OS Manuals

/usr/bin/kube-vip

Kubernetes Control Plane Virtual IP and Load-Balancer

From kube-vip-fips 1.3.1-r2 (enterprise-packages), captured 2026-11-08 by running kube-vip --help (exit 0). permalink

This is a server for providing a Virtual IP and load-balancer for the Kubernetes control-plane

Usage:
  kube-vip [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  kubeadm     Kubeadm functions
  manager     Start the kube-vip manager
  manifest    Manifest functions
  sample      Generate a Sample configuration
  service     Start the Virtual IP / Load balancer as a service within a Kubernetes cluster
  version     Version and Release information about the Kubernetes Virtual IP Server

Flags:
      --address string                                an address (IP or DNS name) to use as a VIP
      --allowInterfaceNotUp                           Allow kube-vip to start even if the interface is not up
      --annotations string                            Set Node annotations prefix for parsing
      --arp                                           Enable Arp for VIP changes
      --autodetectcp                                  Determine working address for control plane (from loopback)
      --bgp                                           This will enable BGP support within kube-vip
      --bgpAttachIPToInterface                        Assign BGP service VIPs to the configured interface
      --bgpHoldTimer uint                             The hold timer for all bgp peers (it defines the time a session is held) (default 30)
      --bgpKeepAliveInterval uint                     The keepalive interval for all bgp peers (it defines the heartbeat of keepalive messages) (default 10)
      --bgpRouterID string                            The routerID for the bgp server
      --bgppeers strings                              Comma separated BGP Peer, format: address:as:password:multihop
      --cleanRoutingTable                             Clean routing table of redundant routes on start
      --config-file string                            Path to a JSON/YAML configuration file to load settings from
      --controlPlaneHealthCheckAddress string         URL to poll for the control-plane health check when using BGP without leader election
      --controlPlaneHealthCheckCAPath string          Path to CA certificate for TLS verification when the control-plane health check URL is HTTPS
      --controlPlaneHealthCheckFailureThreshold int   Consecutive control-plane health check failures before withdrawing the BGP route (default 3)
      --controlPlaneHealthCheckPeriodSeconds int      Seconds between control-plane health checks (default 5)
      --controlPlaneHealthCheckTimeoutSeconds int     Timeout for each control-plane health check request (default 3)
      --controlplane                                  Enable HA for control plane
      --ddns                                          use Dynamic DNS + DHCP to allocate VIP for address
      --debounceTime string                           Configures the time that the event debouncer will wait for the events arrival (default 0s - debouncer disabled, enable with min. 200ms) (default "0s")
      --dhcpBackoffAttempts uint                      number of times DHCP client will try to obtain an IP address (defaults to: 3, 0 for unlimited retries) (default 3)
      --dhcpMode string                               Mode DHCP resolving will use to obtain IP addresses (ipv4, ipv6, dual) (default "ipv4")
      --disableServiceUpdates                         If true, kube-vip will process services as usual, but will not update service's Status.LoadBalancer.Ingress slice
      --dnsMode string                                Name of the mode that DNS lookup will be performed (first, ipv4, ipv6, dual) (default "first")
      --egressWithNftables                            Use nftables-based egress implementation (default true)
      --enableEndpoints                               If enabled, kube-vip will only advertise services, but will use the (deprecated since v1.33) endpoints for IP addresses
      --enableLoadBalancer                            enable loadbalancing on the VIP with IPVS
      --enableNodeLabeling                            Enable leader node labeling with "kube-vip.io/has-ip", defaults to false
      --enablePprof                                   Expose the pprof profiling endpoints (debug only, they are unauthenticated)
      --etcdCACert string                             Verify certificates of TLS-enabled secure servers using this CA bundle file
      --etcdCert string                               Identify secure client using this TLS certificate file
      --etcdEndpoints strings                         Etcd member endpoints
      --etcdKey string                                Identify secure client using this TLS key file
      --healthCheckPort int                           If set to non-zero (> 1024), then this is the port that the healthcheck will listen on
  -h, --help                                          help for kube-vip
      --instanceName string                           Unique name for this kube-vip instance (currently used to isolate nftables egress tables)
      --interface string                              Name of the interface to bind to
      --k8sConfigPath string                          Path to the configuration file used with the Kubernetes client (default "/etc/kubernetes/admin.conf")
      --lbClassName string                            Name of load balancer class for kube-VIP, defaults to "kube-vip.io/kube-vip-class" (default "kube-vip.io/kube-vip-class")
