DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ingress-nginx-helm/docs/user-guide/cli-arguments.md

77 lines
10 KiB
Markdown
Raw Normal View History

Split documentation
2017-10-13 13:55:03 +00:00
# Command line arguments
Proofread cmd package and update flags description
2018-06-11 09:17:50 +00:00
The following command line arguments are accepted by the Ingress controller executable.
Regenerate cli-arguments.md from the actual usage of 0.13
2018-04-24 11:32:47 +00:00
Fix names in documentation (#7940) * Fix names in documentation This fixes the documentation to reflect the name change from `nginx-ingress` to `ingress-nginx`. Signed-off-by: Reinhard Nägele <unguiculus@gmail.com> * Revert accidental changelog update Signed-off-by: Reinhard Nägele <unguiculus@gmail.com>
2021-11-28 21:11:22 +00:00
They are set in the container spec of the `ingress-nginx-controller` Deployment manifest
Regenerate cli-arguments.md from the actual usage of 0.13
2018-04-24 11:32:47 +00:00
| Argument | Description |
|----------|-------------|
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--add_dir_header` | If true, adds the file directory to the header |
| `--alsologtostderr` | log to standard error as well as files |
| `--annotations-prefix` | Prefix of the Ingress annotations specific to the NGINX controller. (default "nginx.ingress.kubernetes.io") |
| `--apiserver-host` | Address of the Kubernetes API server. Takes the form "protocol://address:port". If not specified, it is assumed the program runs inside a Kubernetes cluster and local discovery is attempted. |
| `--certificate-authority` | Path to a cert file for the certificate authority. This certificate is used only when the flag --apiserver-host is specified. |
| `--configmap` | Name of the ConfigMap containing custom global configurations for the controller. |
Implement object deep inspector (#8456)
2022-04-11 14:06:07 +00:00
| `--deep-inspect` | Enables ingress object security deep inspector. (default true) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--default-backend-service` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form "namespace/name". The controller configures NGINX to forward requests to the first port of this Service. |
| `--default-server-port` | Port to use for exposing the default server (catch-all). (default 8181) |
| `--default-ssl-certificate` | Secret containing a SSL certificate to be used by the default HTTPS server (catch-all). Takes the form "namespace/name". |
| `--disable-catch-all` | Disable support for catch-all Ingresses |
This PR: (#7514) <!--- Provide a general summary of your changes in the Title above ---> <!--- Why is this change required? What problem does it solve? --> Introduces the CLI command flag `--disable-full-test` By default, it doesn't alter the current behavior of the tests performed by the admission controller. With or Without the flag, a full checkOverlap is actioned, without any alteration and the object `pcfg` is created with the whole set of ingreses. If the flag is set to true, it does manipulate the size of `pcfg` up to the content of $this single ingress. This is achieved by overriding pcfg content by just the last slice that got recently appended to the object `ings` ``` if n.cfg.DisableFullValidationTest { _, _, pcfg = n.getConfiguration(ings[len(ings)-1:]) } ``` The following steps of generateTemplate and testTemplate are significally reduced to a signle scenario ``` content, err := n.generateTemplate(cfg, *pcfg) ... err = n.testTemplate(content) ``` This flag doesn't avoid the proper testing of collisions, neither bad syntaxis within the rendered configuration of the ingress. But it does eliminate a scenario, which I wasn't able to produce, where by for some reason even proper rendering and valid values, without collisions of host/path may end into an invalid nginx.conf The reasoning for this Feature is: - Test duration increases by the number of ingresses in the cluster. - File size grows to very important numbers 150-200Mb on clusters with just 2000~ ingresses. - Tests in that scenario, takes approximately 20s using the last 0.48.1 improvements - Produces a considerable memory consumption, as well as CPU, compute, that affects directly the containers that serve traffic. Since the flag is trully optional, and by default is disabled I fell as a good thing to have that can definitively help on large-scale scenarios that still want to have a reasonable set of tests in place at a lower cost. <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [X ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) <!