OS Manuals

/usr/bin/virt-handler

FIPS KubeVirt node agent managing VM instance lifecycle and QEMU processes

From virt-handler-fips-1.9 1.9.1-r3 (enterprise-packages), captured 2026-11-08 by running virt-handler --help (exit 0). permalink

Usage of /usr/bin/virt-handler:
      --ca-configmap-name string            The name of configmap containing CA certificates to authenticate requests presenting client certificates with matching CommonName (default "kubevirt-ca")
      --client-cert-file string             Client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/clientcertificates/tls.crt")
      --client-key-file string              Private key for the client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/clientcertificates/tls.key")
      --console-server-port int             The port virt-handler listens on for console requests (default 8186)
      --domain-resync-period-seconds int    Recurring period for resyncing all known virt-launcher domains. (default 300)
      --enable-node-labeller                Enable Node Labeller controller. (default true)
      --externally-managed                  Allow intermediate certificates to be used in building up the chain of trust when certificates are externally managed
      --graceful-shutdown-seconds int       The number of seconds to wait for existing migration connections to close before shutting down virt-handler. (default 300)
      --hostname-override string            Name under which the node is registered in Kubernetes, where this virt-handler instance is running on
      --kubeconfig string                   absolute path to the kubeconfig file
      --kubelet-pods-dir string             Path for pod directory (matching host's path for kubelet root) (default "/var/lib/kubelet/pods")
      --kubelet-root string                 Path for Kubelet root (default "/var/lib/kubelet")
      --kubevirt-private-dir string         private directory for virt-handler state (default "/var/run/kubevirt-private")
      --kubevirt-share-dir string           Shared directory between virt-handler and virt-launcher (default "/var/run/kubevirt")
      --listen string                       Address where to listen on (default "0.0.0.0")
      --master string                       master url
      --max-devices int                     Number of devices to register with Kubernetes device plugin framework (default 1000)
      --max-metric-requests int             Number of concurrent requests to the metrics endpoint (default 3)
      --migration-client-cert-file string   Client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/migrationservercertificates/tls.crt")
      --migration-client-key-file string    Private key for the client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/migrationservercertificates/tls.key")
      --migration-cn-types stringArray      The Common Name types that should be asserted for migration connections (default [virt-handler,migration])
      --pod-ip-address string               The pod ip address
      --port int                            Port to listen on (default 8185)
      --tls-cert-file string                File containing the default x509 Certificate for HTTPS (default "/etc/virt-handler/servercertificates/tls.crt")
      --tls-key-file string                 File containing the default x509 private key matching --tls-cert-file (default "/etc/virt-handler/servercertificates/tls.key")
  -v, --v int                               log level for V logs (default 2)
      --vmstats-server-port int             The port virt-handler listens on for vmstats requests (default 8187)
      --vsock-client-cert-file string       Client certificate used to prove the identity of the virt-handler to in-guest vsock agent (default "/etc/virt-handler/vsockclientcertificates/tls.crt")
      --vsock-client-key-file string        Private key for the client certificate used to prove the identity of the virt-handler to in-guest vsock agent (default "/etc/virt-handler/vsockclientcertificates/tls.key")
      --watchdog-timeout duration           Watchdog file timeout (default 30s)
Options (30)
OptionDescriptionSource
--ca-configmap-name stringThe name of configmap containing CA certificates to authenticate requests presenting client certificates with matching CommonName (default "kubevirt-ca")help
--client-cert-file stringClient certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/clientcertificates/tls.crt")help
--client-key-file stringPrivate key for the client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/clientcertificates/tls.key")help
--console-server-port intThe port virt-handler listens on for console requests (default 8186)help
--domain-resync-period-seconds intRecurring period for resyncing all known virt-launcher domains.help
--enable-node-labellerEnable Node Labeller controller.help
--externally-managedAllow intermediate certificates to be used in building up the chain of trust when certificates are externally managedhelp
--graceful-shutdown-seconds intThe number of seconds to wait for existing migration connections to close before shutting down virt-handler.help
--hostname-override stringName under which the node is registered in Kubernetes, where this virt-handler instance is running onhelp
--kubeconfig stringabsolute path to the kubeconfig filehelp
--kubelet-pods-dir stringPath for pod directory (matching host's path for kubelet root) (default "/var/lib/kubelet/pods")help
--kubelet-root stringPath for Kubelet root (default "/var/lib/kubelet")help
--kubevirt-private-dir stringprivate directory for virt-handler state (default "/var/run/kubevirt-private")help
--kubevirt-share-dir stringShared directory between virt-handler and virt-launcher (default "/var/run/kubevirt")help
--listen stringAddress where to listen on (default "0.0.0.0")help
--master stringmaster urlhelp
--max-devices intNumber of devices to register with Kubernetes device plugin framework (default 1000)help
--max-metric-requests intNumber of concurrent requests to the metrics endpoint (default 3)help
--migration-client-cert-file stringClient certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/migrationservercertificates/tls.crt")help
--migration-client-key-file stringPrivate key for the client certificate used to prove the identity of the virt-handler when it must call out during a request (default "/etc/virt-handler/migrationservercertificates/tls.key")help
--migration-cn-types stringArrayThe Common Name types that should be asserted for migration connections (default [virt-handler,migration])help
--pod-ip-address stringThe pod ip addresshelp
--port intPort to listen on (default 8185)help
--tls-cert-file stringFile containing the default x509 Certificate for HTTPS (default "/etc/virt-handler/servercertificates/tls.crt")help
--tls-key-file stringFile containing the default x509 private key matching --tls-cert-file (default "/etc/virt-handler/servercertificates/tls.key")help
-v, --v intlog level for V logs (default 2)help
--vmstats-server-port intThe port virt-handler listens on for vmstats requests (default 8187)help
--vsock-client-cert-file stringClient certificate used to prove the identity of the virt-handler to in-guest vsock agent (default "/etc/virt-handler/vsockclientcertificates/tls.crt")help
--vsock-client-key-file stringPrivate key for the client certificate used to prove the identity of the virt-handler to in-guest vsock agent (default "/etc/virt-handler/vsockclientcertificates/tls.key")help
--watchdog-timeout durationWatchdog file timeout (default 30s)help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.