      --lbClassNameLegacyHandling                     Use legacy LoadBalancer class name handling (e.g. accepting services both with empty and non-empty class) (default true)
      --lbClassOnly                                   Enable load balancing only for services with LoadBalancerClass "kube-vip.io/kube-vip-class"
      --lbForwardingMethod string                     loadbalancer forwarding method (default "local")
      --lbPort uint16                                 loadbalancer port for the VIP (default 6443)
      --leaderElection                                Use the Kubernetes leader election mechanism for clustering
      --leaderElectionType string                     Defines the backend to run the leader election: kubernetes or etcd. Defaults to kubernetes. (default "kubernetes")
      --leaseDuration int                             Length of time (in seconds) a Kubernetes leader lease can be held for (default 15)
      --leaseName string                              Name of the lease that is used for leader election (default "plndr-cp-lock")
      --leaseRenewDuration int                        Length of time (in seconds) a Kubernetes leader can attempt to renew its lease (default 10)
      --leaseRetry int                                Length of time (in seconds) the LeaderElector clients should wait between tries of actions (default 2)
      --loInterfaceGlobalScope                        If true, kube-vip will set global scope when using the lo interface, otherwise a host scope will be used by default
      --localAS uint32                                The local AS number for the bgp server (default 65000)
      --log int32                                     Set the level of logging
      --loseLeadership                                Lose leadership when VIP interface goes down
      --loseLeadershiptTimeoutSeconds int             Timeout before re-electing a leader when the VIP interface is down (default 30)
      --mirrorDestInterface string                    network interface where all traffic that traverses the service interface will be mirrored to. Source interface will use default interface is servicesInterface is not set.
      --multihop                                      This will enable BGP multihop support
  -n, --namespace string                              The namespace for the configmap defined within the cluster (default "kube-system")
      --nodeName string                               Name to be used for lease holder. Must be unique for each node/instance
      --onlyAllowTrafficServicePorts                  Only allow traffic to service ports, others will be dropped, defaults to false
      --peerAS uint32                                 The AS number for a BGP peer (default 65000)
      --peerAddress string                            The address of a BGP peer
      --peerPass string                               The md5 password for a BGP peer
      --perServiceElectionOnDemand                    Allow kube-vip to use per-service election for annotated services
      --port uint16                                   Port for the VIP (default 6443)
      --pprofHTTPServer string                        Host and port used to expose the pprof endpoints, only used with --enablePprof (default "127.0.0.1:6060")
      --preserveVipOnLeadershipLoss                   Preserve ARP VIP addresses on interface when leadership is lost (default: false for backward compatibility)
      --prometheusHTTPServer string                   Host and port used to expose Prometheus metrics via an HTTP server (default ":2112")
      --routingProtocol int                           The routing protocol value used to create routes (default 248)
      --serviceInterface string                       Name of the interface to bind to (for services)
      --services                                      Enable Kubernetes services
      --servicesElection                              Enable leader election per kubernetes service
      --servicesLeaseName string                      Name of the lease that is used for leader election for services (in arp mode) (default "plndr-svcs-lock")
      --sourceIF string                               The source interface for bgp peering (not to be used with sourceIP)
      --sourceIP string                               The source address for bgp peering (not to be used with sourceIF)
      --table                                         Enable Routing Table for services VIPs
      --tableID int                                   The routing table used for all table entries (default 198)
      --tableType int                                 The type of route that will be added to the routing table (default 1)
      --vip string                                    The Virtual IP address
      --vipSubnet string                              The Virtual IP address subnet e.g. /32 /24 /8 etc.. (Default to 32 for IPv4 and 128 for IPv6)
      --wireguard                                     Enable Wireguard for services VIPs
      --zebra                                         This will enable Zebra support within kube-vip
      --zebraSoftwareName string                      Software Name for Zebra (default "frr8.3")
      --zebraUrl string                               Path to the unix domain socket for connecting to Zebra daemon (default "unix:/var/run/frr/zserv.api")
      --zebraVersion uint32                           Zebra API Version (default 6)