--- Please describe in detail how you tested your changes. --> <!--- Include details of your testing environment, and the tests you ran to --> <!--- see how your change affects other areas of the code, etc. --> Tested with the build kit the following scenarios on a cluster with 1000~ ingresses: - With Flag Disabled or Flag, not present (current status as per 0.48.1) collision scenario (wrong snippet content): `kubectl apply -f ../collision-syntax.yaml 0.18s user 0.05s system 3% cpu 6.639 total` collisions scenario (duplicated host): `kubectl apply -f ../collision-host.yaml 0.17s user 0.05s system 3% cpu 6.245 total` create/update: `kubectl apply -f ing-215.yaml 0.16s user 0.05s system 3% cpu 5.845 total` - With Flag Enabled (true): collision scenario (wrong snippet content): `kubectl apply -f ../collision.yaml 0.18s user 0.02s system 57% cpu 0.347 total` collision scenario (duplicated host): `kubectl apply -f ../collision.yaml 0.21s user 0.06s system 85% cpu 0.318 total` create/update: `kubectl apply -f ing-973.yaml 0.17s user 0.03s system 72% cpu 0.271 total` As part of the test, I did verified that the created nginx for the test was of a smaller size, and that it didnt affect negatively the final nginx.conf (of a much larger side) where this was merged by the next steps in place after the validation. I couldn't observe any other change in the behaviour and so far the routine looks simple and non harmful. <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] I've read the [CONTRIBUTION](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md) guide - [ ] I have added tests to cover my changes. - [ ] All new and existing tests passed. For the test part, I would need to understand the placement and test case that this would require, I wasn't able to see an existing scenario for this
2021-09-07 17:53:16 +00:00
| `--disable-full-test` | Disable full test of all merged ingresses at the admission stage and tests the template of the ingress being created or updated (full test of all ingresses is enabled by default) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--election-id` | Election id to use for Ingress status updates. (default "ingress-controller-leader") |
| `--enable-metrics` | Enables the collection of NGINX metrics (default true) |
| `--enable-ssl-chain-completion` | Autocomplete SSL certificate chains with missing intermediate CA certificates. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 extension for this to succeed. |
| `--enable-ssl-passthrough` | Enable SSL Passthrough. |
| `--health-check-path` | URL path of the health check endpoint. Configured inside the NGINX status server. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. (default "/healthz") |
| `--health-check-timeout` | Time limit, in seconds, for a probe to health-check-path to succeed. (default 10) |
| `--healthz-port` | Port to use for the healthz endpoint. (default 10254) |
Add a flag to specify address to bind the healthz server (#7541) * Add a flag to specify address to bind the healthz server Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com> * Add healthz host to the helm chart Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com> * Apply suggestions from code review Co-authored-by: Ricardo Katz <rikatz@users.noreply.github.com> Co-authored-by: Ricardo Katz <rikatz@users.noreply.github.com>
2021-08-26 12:13:23 +00:00
| `--healthz-host` | Address to bind the healthz endpoint. |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--http-port` | Port to use for servicing HTTP traffic. (default 80) |
| `--https-port` | Port to use for servicing HTTPS traffic. (default 443) |
fix: log warning if empty ingress class is monitored. Improve docs related to --ingress-class
2020-08-21 07:25:43 +00:00
| `--ingress-class` | Name of the ingress class this controller satisfies. The class of an Ingress object is set using the field IngressClassName in Kubernetes clusters version v1.18.0 or higher or the annotation "kubernetes.io/ingress.class" (deprecated). If this parameter is not set, or set to the default value of "nginx", it will handle ingresses with either an empty or "nginx" class name. |
Added docs for --ingress-class-by-name flag in the cli arguments page (#7624) * Added docs for --ingress-class-by-name flag in the cli arguments page Signed-off-by: bhumijgupta <bhumijgupta@gmail.com> * Updated docs to match the flag description in code Signed-off-by: bhumijgupta <bhumijgupta@gmail.com>
