers=[] . X-Remote-Group . --requestheader-uid-headers=[] UID. X-Remote-Uid . RemoteRequestHeaderUID ..PP --requestheader-username- headers=[] (request headers) . X-Remote-User . --runtime-config= = (key=value) API . : v1=true|false API (core API) /=true|false API ( apps/v1=true) api/all=true|false API api/ga=true|false API v[0-9]+ api/beta=true|false API v[0-9]+beta[0-9]+ api/alpha=true|false API v[0-9]+alpha[0-9]+ api/legacy --runtime-config-emulation-forward-compatible=false true API group/version --runtime-config (emulation version) . false API group/version --runtime-config . true . --secure-port=6443 HTTPS . 0 . --service-account-extend-token-expiration=true (projected service account) (legacy) (bound service account token) . admission service-account- max-token-expiration . --service-account-issuer=[] (service account). (claim) "iss" . URI . URI OpenID Discovery 1.0 ServiceAccountIssuerDiscovery feature gate true . OpenID : https://openid.net/specs/openid-connect- discovery-1_0.html. service-account-issuer URL https . URL OpenID {service-account-issuer}/.well-known/openid-configuration . . --service-account-jwks-uri="" URI JSON Web Key Set /.well-known/openid-configuration . URL API ( external-hostname ) (relying parties) . --service-account-key-file=[] PEM- encoded x509 RSA ECDSA ServiceAccount . . --tls-private-key-file . --service- account-signing-key-file . --service-account-lookup=true true ServiceAccount etcd . --service-account-max-token-expiration=0s . TokenRequest . --service-account-signing-endpoint="" JWT . --service-account-signing-key-file --service-account-key- file (). feature gate ExternalServiceAccountTokenSigner . --service-account-signing-key-file="" . (ID tokens) . --service-cluster-ip-range="" IP CIDR IP . IP node pod . CIDR (dual-stack) . --service-node-port-range=30000-32767 NodePort. (ephemeral ports) node . : '30000-32767'. . --show-hidden-metrics-for-version="" . (minor) . . : '1.16'. . --shutdown-delay-duration=0s . . /healthz /livez /readyz . (graceful termination) . (load balancer) . --shutdown-send-retry-after=false true HTTP (in flight) 429 'Retry- After' 'Connection: close' TCP . --shutdown-watch-termination-grace-period=0s apiserver watch . --storage-backend="" . : 'etcd3' (). --storage-initialization-timeout=1m0s apiserver. 1m . --storage-media-type="application/vnd.kubernetes.protobuf" (media type) . . : [application/json, application/yaml, application/vnd.kubernetes.protobuf] --strict-transport-security-directives=[] HSTS . HSTS . : 'max- age=31536000,includeSubDomains,preload' --tls-cert-file="" x509 HTTPS. ( CA ). HTTPS --tls- cert-file --tls-private-key-file --cert-dir . --tls-cipher-suites=[] (cipher suites) . Go . : TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256. : TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA. --tls-curve-preferences=[] CurveID crypto/tls Go . Go . Go https://pkg.go.dev/crypto/tls#CurveID . Go . Go . --tls-min-version="" TLS . : VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13 --tls-private-key-file="" x509 --tls-cert-file. --tls-sni-cert-key=[] x509 (FQDN) (wildcard) . IP IP apiserver IP . . . / --tls-sni-cert-key . : "example.crt,example.key" "foo.crt,foo.key:*.foo.com,foo.com". --token-auth-file="" API . --tracing-config-file="" (tracing) apiserver. -v, --v=0 (verbosity) --version=false --version --version=raw --version=vX.Y.Z... --vmodule= pattern=N ( ) --watch-cache=true (watch cache) apiserver --watch-cache-sizes=[] (pod node ) . : resource[.group]#size resource ( ) group apiVersion v1 (API ) size . apiserver CRD watch-cache . ..SH " (HISTORY)" Eric Paris (eparis at redhat dot com) kubernetes ! Manuals User KUBERNETES(1)(kubernetes)