Documentation
Command line
Every flag, the environment variable that sets it, and its default.
Serving
| Flag | Environment | Default |
|---|---|---|
| --addr | SPINOZA_ADDR | 127.0.0.1:34115 |
| --open | SPINOZA_OPEN | off |
| --token-file | SPINOZA_TOKEN_FILE | unset |
| --log-level | SPINOZA_LOG_LEVEL | info |
| --pprof | SPINOZA_PPROF | off |
| --version | ||
| --license |
Local mode refuses a non-loopback --addr. Cluster mode defaults to 0.0.0.0:8080 when no address is supplied. --pprof stays behind the active authentication model.
Cluster mode
| Flag | Environment | Default |
|---|---|---|
| --cluster-mode | SPINOZA_CLUSTER_MODE | off |
| --public-url | SPINOZA_PUBLIC_URL | unset |
| --impersonate | SPINOZA_IMPERSONATE | on |
| --auth-mode | SPINOZA_AUTH_MODE | none |
| --allow-anonymous-admin | SPINOZA_ALLOW_ANONYMOUS_ADMIN | off |
| --session-secret-file | SPINOZA_SESSION_SECRET_FILE | unset |
| --session-ttl | SPINOZA_SESSION_TTL | 8h |
| --session-max-age | SPINOZA_SESSION_MAX_AGE | 24h |
| --auth-default-role | SPINOZA_AUTH_DEFAULT_ROLE | viewer |
| --auth-admin-groups | SPINOZA_AUTH_ADMIN_GROUPS | unset |
| --auth-editor-groups | SPINOZA_AUTH_EDITOR_GROUPS | unset |
| --auth-viewer-groups | SPINOZA_AUTH_VIEWER_GROUPS | unset |
Authentication proxy
| Flag | Environment | Default |
|---|---|---|
| --auth-user-header | SPINOZA_AUTH_USER_HEADER | X-Forwarded-User |
| --auth-groups-header | SPINOZA_AUTH_GROUPS_HEADER | X-Forwarded-Groups |
| --auth-proxy-secret-header | SPINOZA_AUTH_PROXY_SECRET_HEADER | X-Spinoza-Proxy-Secret |
| --auth-proxy-secret-file | SPINOZA_AUTH_PROXY_SECRET_FILE | unset |
| --auth-proxy-logout-url | SPINOZA_AUTH_PROXY_LOGOUT_URL | unset |
OIDC
| Flag | Environment | Default |
|---|---|---|
| --auth-oidc-issuer | SPINOZA_AUTH_OIDC_ISSUER | unset |
| --auth-oidc-internal-issuer | SPINOZA_AUTH_OIDC_INTERNAL_ISSUER | unset |
| --auth-oidc-client-id | SPINOZA_AUTH_OIDC_CLIENT_ID | unset |
| --auth-oidc-client-secret | SPINOZA_AUTH_OIDC_CLIENT_SECRET | unset |
| --auth-oidc-client-secret-file | SPINOZA_AUTH_OIDC_CLIENT_SECRET_FILE | unset |
| --auth-oidc-redirect-url | SPINOZA_AUTH_OIDC_REDIRECT_URL | public URL + /auth/callback |
| --auth-oidc-scopes | SPINOZA_AUTH_OIDC_SCOPES | openid,profile,email,groups |
| --auth-oidc-groups-claim | SPINOZA_AUTH_OIDC_GROUPS_CLAIM | groups |
| --auth-oidc-username-claims | SPINOZA_AUTH_OIDC_USERNAME_CLAIMS | preferred_username,email,sub |
| --auth-oidc-username-prefix | SPINOZA_AUTH_OIDC_USERNAME_PREFIX | unset |
| --auth-oidc-groups-prefix | SPINOZA_AUTH_OIDC_GROUPS_PREFIX | unset |
| --auth-oidc-post-logout-url | SPINOZA_AUTH_OIDC_POST_LOGOUT_URL | public URL + / |
| --auth-oidc-ca-cert | SPINOZA_AUTH_OIDC_CA_CERT | unset |
| --auth-oidc-insecure-skip-verify | SPINOZA_AUTH_OIDC_INSECURE_SKIP_VERIFY | off |
| --auth-oidc-backchannel-logout | SPINOZA_AUTH_OIDC_BACKCHANNEL_LOGOUT | off |
Cluster access
| Flag | Environment | Default |
|---|---|---|
| --kubeconfig | SPINOZA_KUBECONFIG | the usual lookup |
| --context | SPINOZA_START_CONTEXT | current context |
| --view | SPINOZA_START_VIEW | last view |
| --prometheus | SPINOZA_PROMETHEUS | discovered |
| --qps | SPINOZA_QPS | 50 |
| --burst | SPINOZA_BURST | 100 |
Shells and helpers
| Flag | Environment | Default |
|---|---|---|
| --kubectl | SPINOZA_KUBECTL | kubectl |
| --helm | SPINOZA_HELM | helm |
| --debug-image | SPINOZA_DEBUG_IMAGE | busybox:1.37 |
| --node-shell | SPINOZA_NODE_SHELL | off |
| --node-shell-image | SPINOZA_NODE_SHELL_IMAGE | busybox:1.37 |
| --node-shell-namespace | SPINOZA_NODE_SHELL_NAMESPACE | kube-system |
Caches and budgets
| Flag | Environment | Default |
|---|---|---|
| --sync-timeout | SPINOZA_SYNC_TIMEOUT | 30s |
| --warm-concurrency | SPINOZA_WARM_CONCURRENCY | 8 |
| --count-budget | SPINOZA_COUNT_BUDGET | 20s |
| --count-timeout | SPINOZA_COUNT_TIMEOUT | 5s |
| --count-concurrency | SPINOZA_COUNT_CONCURRENCY | 24 |
The count flags bound how long the sidebar may spend counting objects. A type that runs out of time shows a dash rather than a wrong number.