OC(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💅 OC(1) — ok bestie, let's talk about oc proxy 🫶

You're looking at the <cyan>oc</cyan> manual page, and specifically the <pink>oc proxy</pink> command, because apparently you want a whole proxy server and you want it now. No cap, this one's a baddie.

✨ NAME ✨

oc proxy — literally just runs a proxy to the Kubernetes API server. That's the whole assignment. 💅

🦋 SYNOPSIS 🦋

oc proxy [OPTIONS]

🌸 DESCRIPTION 🌸

Okay so picture this: it creates a proxy server, or if you're feeling fancy, an application-level gateway, sitting right between localhost and the Kubernetes API server. Iconic behavior honestly. ✨

It also lets you serve static content over whatever HTTP path you specify — because why not, main character energy.

Here's the vibe check on how data flows: all incoming data enters through one port and gets forwarded to the remote Kubernetes API server port. The one exception? Paths that match the static content path — those get served as static content instead. Periodt. 💖

🎀 OPTIONS 🎀

  • --accept-hosts="^localhost$,^127\.0\.0\.1$,^\[::1\]$" — the regular expression for hosts the proxy should accept. Default only trusts localhost stuff, lowkey protective. 🔒
  • --accept-paths="^.*" — regular expression for paths the proxy should accept. Default is "everything," so, slay.
  • --address="127.0.0.1" — the IP address to serve on.
  • --api-prefix="/" — the prefix to serve the proxied API under.
  • --append-server-path=false — if true, it enables automatic path appending of the kube context server path to each request.
  • --disable-filter=false — if true, disables request filtering in the proxy.
⚠️ Bestie, listen to me: this is dangerous. It can leave you vulnerable to XSRF attacks when used with an accessible port. Do not just turn this on for funsies. 😭
  • --keepalive=0 — keepalive specifies the keep-alive period for an active network connection. Set it to 0 to disable keepalive.
  • -p, --port=8001 — the port to run the proxy on. Set it to 0 and it'll pick a random port for you. Cute.
  • --reject-methods="^$" — regular expression for HTTP methods the proxy should reject. Example: --reject-methods='POST,PUT,PATCH'. 🙅‍♀️
  • --reject-paths="^/api/./pods/./exec,^/api/./pods/./attach" — regular expression for paths the proxy should reject. And heads up: paths specified here get rejected even if they're accepted by --accept-paths. Rejection wins, no discussion. 💀
  • -u, --unix-socket="" — the Unix socket to run the proxy on.
  • -w, --www="" — also serve static files from the given directory, under the specified prefix.
  • -P, --www-prefix="/static/" — the prefix to serve static files under, if a static file directory is specified.

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

Yep, these come from the parent command — but they're still yours, bestie. 🫶

  • --as="" — username to impersonate for the operation. User could be a regular user or a service account in a namespace.
  • --as-group=[] — group to impersonate for the operation. This flag can be repeated to specify multiple groups.
  • --as-uid="" — UID to impersonate for the operation.
  • --as-user-extra=[] — user extras to impersonate for the operation. This flag can be repeated to specify multiple values for the same key.
  • --cache-dir="/homeless-shelter/.kube/cache" — default cache directory.
  • --certificate-authority="" — path to a cert file for the certificate authority.
  • --client-certificate="" — path to a client certificate file for TLS.
  • --client-key="" — path to a client key file for TLS.
  • --cluster="" — the name of the kubeconfig cluster to use.
  • --context="" — the name of the kubeconfig context to use.
  • --disable-compression=false — if true, opt out of response compression for all requests to the server.
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity.
🙈 This will make your HTTPS connections insecure. Like, actually insecure. You've been warned.
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — path to the kuberc file to use for preferences. This can be disabled by exporting the KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
  • --match-server-version=false — require server version to match client version.
  • -n, --namespace="" — if present, the namespace scope for this CLI request.
  • --profile="none" — name of the profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex).
  • --profile-output="profile.pprof" — name of the file to write the profile to.
  • --request-timeout="0" — how long to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. ✨
  • -s, --server="" — the address and port of the Kubernetes API server.
  • --tls-server-name="" — server name to use for server certificate validation. If it's not provided, the hostname used to contact the server is used.
  • --token="" — bearer token for authentication to the API server.
  • --user="" — the name of the kubeconfig user to use.
  • --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code. Harsh but fair. 💅

💜 EXAMPLE 💜

Okay this is the part where it all clicks, watch:

# To proxy all of the Kubernetes API and nothing else
oc proxy --api-prefix=/

# To proxy only part of the Kubernetes API and also some static files
# You can get pods info with 'curl localhost:8001/api/v1/pods'
oc proxy --www=/my/files --www-prefix=/static/ --api-prefix=/api/

# To proxy the entire Kubernetes API at a different root
# You can get pods info with 'curl localhost:8001/custom/api/v1/pods'
oc proxy --api-prefix=/custom/

# Run a proxy to the Kubernetes API server on port 8011, serving static content from ./local/www/
oc proxy --port=8011 --www=./local/www/

# Run a proxy to the Kubernetes API server on an arbitrary local port
# The chosen port for the server will be output to stdout
oc proxy --port=0

# Run a proxy to the Kubernetes API server, changing the API prefix to k8s-api
# This makes e.g. the pods API available at localhost:8001/k8s-api/v1/pods/
oc proxy --api-prefix=/k8s-api

Not me reading this and immediately wanting to --port=0 just to see the random port print to stdout. 😭🔥

🌈 SEE ALSO 🌈

That's it. That's the list. One icon. 👑

🧚 HISTORY 🧚

June 2016 — ported from the Kubernetes man-doc generator. So it's a vintage, and it still ate. 💅✨

And that's the whole page, bestie! 🎀 This absolute legend of a doc is brought to you by Openshift — the Openshift CLI User Manuals — dated all the way back to June 2016, and titled, of course, OC(1). Go forth and proxy responsibly. 🦋💖🌸

📦 where this page comes from