2021-12-23 21:32:30 +00:00
| `--ingress-class-by-name` | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. (default false) |
Document internal-logger-address cli arg (#8873) Signed-off-by: Edvin Norling <edvin.norling@xenit.se> Signed-off-by: Edvin Norling <edvin.norling@xenit.se>
2022-08-22 23:14:09 +00:00
| `--internal-logger-address` | Define the internal logger address to use when chroot images is used. (default 127.0.0.1:11514) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--kubeconfig` | Path to a kubeconfig file containing authorization and API server information. |
Consistent prometheus metric names and documentation (#8728) * clean prometheus metrics - add new histogram metrics with consistent names - deprecate summary metrics with inconsistent names * update prometheus metrics tests * remove ingress_upstream_header_seconds metric It hasn't been released so it is safe. Use header_duration_seconds metric. * add documentation on prometheus metrics
2022-09-30 15:00:36 +00:00
| `--length-buckets` | Set of buckets which will be used for prometheus histogram metrics such as RequestLength, ResponseLength. (default `[10, 20, 30, 40, 50, 60, 70, 80, 90, 100]`) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--log_backtrace_at` | when logging hits line file:N, emit a stack trace (default :0) |
| `--log_dir` | If non-empty, write log files in this directory |
| `--log_file` | If non-empty, use this log file |
| `--log_file_max_size` | Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) |
| `--logtostderr` | log to standard error instead of files (default true) |
| `--maxmind-edition-ids` | Maxmind edition ids to download GeoLite2 Databases. (default "GeoLite2-City,GeoLite2-ASN") |
Retry to download maxmind DB if it fails (#7242) * Retry to download maxmind DB if it fails. Signed-off-by: Sergey Shakuto <sshakuto@infoblox.com> * Add retries count arg, move retry logic into DownloadGeoLite2DB function Signed-off-by: Sergey Shakuto <sshakuto@infoblox.com> * Reorder parameters in DownloadGeoLite2DB Signed-off-by: Sergey Shakuto <sshakuto@infoblox.com> * Remove hardcoded value Signed-off-by: Sergey Shakuto <sshakuto@infoblox.com>
2021-07-08 22:08:53 +00:00
| `--maxmind-retries-timeout` | Maxmind downloading delay between 1st and 2nd attempt, 0s - do not retry to download if something went wrong. (default 0s) |
| `--maxmind-retries-count` | Number of attempts to download the GeoIP DB. (default 1) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--maxmind-license-key` | Maxmind license key to download GeoLite2 Databases. https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases |
| `--metrics-per-host` | Export metrics per-host (default true) |
Allow to configure delay before controller exits (#8143) * Allow to configure delay before controller exits Signed-off-by: Aditya Kamath <theunrealgeek@gmail.com> * Address comments Signed-off-by: Aditya Kamath <theunrealgeek@gmail.com>
2022-01-17 23:24:49 +00:00
| `--post-shutdown-grace-period` | Additional delay in seconds before controller container exits. (default 10) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--profiler-port` | Port to use for expose the ingress controller Go profiler when it is enabled. (default 10245) |
| `--profiling` | Enable profiling via web interface host:port/debug/pprof/ (default true) |
Spelling
2020-11-27 17:26:53 +00:00
| `--publish-service` | Service fronting the Ingress controller. Takes the form "namespace/name". When used together with update-status, the controller mirrors the address of this service's endpoints to the load-balancer status of all Ingress objects it satisfies. |
Allow multiple publish status addresses
2021-02-26 21:57:54 +00:00
| `--publish-status-address` | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies. Requires the update-status parameter. |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--report-node-internal-ip-address`| Set the load-balancer status of Ingress objects to internal Node addresses instead of external. Requires the update-status parameter. |
Implement reporting status classes in metrics (#8548) This commit introduces a backwards compatible command line option --report-status-classes which will enable reporting response status classes (2xx, 3xx..) instead of status codes in exported metrics.
