Configuration

Every Kubernetes component reads its configuration from a mix of CLI flags and YAML files. This page is the index.

kube-apiserver

CLI flags only (no single config file). Important flag groups, all under cmd/kube-apiserver/app/options/:

• --etcd-servers, --etcd-cafile, --etcd-certfile, --etcd-keyfile — etcd connection
• --advertise-address, --bind-address, --secure-port — listen addresses
• --client-ca-file, --tls-cert-file, --tls-private-key-file — TLS material
• --service-cluster-ip-range, --service-node-port-range — Service VIP / NodePort allocators
• --feature-gates=Foo=true,Bar=false

Structured config files (each its own schema):

• --authentication-config=<path> — staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types_authentication.go
• --authorization-config=<path> — staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types_authorization.go
• --encryption-provider-config=<path> — staging/src/k8s.io/apiserver/pkg/apis/config/v1/types.go
• --admission-control-config-file=<path> — staging/src/k8s.io/apiserver/pkg/admission/apis/config/v1/types.go
• --audit-policy-file=<path> — staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go
• --egress-selector-config-file=<path> — staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types_egressselector.go
• --tracing-config-file=<path> — staging/src/k8s.io/component-base/tracing/api/v1/types.go

kube-controller-manager

Mostly CLI flags. Schema in cmd/kube-controller-manager/app/options/. The most-used:

• --controllers — explicit controller list, comma-separated. * means "all default-on".
• --leader-elect, --leader-elect-lease-duration, etc.
• --use-service-account-credentials — recommended; gives each controller its own SA-bound credentials.
• --node-monitor-grace-period, --node-startup-grace-period — node lifecycle tuning
• --node-eviction-rate, --secondary-node-eviction-rate, --unhealthy-zone-threshold — eviction tuning
• --horizontal-pod-autoscaler-tolerance, etc. — HPA tuning
• --concurrent-deployment-syncs, --concurrent-job-syncs, etc. — per-controller worker count
• --feature-gates

kube-scheduler

CLI flags + a YAML config. Default is flags only.

--config=<path> reads a KubeSchedulerConfiguration (pkg/scheduler/apis/config/v1/types.go):

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration
profiles:
  - schedulerName: default-scheduler
    plugins:
      score:
        enabled:
          - name: NodeResourcesBalancedAllocation
            weight: 1
        disabled:
          - name: ImageLocality
    pluginConfig:
      - name: NodeResourcesFit
        args:
          scoringStrategy:
            type: LeastAllocated
percentageOfNodesToScore: 50
parallelism: 16

kubelet

Both CLI flags and a YAML config (the YAML is the recommended way; flags are deprecated for almost everything except --config):

--config=<path> reads a KubeletConfiguration (pkg/kubelet/apis/config/v1beta1/types.go):

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
clusterDomain: cluster.local
clusterDNS: [10.96.0.10]
cgroupDriver: systemd
containerLogMaxSize: 100Mi
evictionHard:
  memory.available: 100Mi
  nodefs.available: 10%
featureGates:
  KubeletInUserNamespace: true
serverTLSBootstrap: true
rotateCertificates: true

Drop-in directories (/etc/kubernetes/kubelet.conf.d/) overlay additional KubeletConfiguration files. Resolved by pkg/kubelet/kubeletconfig/.

kube-proxy

--config=<path> reads a KubeProxyConfiguration (pkg/proxy/apis/config/v1alpha1/types.go):

apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: nftables # iptables | ipvs | nftables | kernelspace
clusterCIDR: 10.244.0.0/16
ipvs:
  scheduler: rr
  syncPeriod: 30s
nodePortAddresses: ['10.0.0.0/8']
metricsBindAddress: 0.0.0.0:10249

kubeadm

--config=<path> reads a ClusterConfiguration / InitConfiguration / JoinConfiguration (cmd/kubeadm/app/apis/kubeadm/v1beta4/types.go):

apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
  dnsDomain: cluster.local
controlPlaneEndpoint: api.example.com:6443
etcd:
  local: { dataDir: /var/lib/etcd }
apiServer:
  extraArgs:
    audit-log-path: /var/log/kubernetes/audit.log
imageRepository: registry.k8s.io
kubernetesVersion: v1.31.0

A single YAML stream can contain multiple kinds (e.g. ClusterConfiguration + InitConfiguration + KubeletConfiguration + KubeProxyConfiguration) separated by ---.

kubectl

--kubeconfig=<path> (default ~/.kube/config) reads a kubeconfig (staging/src/k8s.io/client-go/tools/clientcmd/api/types.go):

apiVersion: v1
kind: Config
clusters: [...]
users: [...]
contexts: [...]
current-context: prod

KUBECONFIG env var can list multiple files separated by : (Linux/macOS) or ; (Windows). Files are merged in declaration order.

KUBECTL_EXTERNAL_DIFF, EDITOR, and a small set of other environment variables also affect kubectl behaviour. See staging/src/k8s.io/kubectl/pkg/cmd/util/.

Generated default configs

hack/update-generated-stable-metrics.sh plus the gendocs family of binaries produce tables of supported flags. The output lives under staging/src/k8s.io/kubectl/pkg/cmd/help/ and the per-component docs/ directories (mostly for kubernetes/website).