kube-controller-manager [page]deterministic
##
The Kubernetes controller manager is a daemon that embeds the core control loops shipped with Kubernetes. In applications of robotics and automation, a control loop is a non-terminating loop that regulates the state of the system. In Kubernetes, a controller is a control loop that watches the shared state of the cluster through the apiserver and makes changes attempting to move the current state towards the desired state. Examples of controllers that ship with Kubernetes today are the replication controller, endpoints controller, namespace controller, and serviceaccounts controller.
``` kube-controller-manager [flags] ```
##
<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> </colgroup> <tbody>
<tr> <td colspan="2">--allocate-node-cidrs</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Should CIDRs for Pods be allocated and set on the cloud provider. Requires --cluster-cidr.</p></td> </tr>
<tr> <td colspan="2">--allow-metric-labels stringToString Default: []</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.</p></td> </tr>
<tr> <td colspan="2">--allow-metric-labels-manifest string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The path to the manifest file that contains the allow-list mapping. The format of the file is the same as the flag --allow-metric-labels, i.e.,<br/>allowListMapping:<br/>"metric1,label1": "value11,value12"<br/>"metric2,label2": ""<br/>Note that the flag --allow-metric-labels will override the manifest file.</p></td> </tr>
<tr> <td colspan="2">--attach-detach-reconcile-sync-period duration Default: 1m0s</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The reconciler sync wait time between volume attach detach. This duration must be larger than one second, and increasing this value from the default may allow for volumes to be mismatched with pods.</p></td> </tr>
<tr> <td colspan="2">--authentication-kubeconfig string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>kubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.</p></td> </tr>
<tr> <td colspan="2">--authentication-skip-lookup</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.</p></td> </tr>
<tr> <td colspan="2">--authentication-token-webhook-cache-ttl duration Default: 10s</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The duration to cache responses from the webhook token authenticator.</p></td> </tr>
<tr> <td colspan="2">--authentication-tolerate-lookup-failure</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.</p></td> </tr>
<tr> <td colspan="2">--authorization-always-allow-paths strings Default: "/healthz,/readyz,/livez"</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>A list of HTTP paths to skip during authorization, i.e. these are authorized without conta …(trimmed)