# kube-proxy Configuration (v1alpha1)

kube-proxy Configuration (v1alpha1)Resource TypesKubeProxyConfigurationFormatOptionsAppears in:LoggingConfigurationFormatOptions contains options for the different logging formats.FieldDescriptiontext [Required]TextOptions[Alpha] Text contains options for logging format "text". Only available when the LoggingAlphaOptions feature gate is enabled.json [Required]JSONOptions[Alpha] JSON contains options for logging format "json". Only available when the LoggingAlphaOptions feature gate is enabled.JSONOptionsAppears in:FormatOptionsJSONOptions contains options for logging format "json".FieldDescriptionOutputRoutingOptions [Required]OutputRoutingOptions(Members of OutputRoutingOptions are embedded into this type.) No description provided.LogFormatFactoryLogFormatFactory provides support for a certain additional, non-default log format.LoggingConfigurationAppears in:KubeProxyConfigurationKubeletConfigurationLoggingConfiguration contains logging options.FieldDescriptionformat [Required]stringFormat Flag specifies the structure of log messages. default value of format is textflushFrequency [Required]TimeOrMetaDurationMaximum time between log flushes. If a string, parsed as a duration (i.e. "1s") If an int, the maximum number of nanoseconds (i.e. 1s = 1000000000). Ignored if the selected logging backend writes log messages without buffering.verbosity [Required]VerbosityLevelVerbosity is the threshold that determines which log messages are logged. Default is zero which logs only the most important messages. Higher values enable additional messages. Error messages are always logged.vmodule [Required]VModuleConfigurationVModule overrides the verbosity threshold for individual files. Only supported for "text" log format.options [Required]FormatOptions[Alpha] Options holds additional parameters that are specific to the different logging formats. Only the options for the selected format get used, but all of them get validated. Only available when the LoggingAlphaOptions feature gate is enabled.LoggingOptionsLoggingOptions can be used with ValidateAndApplyWithOptions to override certain global defaults.FieldDescriptionErrorStream [Required]io.WriterErrorStream can be used to override the os.Stderr default.InfoStream [Required]io.WriterInfoStream can be used to override the os.Stdout default.OutputRoutingOptionsAppears in:JSONOptionsTextOptionsOutputRoutingOptions contains options that are supported by both "text" and "json".FieldDescriptionsplitStream [Required]bool[Alpha] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write both to stdout, without buffering. Only available when the LoggingAlphaOptions feature gate is enabled.infoBufferSize [Required]k8s.io/apimachinery/pkg/api/resource.QuantityValue[Alpha] InfoBufferSize sets the size of the info stream when using split streams. The default is zero, which disables buffering. Only available when the LoggingAlphaOptions feature gate is enabled.TextOptionsAppears in:FormatOptionsTextOptions contains options for logging format "text".FieldDescriptionOutputRoutingOptions [Required]OutputRoutingOptions(Members of OutputRoutingOptions are embedded into this type.) No description provided.TimeOrMetaDurationAppears in:LoggingConfigurationTimeOrMetaDuration is present only for backwards compatibility for the flushFrequency field, and new fields should use metav1.Duration.FieldDescriptionDuration [Required]meta/v1.DurationDuration holds the duration- [Required]boolSerializeAsString controls whether the value is serialized as a string or an integerVModuleConfiguration(Alias of []k8s.io/component-base/logs/api/v1.VModuleItem)Appears in:LoggingConfigurationVModuleConfiguration is a collection of individual file names or patterns and the corresponding verbosity threshold.VerbosityLevel(Alias of uint32)Appears in:LoggingConfigurationVerbosityLevel represents a klog or logr verbosity threshold.ClientConnectionConfigurationAppears in:KubeProxyConfigurationKubeSchedulerConfigurationGenericControllerManagerConfigurationClientConnectionConfiguration contains details for constructing a client.FieldDescriptionkubeconfig [Required]stringkubeconfig is the path to a KubeConfig file.acceptContentTypes [Required]stringacceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.contentType [Required]stringcontentType is the content type used when sending data to the server from this client.qps [Required]float32qps controls the number of queries per second allowed for this connection.burst [Required]int32burst allows extra queries to accumulate when a client is exceeding its rate.DebuggingConfigurationAppears in:KubeSchedulerConfigurationGenericControllerManagerConfigurationDebuggingConfiguration holds configuration for Debugging related features.FieldDescriptionenableProfiling [Required]boolenableProfiling enables profiling via web interface host:port/debug/pprof/enableContentionProfiling [Required]boolenableContentionProfiling enables block profiling, if enableProfiling is true.LeaderElectionConfigurationAppears in:KubeSchedulerConfigurationGenericControllerManagerConfigurationLeaderElectionConfiguration defines the configuration of leader election clients for components that can run with leader election enabled.FieldDescriptionleaderElect [Required]boolleaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated components for high availability.leaseDuration [Required]meta/v1.DurationleaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.renewDeadline [Required]meta/v1.DurationrenewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.retryPeriod [Required]meta/v1.DurationretryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.resourceLock [Required]stringresourceLock indicates the resource object type that will be used to lock during leader election cycles.resourceName [Required]stringresourceName indicates the name of resource object that will be used to lock during leader election cycles.resourceNamespace [Required]stringresourceName indicates the namespace of resource object that will be used to lock during leader election cycles.KubeProxyConfigurationKubeProxyConfiguration contains everything necessary to configure the Kubernetes proxy server.FieldDescriptionapiVersionstringkubeproxy.config.k8s.io/v1alpha1kindstringKubeProxyConfigurationfeatureGates [Required]map[string]boolfeatureGates is a map of feature names to bools that enable or disable alpha/experimental features.clientConnection [Required]ClientConnectionConfigurationclientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.logging [Required]LoggingConfigurationlogging specifies the options of logging. Refer to Logs Options for more information.hostnameOverride [Required]stringhostnameOverride, if non-empty, will be used as the name of the Node that kube-proxy is running on. If unset, the node name is assumed to be the same as the node's hostname.bindAddress [Required]stringbindAddress can be used to override kube-proxy's idea of what its node's primary IP is. Note that the name is a historical artifact, and kube-proxy does not actually bind any sockets to this IP.healthzBindAddress [Required]stringhealthzBindAddress is the IP address and port for the health check server to serve on, defaulting to "0.0.0.0:10256" (if bindAddress is unset or IPv4), or "[::]:10256" (if bindAddress is IPv6).metricsBindAddress [Required]stringmetricsBindAddress is the IP address and port for the metrics server to serve on, defaulting to "127.0.0.1:10249" (if bindAddress is unset or IPv4), or "[::1]:10249" (if bindAddress is IPv6). (Set to "0.0.0.0:10249" / "[::]:10249" to bind on all interfaces.)bindAddressHardFail [Required]boolbindAddressHardFail, if true, tells kube-proxy to treat failure to bind to a port as fatal and exitenableProfiling [Required]boolenableProfiling enables profiling via web interface on /debug/pprof handler. Profiling handlers will be handled by metrics server.showHiddenMetricsForVersion [Required]stringshowHiddenMetricsForVersion is the version for which you want to show hidden metrics.mode [Required]ProxyModemode specifies which proxy mode to use.iptables [Required]KubeProxyIPTablesConfigurationiptables contains iptables-related configuration options.ipvs [Required]KubeProxyIPVSConfigurationipvs contains ipvs-related configuration options.nftables [Required]KubeProxyNFTablesConfigurationnftables contains nftables-related configuration options.winkernel [Required]KubeProxyWinkernelConfigurationwinkernel contains winkernel-related configuration options.detectLocalMode [Required]LocalModedetectLocalMode determines mode to use for detecting local traffic, defaults to ClusterCIDRdetectLocal [Required]DetectLocalConfigurationdetectLocal contains optional configuration settings related to DetectLocalMode.clusterCIDR [Required]stringclusterCIDR is the CIDR range of the pods in the cluster. (For dual-stack clusters, this can be a comma-separated dual-stack pair of CIDR ranges.). When DetectLocalMode is set to ClusterCIDR, kube-proxy will consider traffic to be local if its source IP is in this range. (Otherwise it is not used.)nodePortAddresses [Required][]stringnodePortAddresses is a list of CIDR ranges that contain valid node IPs, or alternatively, the single string 'primary'. If set to a list of CIDRs, connections to NodePort services will only be accepted on node IPs in one of the indicated ranges. If set to 'primary', NodePort services will only be accepted on the node's primary IPv4 and/or IPv6 address according to the Node object. If unset, NodePort connections will be accepted on all local IPs.oomScoreAdj [Required]int32oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]conntrack [Required]KubeProxyConntrackConfigurationconntrack contains conntrack-related configuration options.configSyncPeriod [Required]meta/v1.DurationconfigSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater than 0.portRange [Required]stringportRange was previously used to configure the userspace proxy, but is now unused.windowsRunAsService [Required]boolwindowsRunAsService, if true, enables Windows service control manager API integration.DetectLocalConfigurationAppears in:KubeProxyConfigurationDetectLocalConfiguration contains optional settings related to DetectLocalMode optionFieldDescriptionbridgeInterface [Required]stringbridgeInterface is a bridge interface name. When DetectLocalMode is set to LocalModeBridgeInterface, kube-proxy will consider traffic to be local if it originates from this bridge.interfaceNamePrefix [Required]stringinterfaceNamePrefix is an interface name prefix. When DetectLocalMode is set to LocalModeInterfaceNamePrefix, kube-proxy will consider traffic to be local if it originates from any interface whose name begins with this prefix.KubeProxyConntrackConfigurationAppears in:KubeProxyConfigurationKubeProxyConntrackConfiguration contains conntrack settings for the Kubernetes proxy server.FieldDescriptionmaxPerCore [Required]int32maxPerCore is the maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore min).min [Required]int32min is the minimum value of