Use "kube-vip [command] --help" for more information about a command.
Options (85)
OptionDescriptionSource
--address stringan address (IP or DNS name) to use as a VIPhelp
--allowInterfaceNotUpAllow kube-vip to start even if the interface is not uphelp
--annotations stringSet Node annotations prefix for parsinghelp
--arpEnable Arp for VIP changeshelp
--autodetectcpDetermine working address for control plane (from loopback)help
--bgpThis will enable BGP support within kube-viphelp
--bgpAttachIPToInterfaceAssign BGP service VIPs to the configured interfacehelp
--bgpHoldTimer uintThe hold timer for all bgp peers (it defines the time a session is held) (default 30)help
--bgpKeepAliveInterval uintThe keepalive interval for all bgp peers (it defines the heartbeat of keepalive messages) (default 10)help
--bgpRouterID stringThe routerID for the bgp serverhelp
--bgppeers stringsComma separated BGP Peer, format: address:as:password:multihophelp
--cleanRoutingTableClean routing table of redundant routes on starthelp
--config-file stringPath to a JSON/YAML configuration file to load settings fromhelp
--controlPlaneHealthCheckAddress stringURL to poll for the control-plane health check when using BGP without leader electionhelp
--controlPlaneHealthCheckCAPath stringPath to CA certificate for TLS verification when the control-plane health check URL is HTTPShelp
--controlPlaneHealthCheckFailureThreshold intConsecutive control-plane health check failures before withdrawing the BGP route (default 3)help
--controlPlaneHealthCheckPeriodSeconds intSeconds between control-plane health checks (default 5)help
--controlPlaneHealthCheckTimeoutSeconds intTimeout for each control-plane health check request (default 3)help
--controlplaneEnable HA for control planehelp
--ddnsuse Dynamic DNS + DHCP to allocate VIP for addresshelp
--debounceTime stringConfigures the time that the event debouncer will wait for the events arrival (default 0s - debouncer disabled, enable with min.help
--dhcpBackoffAttempts uintnumber of times DHCP client will try to obtain an IP address (defaults to: 3, 0 for unlimited retries) (default 3)help
--dhcpMode stringMode DHCP resolving will use to obtain IP addresses (ipv4, ipv6, dual) (default "ipv4")help
--disableServiceUpdatesIf true, kube-vip will process services as usual, but will not update service's Status.LoadBalancer.Ingress slicehelp
--dnsMode stringName of the mode that DNS lookup will be performed (first, ipv4, ipv6, dual) (default "first")help
--egressWithNftablesUse nftables-based egress implementation (default true)help
--enableEndpointsIf enabled, kube-vip will only advertise services, but will use the (deprecated since v1.33) endpoints for IP addresseshelp
--enableLoadBalancerenable loadbalancing on the VIP with IPVShelp
--enableNodeLabelingEnable leader node labeling with "kube-vip.io/has-ip", defaults to falsehelp
--enablePprofExpose the pprof profiling endpoints (debug only, they are unauthenticated)help
--etcdCACert stringVerify certificates of TLS-enabled secure servers using this CA bundle filehelp
--etcdCert stringIdentify secure client using this TLS certificate filehelp
--etcdEndpoints stringsEtcd member endpointshelp
--etcdKey stringIdentify secure client using this TLS key filehelp
--healthCheckPort intIf set to non-zero (> 1024), then this is the port that the healthcheck will listen onhelp
-h, --helphelp for kube-viphelp
--instanceName stringUnique name for this kube-vip instance (currently used to isolate nftables egress tables)help
--interface stringName of the interface to bind tohelp
--k8sConfigPath stringPath to the configuration file used with the Kubernetes client (default "/etc/kubernetes/admin.conf")help
--lbClassName stringName of load balancer class for kube-VIP, defaults to "kube-vip.io/kube-vip-class" (default "kube-vip.io/kube-vip-class")help
