KUBERNETES(1)(kubernetes)

💖 KUBERNETES(1) — kubectl proxy 💖

okay bestie, sit down, hydrate, because we're talking about kubectl proxy from the kubernetes manual, section 1. yes it's a real grown-up manpage. yes i'm making it cute. no i'm not skipping a single flag. let's go 🫶

---

✨ NAME ✨

kubectl proxy — Run a proxy to the Kubernetes API server 🌈

---

🦋 SYNOPSIS 🦋

kubectl proxy [OPTIONS]

---

💅 DESCRIPTION 💅

So like, this command creates a proxy server or application-level gateway between localhost and the Kubernetes API server. it's giving middleman, but make it network. 🌉

it also lets you serve static content over a specified HTTP path — yes, static files too, she contains multitudes.

here's the vibe: all incoming data enters through one port and gets forwarded to the remote Kubernetes API server port. the one exception is the path that matches the static content path — that one doesn't get forwarded, she's just serving files. periodt. ✨

---

👑 OPTIONS 👑

• --accept-hosts="^localhost$,^127\.0\.0\.1$,^\[::1\]$" — regex for the hosts the proxy is willing to accept. it's the bouncer at the door. 🚪
• --accept-paths="^.*" — regex for the paths the proxy should accept. by default she's accepting everything, which, okay, generous queen.
• --address="127.0.0.1" — the IP address to serve on.
• --api-prefix="/" — the prefix the proxied API gets served under.
• --append-server-path=false — if true, turns on automatic path appending of the kube context server path to every single request. ✨
• --disable-filter=false — if true, disables request filtering in the proxy. > ⚠️ bestie this is dangerous — it can leave you vulnerable to XSRF attacks when used with an accessible port. i'm not being dramatic, the manpage said it first. 💀
• --keepalive=0s — keepalive specifies the keep-alive period for an active network connection. set it to 0 to disable keepalive entirely.
• -p, --port=8001 — the port the proxy runs on. set it to 0 to let it pick a random port (chaotic, love that for her 🎲).
• --reject-methods="^$" — regex for HTTP methods the proxy should reject. example: --reject-methods='POST,PUT,PATCH' — blocking the whole trio, iconic behavior.
• --reject-paths="^/api/./pods/./exec,^/api/./pods/./attach" — regex for paths the proxy should reject. paths listed here get rejected even if --accept-paths accepted them. rejection is final, no appeals. 🚫
• -u, --unix-socket="" — unix socket to run the proxy on.
• -w, --www="" — also serve static files from the given directory, under the specified prefix.
• -P, --www-prefix="/static/" — prefix to serve static files under, if a static file directory is specified.

---

🌸 OPTIONS INHERITED FROM PARENT COMMANDS 🌸

these aren't hers, she got them from her parent command. nepo baby but the flags are useful so we move. 💜

• --as="" — username to impersonate for the operation. can be a regular user or a service account in a namespace.
• --as-group=[] — group to impersonate for the operation. repeatable, so you can stack multiple groups. 💫
• --as-uid="" — UID to impersonate for the operation.
• --as-user-extra=[] — user extras to impersonate for the operation. repeatable, so you can specify multiple values for the same key.
• --cache-dir="/home/username/.kube/cache" — default cache directory.
• --certificate-authority="" — path to a cert file for the certificate authority.
• --client-certificate="" — path to a client certificate file for TLS.
• --client-key="" — path to a client key file for TLS.
• --cluster="" — the name of the kubeconfig cluster to use.
• --context="" — the name of the kubeconfig context to use.
• --disable-compression=false — if true, opt out of response compression for all requests to the server.
• --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. > ⚠️ this will make your HTTPS connections insecure. literally what it says. 😭
• --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
• --kuberc="" — path to the kuberc file to use for preferences. you can disable this by exporting KUBECTL_KUBERC=false feature gate or turning off the feature with KUBERC=off.
• --match-server-version=false — require the server version to match the client version.
• -n, --namespace="" — if present, the namespace scope for this CLI request.
• --password="" — password for basic authentication to the API server.
• --profile="none" — name of the profile to capture. one of (none|cpu|heap|goroutine|threadcreate|block|mutex|trace).
• --profile-output="profile.pprof" — name of the file to write the profile to.
• --proxy-url="" — proxy URL to use for requests to the API server.
• --request-timeout="0" — how long to wait before giving up on a single server request. non-zero values should include a time unit (e.g. 1s, 2m, 3h). a value of zero means don't timeout requests — she waits forever, loyal to a fault. 🕰️
• -s, --server="" — the address and port of the Kubernetes API server.
• --tls-server-name="" — server name to use for server certificate validation. if it's not provided, the hostname used to contact the server is used.
• --token="" — bearer token for authentication to the API server.
• --user="" — the name of the kubeconfig user to use.
• --username="" — username for basic authentication to the API server.
• --version=false — --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version.
• --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code. harsh but fair. 💀

---

⭐ EXAMPLE ⭐

these are verbatim, don't touch them, just read and absorb:

# To proxy all of the Kubernetes API and nothing else
kubectl proxy --api-prefix=/

# To proxy only part of the Kubernetes API and also some static files
# You can get pods info with 'curl localhost:8001/api/v1/pods'
kubectl proxy --www=/my/files --www-prefix=/static/ --api-prefix=/api/

# To proxy the entire Kubernetes API at a different root
# You can get pods info with 'curl localhost:8001/custom/api/v1/pods'
kubectl proxy --api-prefix=/custom/

# Run a proxy to the Kubernetes API server on port 8011, serving static content from ./local/www/
kubectl proxy --port=8011 --www=./local/www/

# Run a proxy to the Kubernetes API server on an arbitrary local port
# The chosen port for the server will be output to stdout
kubectl proxy --port=0

# Run a proxy to the Kubernetes API server, changing the API prefix to k8s-api
# This makes e.g. the pods API available at localhost:8001/k8s-api/v1/pods/
kubectl proxy --api-prefix=/k8s-api

---

🎀 SEE ALSO 🎀

• kubectl(1),

---

🌈 HISTORY 🌈

January 2015, originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material — but hopefully they have been automatically generated since! (her words, not mine, and honestly? valid.) 💜

---

okay that's the whole page, no cap, every single flag accounted for 🫶

and for the cute sign-off: this lil' manual lives in the Manuals collection, User category, filed under KUBERNETES(1)(kubernetes) — original author credit goes to Eric Paris, Jan 2015. slay, bye bestie 💅✨🎀🦋🌸👑