2022-05-21 18:18:00 +00:00
| `--report-status-classes` | If true, report status classes in metrics (2xx, 3xx, 4xx and 5xx) instead of full status codes. (default false) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--skip_headers` | If true, avoid header prefixes in the log messages |
| `--skip_log_headers` | If true, avoid headers when opening log files |
| `--ssl-passthrough-proxy-port` | Port to use internally for SSL Passthrough. (default 442) |
Consistent prometheus metric names and documentation (#8728) * clean prometheus metrics - add new histogram metrics with consistent names - deprecate summary metrics with inconsistent names * update prometheus metrics tests * remove ingress_upstream_header_seconds metric It hasn't been released so it is safe. Use header_duration_seconds metric. * add documentation on prometheus metrics
2022-09-30 15:00:36 +00:00
| `--size-buckets` | Set of buckets which will be used for prometheus histogram metrics such as BytesSent. (default `[10, 100, 1000, 10000, 100000, 1e+06, 1e+07]`) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--status-port` | Port to use for the lua HTTP endpoint configuration. (default 10246) |
| `--status-update-interval` | Time interval in seconds in which the status should check if an update is required. Default is 60 seconds (default 60) |
| `--stderrthreshold` | logs at or above this threshold go to stderr (default 2) |
| `--stream-port` | Port to use for the lua TCP/UDP endpoint configuration. (default 10247) |
| `--sync-period` | Period at which the controller forces the repopulation of its local object stores. Disabled by default. |
| `--sync-rate-limit` | Define the sync frequency upper limit (default 0.3) |
| `--tcp-services-configmap` | Name of the ConfigMap containing the definition of the TCP services to expose. The key in the map indicates the external port to be used. The value is a reference to a Service in the form "namespace/name:port", where "port" can either be a port number or name. TCP ports 80 and 443 are reserved by the controller for servicing HTTP traffic. |
Consistent prometheus metric names and documentation (#8728) * clean prometheus metrics - add new histogram metrics with consistent names - deprecate summary metrics with inconsistent names * update prometheus metrics tests * remove ingress_upstream_header_seconds metric It hasn't been released so it is safe. Use header_duration_seconds metric. * add documentation on prometheus metrics
2022-09-30 15:00:36 +00:00
| `--time-buckets` | Set of buckets which will be used for prometheus histogram metrics such as RequestTime, ResponseTime. (default `[0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]`) |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `--udp-services-configmap` | Name of the ConfigMap containing the definition of the UDP services to expose. The key in the map indicates the external port to be used. The value is a reference to a Service in the form "namespace/name:port", where "port" can either be a port name or number. |
| `--update-status` | Update the load-balancer status of Ingress objects this controller satisfies. Requires setting the publish-service parameter to a valid Service reference. (default true) |
| `--update-status-on-shutdown` | Update the load-balancer status of Ingress objects when the controller shuts down. Requires the update-status parameter. (default true) |
Add flag to allow setting a shutdown grace period
2020-07-06 19:05:16 +00:00
| `--shutdown-grace-period` | Seconds to wait after receiving the shutdown signal, before stopping the nginx process. |
Remove deprecated flags and update docs
2020-04-12 13:58:51 +00:00
| `-v, --v Level` | number for the log level verbosity |
| `--validating-webhook` | The address to start an admission controller on to validate incoming ingresses. Takes the form "<host>:port". If not provided, no admission controller is started. |
| `--validating-webhook-certificate` | The path of the validating webhook certificate PEM. |
| `--validating-webhook-key` | The path of the validating webhook key PEM. |
| `--version` | Show release information about the NGINX Ingress controller and exit. |
| `--vmodule` | comma-separated list of pattern=N settings for file-filtered logging |
| `--watch-namespace` | Namespace the controller watches for updates to Kubernetes objects. This includes Ingresses, Services and all configuration resources. All namespaces are watched if this parameter is left empty. |
support watch namespaces matched namespace selector (#7472) skip caching namespaces at cluster scope if only watching single namespace add --watch-namespace-selector in user guide add e2e test
2021-11-12 19:46:28 +00:00
| `--watch-namespace-selector` | The controller will watch namespaces whose labels match the given selector. This flag only takes effective when `--watch-namespace` is empty. |
Reference in a new issue Copy permalink