--lbClassNameLegacyHandlingUse legacy LoadBalancer class name handling (e.g. accepting services both with empty and non-empty class) (default true)help
--lbClassOnlyEnable load balancing only for services with LoadBalancerClass "kube-vip.io/kube-vip-class"help
--lbForwardingMethod stringloadbalancer forwarding method (default "local")help
--lbPort uint16loadbalancer port for the VIP (default 6443)help
--leaderElectionUse the Kubernetes leader election mechanism for clusteringhelp
--leaderElectionType stringDefines the backend to run the leader election: kubernetes or etcd.help
--leaseDuration intLength of time (in seconds) a Kubernetes leader lease can be held for (default 15)help
--leaseName stringName of the lease that is used for leader election (default "plndr-cp-lock")help
--leaseRenewDuration intLength of time (in seconds) a Kubernetes leader can attempt to renew its lease (default 10)help
--leaseRetry intLength of time (in seconds) the LeaderElector clients should wait between tries of actions (default 2)help
--loInterfaceGlobalScopeIf true, kube-vip will set global scope when using the lo interface, otherwise a host scope will be used by defaulthelp
--localAS uint32The local AS number for the bgp server (default 65000)help
--log int32Set the level of logginghelp
--loseLeadershipLose leadership when VIP interface goes downhelp
--loseLeadershiptTimeoutSeconds intTimeout before re-electing a leader when the VIP interface is down (default 30)help
--mirrorDestInterface stringnetwork interface where all traffic that traverses the service interface will be mirrored to.help
--multihopThis will enable BGP multihop supporthelp
-n, --namespace stringThe namespace for the configmap defined within the cluster (default "kube-system")help
--nodeName stringName to be used for lease holder.help
--onlyAllowTrafficServicePortsOnly allow traffic to service ports, others will be dropped, defaults to falsehelp
--peerAS uint32The AS number for a BGP peer (default 65000)help
--peerAddress stringThe address of a BGP peerhelp
--peerPass stringThe md5 password for a BGP peerhelp
--perServiceElectionOnDemandAllow kube-vip to use per-service election for annotated serviceshelp
--port uint16Port for the VIP (default 6443)help
--pprofHTTPServer stringHost and port used to expose the pprof endpoints, only used with --enablePprof (default "127.0.0.1:6060")help
--preserveVipOnLeadershipLossPreserve ARP VIP addresses on interface when leadership is lost (default: false for backward compatibility)help
--prometheusHTTPServer stringHost and port used to expose Prometheus metrics via an HTTP server (default ":2112")help
--routingProtocol intThe routing protocol value used to create routes (default 248)help
--serviceInterface stringName of the interface to bind to (for services)help
--servicesEnable Kubernetes serviceshelp
--servicesElectionEnable leader election per kubernetes servicehelp
--servicesLeaseName stringName of the lease that is used for leader election for services (in arp mode) (default "plndr-svcs-lock")help
--sourceIF stringThe source interface for bgp peering (not to be used with sourceIP)help
--sourceIP stringThe source address for bgp peering (not to be used with sourceIF)help
--tableEnable Routing Table for services VIPshelp
--tableID intThe routing table used for all table entries (default 198)help
--tableType intThe type of route that will be added to the routing table (default 1)help
--vip stringThe Virtual IP addresshelp
--vipSubnet stringThe Virtual IP address subnet e.g. /32 /24 /8 etc..help
--wireguardEnable Wireguard for services VIPshelp
--zebraThis will enable Zebra support within kube-viphelp
--zebraSoftwareName stringSoftware Name for Zebra (default "frr8.3")help
--zebraUrl stringPath to the unix domain socket for connecting to Zebra daemon (default "unix:/var/run/frr/zserv.api")help
--zebraVersion uint32Zebra API Version (default 6)help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.