OS Manuals

/usr/bin/proxy-agent

Konnectivity proxy-agent (worker-node component) that dials back to the proxy-server and relays traffic to in-cluster destinations

From apiserver-network-proxy-0.37-agent 0.37.0-r5 (enterprise-packages), captured 2026-11-08 by running proxy-agent --help (exit 0). permalink

A gRPC agent, Connects to the proxy and then allows traffic to be forwarded to it.

Usage:
  agent [flags]

Flags:
      --add-dir-header                      If true, adds the file directory to the header of the log messages
      --admin-bind-address string           Bind address for admin connections. If empty, we will bind to all interfaces. (default "127.0.0.1")
      --admin-server-port int               The port the admin server is listening on. (default 8094)
      --agent-cert string                   If non-empty secure communication with this cert.
      --agent-id string                     The unique ID of this agent. Can also be set by the 'PROXY_AGENT_ID' environment variable. Default to a generated uuid if not set. (default "d5d5bc92-7729-4efd-b14b-9bb767740ef3")
      --agent-identifiers string            Identifiers of the agent that will be used by the server when choosing agent. N.B. the list of identifiers must be in URL encoded format. e.g.,host=localhost&host=node1.mydomain.com&cidr=127.0.0.1/16&ipv4=1.2.3.4&ipv4=5.6.7.8&ipv6=:::::&default-route=true
      --agent-key string                    If non-empty secure communication with this key.
      --alpn-proto strings                  Additional ALPN protocols to be presented when connecting to the server. Useful to distinguish between network proxy and apiserver connections that share the same destination address.
      --alsologtostderr                     log to standard error as well as files (no effect when -logtostderr=true)
      --alsologtostderrthreshold severity   logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)
      --ca-cert string                      If non-empty the CAs we use to validate clients.
      --count-server-leases                 Enables lease counting system to determine the number of proxy servers to connect to.
      --enable-contention-profiling         enable contention profiling at host:admin-port/debug/pprof/block. "--enable-profiling" must also be set.
      --enable-profiling                    enable pprof at host:admin-port/debug/pprof
      --health-server-host string           The host address to listen on, without port.
      --health-server-port int              The port the health server is listening on. (default 8093)
  -h, --help                                help for agent
      --keepalive-time duration             Time for gRPC agent server keepalive. (default 1h0m0s)
      --kube-api-content-type string        Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
      --kubeconfig string                   Path to the kubeconfig file
      --lease-label-selector string         Label selector for leases to take into account when counting servers. (default "k8s-app=konnectivity-server")
      --lease-namespace string              Namespace where lease objects are managed. (default "kube-system")
      --legacy-stderr-threshold-behavior    If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true)
      --log-backtrace-at traceLocation      when logging hits line file:N, emit a stack trace (default :0)
      --log-dir string                      If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log-file string                     If non-empty, use this log file (no effect when -logtostderr=true)
      --log-file-max-size uint              Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                         log to standard error instead of files (default true)
      --one-output                          If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --probe-interval duration             The interval by which the agent periodically checks if its connections to the proxy server are ready. (default 1s)
      --proxy-server-host string            The hostname to use to connect to the proxy-server. (default "127.0.0.1")
      --proxy-server-port int               The port the proxy server is listening on. (default 8091)
      --server-count-source string          Defines how the server counts from lease and from server responses are combined. Possible values: 'default' to use only one source (server or leases depending on other flags), 'max' to take the larger value. (default "default")
      --service-account-token-path string   If non-empty proxy agent uses this token to prove its identity to the proxy server.
      --skip-headers                        If true, avoid header prefixes in the log messages
      --skip-log-headers                    If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --stderrthreshold severity            logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)