connect-tracking records to allocate, regardless of maxPerCore (set maxPerCore=0 to leave the limit as-is).tcpEstablishedTimeout [Required]meta/v1.DurationtcpEstablishedTimeout is how long an idle TCP connection will be kept open (e.g. '2s'). Must be greater than 0 to set.tcpCloseWaitTimeout [Required]meta/v1.DurationtcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE_WAIT state will remain in the conntrack table. (e.g. '60s'). Must be greater than 0 to set.tcpBeLiberal [Required]booltcpBeLiberal, if true, kube-proxy will configure conntrack to run in liberal mode for TCP connections and packets with out-of-window sequence numbers won't be marked INVALID.udpTimeout [Required]meta/v1.DurationudpTimeout is how long an idle UDP conntrack entry in UNREPLIED state will remain in the conntrack table (e.g. '30s'). Must be greater than 0 to set.udpStreamTimeout [Required]meta/v1.DurationudpStreamTimeout is how long an idle UDP conntrack entry in ASSURED state will remain in the conntrack table (e.g. '300s'). Must be greater than 0 to set.KubeProxyIPTablesConfigurationAppears in:KubeProxyConfigurationKubeProxyIPTablesConfiguration contains iptables-related configuration details for the Kubernetes proxy server.FieldDescriptionmasqueradeBit [Required]int32masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the iptables or ipvs proxy mode. Values must be within the range [0, 31].masqueradeAll [Required]boolmasqueradeAll tells kube-proxy to SNAT all traffic sent to Service cluster IPs, when using the iptables or ipvs proxy mode. This may be required with some CNI plugins.localhostNodePorts [Required]boollocalhostNodePorts, if false, tells kube-proxy to disable the legacy behavior of allowing NodePort services to be accessed via localhost. (Applies only to iptables mode and IPv4; localhost NodePorts are never allowed with other proxy modes or with IPv6.)syncPeriod [Required]meta/v1.DurationsyncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.minSyncPeriod [Required]meta/v1.DurationminSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync.KubeProxyIPVSConfigurationAppears in:KubeProxyConfigurationKubeProxyIPVSConfiguration contains ipvs-related configuration details for the Kubernetes proxy server.FieldDescriptionsyncPeriod [Required]meta/v1.DurationsyncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.minSyncPeriod [Required]meta/v1.DurationminSyncPeriod is the minimum period between IPVS rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate IPVS resync.scheduler [Required]stringscheduler is the IPVS scheduler to useexcludeCIDRs [Required][]stringexcludeCIDRs is a list of CIDRs which the ipvs proxier should not touch when cleaning up ipvs services.strictARP [Required]boolstrictARP configures arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interfacetcpTimeout [Required]meta/v1.DurationtcpTimeout is the timeout value used for idle IPVS TCP sessions. The default value is 0, which preserves the current timeout value on the system.tcpFinTimeout [Required]meta/v1.DurationtcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. The default value is 0, which preserves the current timeout value on the system.udpTimeout [Required]meta/v1.DurationudpTimeout is the timeout value used for IPVS UDP packets. The default value is 0, which preserves the current timeout value on the system.KubeProxyNFTablesConfigurationAppears in:KubeProxyConfigurationKubeProxyNFTablesConfiguration contains nftables-related configuration details for the Kubernetes proxy server.FieldDescriptionmasqueradeBit [Required]int32masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the nftables proxy mode. Values must be within the range [0, 31].masqueradeAll [Required]boolmasqueradeAll tells kube-proxy to SNAT all traffic sent to Service cluster IPs, when using the nftables mode. This may be required with some CNI plugins.syncPeriod [Required]meta/v1.DurationsyncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.minSyncPeriod [Required]meta/v1.DurationminSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync.KubeProxyWinkernelConfigurationAppears in:KubeProxyConfigurationKubeProxyWinkernelConfiguration contains Windows/HNS settings for the Kubernetes proxy server.FieldDescriptionnetworkName [Required]stringnetworkName is the name of the network kube-proxy will use to create endpoints and policiessourceVip [Required]stringsourceVip is the IP address of the source VIP endpoint used for NAT when loadbalancingenableDSR [Required]boolenableDSR tells kube-proxy whether HNS policies should be created with DSRrootHnsEndpointName [Required]stringrootHnsEndpointName is the name of hnsendpoint that is attached to l2bridge for root network namespaceforwardHealthCheckVip [Required]boolforwardHealthCheckVip forwards service VIP for health check port on WindowsLocalMode(Alias of string)Appears in:KubeProxyConfigurationLocalMode represents modes to detect local traffic from the nodeProxyMode(Alias of string)Appears in:KubeProxyConfigurationProxyMode represents modes used by the Kubernetes proxy server.Three modes of proxy are available on Linux platforms: iptables, ipvs, and nftables. One mode of proxy is available on Windows platforms: kernelspace.If the proxy mode is unspecified, a default proxy mode will be used (currently this is iptables on Linux and kernelspace on Windows). If the selected proxy mode cannot be used (due to lack of kernel support, missing userspace components, etc) then kube-proxy will exit with an error.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.