KUBERNETES(1)(kubernetes) KUBERNETES(1)(kubernetes) Eric Paris Jan 2015 (NAME) kube-controller-manager - (SYNOPSIS) kube-controller-manager [OPTIONS] (DESCRIPTION) (Kubernetes controller manager) . . apiserver . (replication controller) (endpoints controller) (namespace controller) (serviceaccounts controller) . (OPTIONS) --allocate-node-cidrs=false CIDR . --cluster-cidr . --allow-metric-labels=[] . , . ,... : metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'. --allow-metric-labels-manifest="" . --allow-metric-labels : allowListMapping: "metric1,label1": "value11,value12" "metric2,label2": "" --allow-metric-labels . --allow-untagged-cloud=false (cluster-id) . () cluster-id . --attach-detach-reconcile-sync-period=1m0s (reconciler) (attach) (detach) . . --authentication-kubeconfig="" kubeconfig (core) tokenreviews.authentication.k8s.io . . CA . --authentication-skip-lookup=false false authentication-kubeconfig . --authentication-token-webhook-cache-ttl=10s (). --authentication-tolerate-lookup-failure=false true (fatal) . . --authorization-always-allow-paths=[/healthz,/readyz,/livez] HTTP . --authorization-kubeconfig="" kubeconfig subjectaccessreviews.authorization.k8s.io . . (forbidden) . --authorization-webhook-cache-authorized-ttl=10s <<>> (authorized) . --authorization-webhook-cache-unauthorized-ttl=10s <<>> (unauthorized) . --bind-address=0.0.0.0 IP --secure-port . . (0.0.0.0 ::) IP . --cert-dir="" TLS. --tls-cert-file --tls-private-key-file . --cidr-allocator-type="RangeAllocator" CIDR . --client-ca-file="" client-ca-file CommonName . --cloud-config="" . . --cloud-provider="" . . --cluster-cidr="" CIDR . --allocate-node-cidrs=true false . --cluster-name="kubernetes" . --cluster-signing-cert-file="" X509 CA PEM . --cluster-signing-* . --cluster-signing-duration=8760h0m0s . CSR spec.expirationSeconds . --cluster-signing-key-file="" RSA ECDSA PEM . --cluster-signing-* . --cluster-signing-kube-apiserver-client-cert-file="" X509 CA PEM kubernetes.io/kube-apiserver-client . --cluster-signing-{cert,key}-file . --cluster-signing-kube-apiserver-client-key-file="" RSA ECDSA PEM kubernetes.io/kube-apiserver-client . --cluster-signing-{cert,key}-file . --cluster-signing-kubelet-client-cert-file="" X509 CA PEM kubernetes.io/kube-apiserver-client-kubelet . --cluster-signing-{cert,key}-file . --cluster-signing-kubelet-client-key-file="" RSA ECDSA PEM kubernetes.io/kube-apiserver-client-kubelet . --cluster-signing-{cert,key}-file . --cluster-signing-kubelet-serving-cert-file="" X509 CA PEM kubernetes.io/kubelet-serving . --cluster-signing-{cert,key}-file . --cluster-signing-kubelet-serving-key-file="" RSA ECDSA PEM kubernetes.io/kubelet-serving . --cluster-signing-{cert,key}-file . --cluster-signing-legacy-unknown-cert-file="" X509 CA PEM kubernetes.io/legacy-unknown . --cluster-signing-{cert,key}-file . --cluster-signing-legacy-unknown-key-file="" RSA ECDSA PEM kubernetes.io/legacy-unknown . --cluster-signing-{cert,key}-file . --concurrent-cron-job-syncs=5 (cron job) . = (CPU) . --concurrent-daemonset-syncs=2 (daemonset) . = . --concurrent-deployment-syncs=5 (deployment) . = . --concurrent-device-taint-eviction-syncs=8 ( DeviceTaintRule). = . --concurrent-endpoint-syncs=5 . = . --concurrent-ephemeralvolume-syncs=5 (ephemeral volume) . = . --concurrent-gc-syncs=20 (garbage collector) . --concurrent-horizontal-pod-autoscaler-syncs=5 (HPA) . = . --concurrent-job-syncs=5 (job) . = . --concurrent-namespace-syncs=10 (namespace) . = . --concurrent-replicaset-syncs=5 (replica sets) . = . --concurrent-resource-quota-syncs=5 (resource quotas) . = . --concurrent-resourceclaim-syncs=50 ( ResourceClaim). = . --concurrent-service-endpoint-syncs=5 . = (endpoint slice) . 