      --sync-forever                        If true, the agent continues syncing, in order to support server count changes.
      --sync-interval duration              The initial interval by which the agent periodically checks if it has connections to all instances of the proxy server. (default 1s)
      --sync-interval-cap duration          The maximum interval for the SyncInterval to back off to when unable to connect to the proxy server (default 10s)
  -v, --v Level                             number for the log level verbosity (default 4)
      --vmodule moduleSpec                  comma-separated list of pattern=N settings for file-filtered logging
      --warn-on-channel-limit               Turns on a warning if the system is going to push to a full channel. The check involves an unsafe read.
      --xfr-channel-size int                Set the size of the channel for transferring data between the agent and the proxy server. (default 150)
Options (44)
OptionDescriptionSource
--add-dir-headerIf true, adds the file directory to the header of the log messageshelp
--admin-bind-address stringBind address for admin connections.help
--admin-server-port intThe port the admin server is listening on.help
--agent-cert stringIf non-empty secure communication with this cert.help
--agent-id stringThe unique ID of this agent.help
--agent-identifiers stringIdentifiers of the agent that will be used by the server when choosing agent.help
--agent-key stringIf non-empty secure communication with this key.help
--alpn-proto stringsAdditional ALPN protocols to be presented when connecting to the server.help
--alsologtostderrlog to standard error as well as files (no effect when -logtostderr=true)help
--alsologtostderrthreshold severitylogs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)help
--ca-cert stringIf non-empty the CAs we use to validate clients.help
--count-server-leasesEnables lease counting system to determine the number of proxy servers to connect to.help
--enable-contention-profilingenable contention profiling at host:admin-port/debug/pprof/block.help
--enable-profilingenable pprof at host:admin-port/debug/pprofhelp
--health-server-host stringThe host address to listen on, without port.help
--health-server-port intThe port the health server is listening on.help
-h, --helphelp for agenthelp
--keepalive-time durationTime for gRPC agent server keepalive.help
--kube-api-content-type stringContent type of requests sent to apiserver.help
--kubeconfig stringPath to the kubeconfig filehelp
--lease-label-selector stringLabel selector for leases to take into account when counting servers.help
--lease-namespace stringNamespace where lease objects are managed.help
--legacy-stderr-threshold-behaviorIf true, stderrthreshold is ignored when logtostderr=true (legacy behavior).help
--log-backtrace-at traceLocationwhen logging hits line file:N, emit a stack trace (default :0)help
--log-dir stringIf non-empty, write log files in this directory (no effect when -logtostderr=true)help
--log-file stringIf non-empty, use this log file (no effect when -logtostderr=true)help
--log-file-max-size uintDefines the maximum size a log file can grow to (no effect when -logtostderr=true).help
--logtostderrlog to standard error instead of files (default true)help
--one-outputIf true, only write logs to their native severity level (vs also writing to each lower severity level;help
--probe-interval durationThe interval by which the agent periodically checks if its connections to the proxy server are ready.help
--proxy-server-host stringThe hostname to use to connect to the proxy-server.help
--proxy-server-port intThe port the proxy server is listening on.help
--server-count-source stringDefines how the server counts from lease and from server responses are combined.help
--service-account-token-path stringIf non-empty proxy agent uses this token to prove its identity to the proxy server.help
--skip-headersIf true, avoid header prefixes in the log messageshelp
--skip-log-headersIf true, avoid headers when opening log files (no effect when -logtostderr=true)help
--stderrthreshold severitylogs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)help
--sync-foreverIf true, the agent continues syncing, in order to support server count changes.help
--sync-interval durationThe initial interval by which the agent periodically checks if it has connections to all instances of the proxy server.help
--sync-interval-cap durationThe maximum interval for the SyncInterval to back off to when unable to connect to the proxy server (default 10s)help
-v, --v Levelnumber for the log level verbosity (default 4)help
--vmodule moduleSpeccomma-separated list of pattern=N settings for file-filtered logginghelp
--warn-on-channel-limitTurns on a warning if the system is going to push to a full channel.help
--xfr-channel-size intSet the size of the channel for transferring data between the agent and the proxy server.help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.