The kube-rbac-proxy is a small HTTP proxy for a single upstream that can perform RBAC authorization against the Kubernetes API using SubjectAccessReview. Usage: kube-rbac-proxy [flags] Kube-rbac-proxy flags: --allow-paths strings Comma-separated list of paths against which kube-rbac-proxy pattern-matches the incoming request. If the request doesn't match, kube-rbac-proxy responds with a 404 status code. If omitted, the incoming request path isn't checked. Cannot be used with --ignore-paths. --auth-header-fields-enabled When set to true, kube-rbac-proxy adds auth-related fields to the headers of http requests sent to the upstream --auth-header-groups-field-name string The name of the field inside a http(2) request header to tell the upstream server about the user's groups (default "x-remote-groups") --auth-header-groups-field-separator string The separator string used for concatenating multiple group names in a groups header field's value (default "|") --auth-header-user-field-name string The name of the field inside a http(2) request header to tell the upstream server about the user's name (default "x-remote-user") --auth-token-audiences strings Comma-separated list of token audiences to accept. By default a token does not have to have any specific audience. It is recommended to set a specific audience. --client-ca-file string If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate. --config-file string Configuration file to configure kube-rbac-proxy. --http2-disable Disable HTTP/2 support --http2-max-concurrent-streams uint32 The maximum number of concurrent streams per HTTP/2 connection. (default 100) --http2-max-size uint32 The maximum number of bytes that the server will accept for frame size and buffer per stream in a HTTP/2 request. (default 262144) --ignore-paths strings Comma-separated list of paths against which kube-rbac-proxy pattern-matches the incoming request. If the requst matches, it will proxy the request without performing an authentication or authorization check. Cannot be used with --allow-paths. --insecure-listen-address string [DEPRECATED] The address the kube-rbac-proxy HTTP server should listen on. --kube-api-burst int kube-api burst value; needed when kube-api-qps is set --kube-api-qps float32 queries per second to the api, kube-client starts client-side throttling, when breached --kubeconfig string Path to a kubeconfig file, specifying how to connect to the API server. If unset, in-cluster configuration will be used --oidc-ca-file string If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used. --oidc-clientID string The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set. --oidc-groups-claim string Identifier of groups in JWT claim, by default set to 'groups' (default "groups") --oidc-groups-prefix string If provided, all groups will be prefixed with this value to prevent conflicts with other authentication strategies. --oidc-issuer string The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT). --oidc-sign-alg stringArray Supported signing algorithms, default RS256 (default [RS256]) --oidc-username-claim string Identifier of the user in JWT claim, by default set to 'email' (default "email") --oidc-username-prefix string If provided, the username will be prefixed with this value to prevent conflicts with other authentication strategies. --proxy-endpoints-port int The port to securely serve proxy-specific endpoints (such as '/healthz'). Uses the host from the '--secure-listen-address'. --secure-listen-address string The address the kube-rbac-proxy HTTPs server should listen on. --tls-cert-file string File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert) --tls-cipher-suites strings Comma-separated list of cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If omitted, the default Go cipher suites will be used --tls-min-version string Minimum TLS version supported. Value must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants. (default "VersionTLS12") --tls-private-key-file string File containing the default x509 private key matching --tls-cert-file. --tls-reload-interval duration [DEPRECATED] The interval at which to watch for TLS certificate changes, by default set to 1 minute. (default 1m0s) --upstream string The upstream URL to proxy to once requests have successfully been authenticated and authorized. --upstream-ca-file string The CA the upstream uses for TLS connection. This is required when the upstream uses TLS and its own CA certificate --upstream-client-cert-file string If set, the client will be used to authenticate the proxy to upstream. Requires --upstream-client-key-file to be set, too. --upstream-client-key-file string The key matching the certificate from --upstream-client-cert-file. If set, requires --upstream-client-cert-file to be set, too. --upstream-force-h2c Force h2c to communiate with the upstream. This is required when the upstream speaks h2c(http/2 cleartext - insecure variant of http/2) only. For example, go-grpc server in the insecure mode, such as helm's tiller w/o TLS, speaks h2c only Global flags: -h, --help help for kube-rbac-proxy --version version[=true] --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version