5 . --concurrent-service-syncs=1 . = . --concurrent-serviceaccount-token-syncs=5 . = . --concurrent-statefulset-syncs=5 (statefulset) . = . --concurrent-ttl-after-finished-syncs=5 ttl-after-finished- controller . --concurrent-validating-admission-policy-status-syncs=5 ValidatingAdmissionPolicyStatusController . --concurrent_rc_syncs=5 (replication controllers) . = . --configure-cloud-routes=true CIDR allocate-node-cidrs . --contention-profiling=false (block profiling) . --controller-shutdown-timeout=10s . --controller-start-interval=0s . --controllers=[] . '' 'foo' 'foo' '-foo' 'foo' . : bootstrap-signer-controller, certificatesigningrequest-approving-controller, certificatesigningrequest-cleaner-controller, certificatesigningrequest-signing-controller, cloud-node-lifecycle- controller, clusterrole-aggregation-controller, cronjob-controller, daemonset-controller, deployment-controller, device-taint-eviction- controller, disruption-controller, endpoints-controller, endpointslice- controller, endpointslice-mirroring-controller, ephemeral-volume- controller, garbage-collector-controller, horizontal-pod-autoscaler- controller, job-controller, kube-apiserver-serving-clustertrustbundle- publisher-controller, legacy-serviceaccount-token-cleaner-controller, namespace-controller, node-ipam-controller, node-lifecycle-controller, node-route-controller, persistentvolume-attach-detach-controller, persistentvolume-binder-controller, persistentvolume-expander- controller, persistentvolume-protection-controller, persistentvolumeclaim-protection-controller, pod-garbage-collector- controller, podcertificaterequest-cleaner-controller, podgroup- protection-controller, replicaset-controller, replicationcontroller- controller, resourceclaim-controller, resourcepoolstatusrequest- controller, resourcequota-controller, root-ca-certificate-publisher- controller, selinux-warning-controller, service-cidr-controller, service-lb-controller, serviceaccount-controller, serviceaccount-token- controller, statefulset-controller, storage-version-migrator- controller, storageversion-garbage-collector-controller, taint- eviction-controller, token-cleaner-controller, ttl-after-finished- controller, ttl-controller, validatingadmissionpolicy-status- controller, volumeattributesclass-protection-controller : bootstrap-signer-controller, selinux-warning- controller, token-cleaner-controller --disable-attach-detach-reconcile-sync=false . . --disable-force-detach-on-timeout=false (unmount) . true (non- graceful node shutdown) . https://k8s.io/docs/storage-disable-force-detach-on- timeout . --disable-http2-serving=false true HTTP2 [=false]. --disabled-metrics=[] . . : . --emulated-version=[] (API ...) . . major.minor : '--emulated-version=wardle=1.2,kube=1.31'. : kube=1.33..1.36 (: 1.36) "kube" . --enable-dynamic-provisioning=true (dynamic provisioning) . --enable-garbage-collector=true (generic garbage collector). kube-apiserver . --enable-hostpath-provisioner=false PV HostPath . . HostPath . --enable-leader-migration=false . --endpoint-updates-batch-period=0s . . = . --endpointslice-updates-batch-period=0s (EndpointSlice). . = . --external-cloud-volume-plugin="" external . cloud-provider . node-ipam-controller persistentvolume-binder-controller persistentvolume-expander- controller attach-detach-controller (in tree) . --feature-gates= component:key=value / . "kube" . . : --feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature-gates 'kube:featureC=true' : kube:APIResponseCompression=true|false (BETA - default=true) kube:APIServerIdentity=true|false (BETA - default=true) kube:APIServingWithRoutine=true|false (ALPHA - default=false) kube:AllAlpha=true|false (ALPHA - default=false) kube:AllBeta=true|false (BETA - default=false) kube:AllowParsingUserUIDFromCertAuth=true|false (BETA - default=true) kube:AllowUnsafeMalformedObjectDeletion=true|false (ALPHA - default=false) kube:AtomicFIFO=true|false (BETA - default=true) kube:AuthorizePodWebsocketUpgradeCreatePermission=true|false (BETA - default=true) kube:CBORServingAndStorage=true|false (ALPHA - default=false) kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false) kube:CPUManagerPolicyBetaOptions=true|false (BETA - default=true) kube:CRDObservedGenerationTracking=true|false (BETA - default=true) kube:CRIListStreaming=true|false (ALPHA - default=false) kube:CSIVolumeHealth=true|false (ALPHA - default=false) kube:ClearingNominatedNodeNameAfterBinding=true|false (BETA - default=true) kube:ClientsAllowCARotation=true|false (BETA - default=true) kube:ClientsAllowCBOR=true|false (ALPHA - default=false) kube:ClientsAllowTLSCacheGC=true|false (BETA - default=true) kube:ClientsPreferCBOR=true|false (ALPHA - default=false) kube:CloudControllerManagerWatchBasedRoutesReconciliation=true|false (ALPHA - default=false) kube:CloudControllerManagerWebhook=true|false (ALPHA - default=false) kube:ClusterTrustBundle=true|false (BETA - default=false) kube:ClusterTrustBundleProjection=true|false (BETA - default=false) kube:ComponentFlagz=true|false (BETA - default=true) kube:ComponentStatusz=true|false (BETA - default=true) kube:ConcurrentWatchObjectDecode=true|false (BETA - default=false) kube:ConstrainedImpersonation=true|false (BETA - default=true) kube:ContainerCheckpoint=true|false (BETA - default=true) kube:ContainerRestartRules=true|false (BETA - default=true) kube:ContainerStopSignals=true|false (ALPHA - default=false) kube:ContextualLogging=true|false (BETA - default=true) kube:ControllerManagerReleaseLeaderElectionLockOnExit=true|false (ALPHA - default=false) kube:CoordinatedLeaderElection=true|false (BETA - default=false) kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false) kube:DRAConsumableCapacity=true|false (BETA - default=true) kube:DRADeviceBindingConditions=true|false (BETA - default=true) kube:DRADeviceTaintRules=true|false (BETA - default=false) kube:DRADeviceTaints=true|false (BETA - default=true) kube:DRAExtendedResource=true|false (BETA - default=true) kube:DRAListTypeAttributes=true|false (ALPHA - default=false) kube:DRANodeAllocatableResources=true|false (ALPHA - default=false) kube:DRAPartitionableDevices=true|false (BETA - default=true) kube:DRAResourceClaimDeviceStatus=true|false (BETA - default=true) kube:DRAResourceClaimGranularStatusAuthorization=true|false (BETA - default=true) kube:DRAResourcePoolStatus=true|false (ALPHA - default=false) kube:DRASchedulerFilterTimeout=true|false (BETA - default=true) kube:DRAWorkloadResourceClaims=true|false (ALPHA - default=false) kube:DeclarativeValidationBeta=true|false (BETA - default=true) kube:DeploymentReplicaSetTerminatingReplicas=true|false (BETA - default=true) kube:DetectCacheInconsistency=true|false (BETA - default=true) kube:EnvFiles=true|false (BETA - default=true) kube:EventedPLEG=true|false (ALPHA - default=false) kube:ExtendWebSocketsToKubelet=true|false (BETA - default=true) kube:GangScheduling=true|false (ALPHA - default=false) kube:GenericWorkload=true|false (ALPHA - default=false) kube:GracefulNodeShutdown=true|false (BETA - default=true) kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true) kube:HPAConfigurableTolerance=true|false (BETA - default=true) kube:HPAScaleToZero=true|false (ALPHA - default=false) kube:HostnameOverride=true|false (BETA - default=true) kube:ImageVolumeWithDigest=true|false (ALPHA - default=false) kube:InOrderInformersBatchProcess=true|false (BETA - default=true) kube:InPlacePodLevelResourcesVerticalScaling=true|false (BETA - default=true) kube:InPlacePodVerticalScalingExclusiveCPUs=true|false (ALPHA - default=false) kube:InPlacePodVerticalScalingExclusiveMemory=true|false (ALPHA - default=false) kube:InPlacePodVerticalScalingInitContainers=true|false (BETA - default=true) kube:KubeletCrashLoopBackOffMax=true|false (BETA - default=true) kube:KubeletEnsureSecretPulledImages=true|false (BETA - default=true) kube:KubeletInUserNamespace=true|false (ALPHA - default=false) kube:KubeletSeparateDiskGC=true|false (BETA - default=true) kube:KubeletServiceAccountTokenForCredentialProviders=true|false (BETA - default=true) kube:ListFromCacheSnapshot=true|false (BETA - default=true) kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false) kube:LoggingAlphaOptions=true|false (ALPHA - default=false) kube:LoggingBetaOptions=true|false (BETA - default=true) kube:ManifestBasedAdmissionControlConfig=true|false (ALPHA - default=false) kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true) kube:MatchLabelKeysInPodTopologySpreadSelectorMerge=true|false (BETA - default=true) kube:MaxUnavailableStatefulSet=true|false (BETA - default=false) kube:MemoryQoS=true|false (ALPHA - default=false) kube:MutablePVNodeAffinity=true|false (ALPHA - default=false) kube:MutablePodResourcesForSuspendedJobs=true|false (BETA - default=true) kube:MutableSchedulingDirectivesForSuspendedJobs=true|false (BETA - default=true) kube:NativeHistograms=true|false (ALPHA - default=false) kube:NodeDeclaredFeatures=true|false (BETA - default=true) kube:NominatedNodeNameForExpectation=true|false (BETA - default=true) kube:OpenAPIEnums=true|false (BETA - default=true) kube:OpportunisticBatching=true|false (BETA - default=true) kube:PLEGOnDemandRelist=true|false (BETA - default=true) kube:PersistentVolumeClaimUnusedSinceTime=true|false (ALPHA - default=false) kube:PodAndContainerStatsFromCRI=true|false (ALPHA - default=false) kube:PodCertificateRequest=true|false (BETA - default=false) kube:PodDeletionCost=true|false (BETA - default=true) kube:PodLevelResourceManagers=true|false (ALPHA - default=false) kube:PodLevelResources=true|false (BETA - default=true) kube:PodLogsQuerySplitStreams=true|false (ALPHA - default=false) kube:PodReadyToStartContainersCondition=true|false (BETA - default=true) kube:PodTopologyLabelsAdmission=true|false (BETA - default=true) kube:PodsAPI=true|false (ALPHA - default=false) kube:PortForwardWebsockets=true|false (BETA - default=true) kube:PreventStaticPodAPIReferences=true|false (BETA - default=true) kube:QOSReserved=true|false (ALPHA - default=false) kube:ReduceDefaultCrashLoopBackOffDecay=true|false (ALPHA - default=false) kube:RelaxedServiceNameValidation=true|false (BETA - default=true) kube:ReloadKubeletClientCAFile=true|false (BETA - default=true) kube:ReloadKubeletServerCertificateFile=true|false (BETA - default=true) kube:RemoteRequestHeaderUID=true|false (BETA - default=true) kube:ResourceHealthStatus=true|false (BETA - default=true) kube:ResourceHealthStatusMessage=true|false (BETA - default=true) kube:RestartAllContainersOnContainerExits=true|false (BETA - default=true) kube:RotateKubeletServerCertificate=true|false (BETA - default=true) kube:RuntimeClassInImageCriApi=true|false (ALPHA - default=false) kube:SELinuxMount=true|false (BETA - default=false) kube:SchedulerAsyncAPICalls=true|false (BETA - default=false) kube:SchedulerAsyncPreemption=true|false (BETA - default=true) kube:SchedulerPopFromBackoffQ=true|false (BETA - default=true) kube:ServiceAccountNodeAudienceRestriction=true|false (BETA - default=true) kube:ShardedListAndWatch=true|false (ALPHA - default=false) kube:SizeBasedListCostEstimate=true|false (BETA - default=true) kube:StaleControllerConsistencyDaemonSet=true|false (BETA - default=true) kube:StaleControllerConsistencyJob=true|false (BETA - default=true) kube:StaleControllerConsistencyReplicaSet=true|false (BETA - default=true) kube:StaleControllerConsistencyStatefulSet=true|false (BETA - default=true) kube:StatefulSetSemanticRevisionComparison=true|false (BETA - default=true) kube:StorageCapacityScoring=true|false (ALPHA - default=false) kube:StorageVersionAPI=true|false (ALPHA - default=false) kube:StorageVersionHash=true|false (BETA - default=true) kube:StorageVersionMigrator=true|false (BETA - default=false) kube:StrictIPCIDRValidation=true|false (BETA - default=true) kube:StructuredAuthenticationConfigurationEgressSelector=true|false (BETA - default=true) kube:StructuredAuthenticationConfigurationJWKSMetrics=true|false (BETA - default=true) kube:TaintTolerationComparisonOperators=true|false (ALPHA - default=false) kube:TokenRequestServiceAccountUIDValidation=true|false (BETA - default=true) kube:TopologyAwareWorkloadScheduling=true|false (ALPHA - default=false) kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false) kube:TopologyManagerPolicyBetaOptions=true|false (BETA - default=true) kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true) kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true) kube:UnknownVersionInteroperabilityProxy=true|false (BETA - default=true) kube:UnlockWhileProcessingFIFO=true|false (BETA - default=true) kube:UserNamespacesHostNetworkSupport=true|false (ALPHA - default=false) kube:VolumeLimitScaling=true|false (ALPHA - default=false) kube:WatchCacheInitializationPostStartHook=true|false (BETA - default=true) kube:WatchList=true|false (BETA - default=true) kube:WatchListClient=true|false (BETA - default=true) kube:WindowsCPUAndMemoryAffinity=true|false (ALPHA - default=false) kube:WindowsGracefulNodeShutdown=true|false (BETA - default=true) kube:WorkloadAwarePreemption=true|false (ALPHA - default=false) kube:WorkloadWithJob=true|false (ALPHA - default=false) --flex-volume-plugin-dir="/usr/libexec/kubernetes/kubelet- plugins/volume/exec/" flex volume . -h, --help=false kube-controller- manager. --horizontal-pod-autoscaler-cpu-initialization-period=5m0s (CPU) . --horizontal-pod-autoscaler-downscale-stabilization=5m0s . --horizontal-pod-autoscaler-initial-readiness-delay=30s . --horizontal-pod-autoscaler-sync-period=15s . --horizontal-pod-autoscaler-tolerance=0.1 ( .) . --http2-max-streams-per-connection=0 HTTP/2 . Go . --kube-api-burst=30 (Burst) apiserver . --kube-api-content-type="application/vnd.kubernetes.protobuf" apiserver. --kube-api-qps=20 (QPS) apiserver . --kubeconfig="" kubeconfig ( master ). --large-cluster-size-threshold=50 node- lifecycle-controller (eviction) . --secondary-node-eviction-rate 0 . : (zone) . --leader-elect=true . (HA) . --leader-elect-lease-duration=15s . . . --leader-elect-renew-deadline=10s . . . --leader-elect-resource-lock="leases" . 'leases' . --leader-elect-resource-name="kube-controller-manager" . --leader-elect-resource-namespace="kube-system" . --leader-elect-retry-period=2s . . --leader-migration-config="" . LeaderMigrationConfiguration controllermanager.config.k8s.io v1alpha1 . --legacy-service-account-token-clean-up-period=8760h0m0s . --log-flush-frequency=5s . --log-text-info-buffer-size=0 [] info . . (512) 1000 (1K) 1024 (2Ki) (3M, 4G, 5Mi, 6Gi) . LoggingAlphaOptions . --log-text-split-stream=false [] stderr stdout . stdout . LoggingAlphaOptions . --logging-format="text" . : "text". --master="" API ( kubeconfig ). --max-endpoints-per-slice=100 EndpointSlice . . 100 . --min-compatibility-version=[] (control plane) . emulated-version . major.minor : '--min-compatibility- version=wardle=1.2,kube=1.31'. : kube=1.33..1.36 (: 1.35) "kube" . --min-resync-period=12h0m0s (resync) (reflectors) MinResyncPeriod 2*MinResyncPeriod . --mirroring-concurrent-service-endpoint-syncs=5 endpointslice-mirroring-controller . = . 5 . --mirroring-endpointslice-updates-batch-period=0s EndpointSlice endpointslice-mirroring-controller. EndpointSlice EndpointSlice . = . --mirroring-max-endpoints-per-subset=1000 endpointslice-mirroring-controller EndpointSlice . . 100 . --namespace-sync-period=5m0s (namespace). --node-cidr-mask-size=0 CIDR . IPv4 24 IPv6 64 . --node-cidr-mask-size-ipv4=0 CIDR IPv4 (dual-stack). 24 . --node-cidr-mask-size-ipv6=0 CIDR IPv6 (dual-stack). 64 . --node-eviction-rate=0.1 ( / --unhealthy-zone-threshold ). . --node-monitor-grace-period=50s . N nodeStatusUpdateFrequency kubelet N kubelet . HTTP2_PING_TIMEOUT_SECONDS HTTP2_READ_IDLE_TIMEOUT_SECONDS . --node-monitor-period=5s NodeStatus cloud-node-lifecycle- controller. --node-startup-grace-period=1m0s . --node-sync-period=0s . node-monitor-period route- reconciliation-period . --permit-address-sharing=false true SO_REUSEADDR . IP 0.0.0.0 IP TIME_WAIT [=false]. --permit-port-sharing=false true SO_REUSEPORT [=false]. --profiling=true host:port/debug/pprof/. --pv-recycler-increment-timeout-nfs=30 (Gi) ActiveDeadlineSeconds NFS. --pv-recycler-minimum-timeout-hostpath=60 ActiveDeadlineSeconds HostPath. . --pv-recycler-minimum-timeout-nfs=300 ActiveDeadlineSeconds NFS. --pv-recycler-pod-template-filepath-hostpath="" HostPath . . --pv-recycler-pod-template-filepath-nfs="" NFS . --pv-recycler-timeout-increment-hostpath=30 (Gi) ActiveDeadlineSeconds HostPath. . --pvclaimbinder-sync-period=15s (PV) (PVC). --requestheader-allowed-names=[] (Common Names) --requestheader-username-headers . --requestheader-client-ca-file . --requestheader-client-ca-file="" --requestheader-username-headers. : . --requestheader-extra-headers-prefix=[x-remote-extra-] . X-Remote-Extra- . --requestheader-group-headers=[x-remote-group] . X-Remote-Group . --requestheader-uid-headers=[] (UID). X-Remote-Uid . RemoteRequestHeaderUID . --requestheader-username-headers=[x-remote-user] . X-Remote-User . --resource-quota-sync-period=5m0s . --root-ca-file="" . CA PEM . --route-reconciliation-period=10s . --secondary-node-eviction-rate=0.01 ( / --unhealthy-zone-threshold ). . --large-cluster-size-threshold 0 . --secure-port=10257 HTTPS . 0 HTTPS . --service-account-private-key-file="" . RSA ECDSA PEM . --service-cluster-ip-range="" CIDR . --allocate-node-cidrs=true false . --show-hidden-metrics-for-version="" . (minor) . . : '1.16'. . --terminated-pod-gc-threshold=12500 . 0 . --tls-cert-file="" x509 HTTPS ( CA ). HTTPS --tls-cert-file --tls-private-key- file --cert-dir . --tls-cipher-suites=[] (cipher suites) . Go . : TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256. : TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA. --tls-curve-preferences=[] CurveID crypto/tls Go . Go . Go https://pkg.go.dev/crypto/tls#CurveID . Go . Go . --tls-min-version="" TLS . : VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. --tls-private-key-file="" x509 --tls-cert-file. --tls-sni-cert-key=[] x509 (FQDN) ( /wildcard) . IP IP apiserver IP . . . / --tls-sni-cert-key . : "example.crt,example.key" "foo.crt,foo.key:*.foo.com,foo.com". --unhealthy-zone-threshold=0.55 Ready ( ) . --use-service-account-credentials=false true . -v, --v=0 (verbosity) . --version=false --version --version=raw --version=vX.Y.Z... . --vmodule= pattern=N ( ). (HISTORY) (eparis at redhat dot com) ! Manuals User KUBERNETES(1)(kubernetes)