Command-Line Arguments

Reference for all Dashboard module command-line arguments

Kubernetes Dashboard modules accept command-line arguments to customize their behavior. Arguments are passed via Helm values under <module>.containers.args.

API Module Arguments

The API module is the backend that communicates with the Kubernetes API server and serves Dashboard data.

Configuration in Helm

api:
  containers:
    args:
      - --openapi-enabled=true
      - --prometheus-enabled=true
      - --system-banner="Production Cluster"

Available Arguments

disable-csrf-protection · boolean · default: "false"

Disable CSRF (Cross-Site Request Forgery) protection.

api:
  containers:
    args:
      - --disable-csrf-protection=false

Never enable this in production. CSRF protection is critical for security.

act-as-proxy · boolean · default: "false"

Force Dashboard to work in full proxy mode, disabling in-cluster client calls.

api:
  containers:
    args:
      - --act-as-proxy=true

Useful when Dashboard runs outside the cluster and must proxy all requests.

openapi-enabled · boolean · default: "false"

Enable OpenAPI v2 endpoint at /apidocs.json.

api:
  containers:
    args:
      - --openapi-enabled=true

Used to autogenerate OpenAPI/GraphQL schemas.

profiler · boolean · default: "false"

Enable pprof profiling endpoint.

api:
  containers:
    args:
      - --profiler=true

Exposes profiling data at localhost:8070/debug/pprof for performance debugging.

prometheus-enabled · boolean · default: "false"

Enable Prometheus metrics endpoint.

api:
  containers:
    args:
      - --prometheus-enabled=true

Exposes metrics at localhost:8080/metrics for Prometheus scraping.

apiserver-skip-tls-verify · boolean · default: "false"

Skip TLS certificate verification when connecting to Kubernetes API server.

api:
  containers:
    args:
      - --apiserver-skip-tls-verify=true

Only use for development/testing. Never in production.

auto-generate-certificates · boolean · default: "false"

Automatically generate self-signed certificates for HTTPS.

api:
  containers:
    args:
      - --auto-generate-certificates=true

Certificates are stored in --default-cert-dir.

cache-enabled · boolean · default: "true"

Enable client-side caching.

api:
  containers:
    args:
      - --cache-enabled=true

Improves performance by caching Kubernetes API responses.

cluster-context-enabled · boolean · default: "false"

Enable multi-cluster cache context support.

api:
  containers:
    args:
      - --cluster-context-enabled=true
      - --token-exchange-endpoint=http://token-service:8000/exchange

Requires a token exchange endpoint for multi-cluster scenarios.

cache-size · number · default: "1000"

Maximum number of cache entries.

api:
  containers:
    args:
      - --cache-size=5000

cache-ttl · duration · default: "10m"

Time-to-live for each cache entry.

api:
  containers:
    args:
      - --cache-ttl=15m

cache-refresh-debounce · duration · default: "5s"

Minimum time between cache refreshes in background.

api:
  containers:
    args:
      - --cache-refresh-debounce=10s

insecure-port · number · default: "8000"

Port for HTTP requests.

api:
  containers:
    args:
      - --insecure-port=8000

port · number · default: "8001"

Port for HTTPS requests.

api:
  containers:
    args:
      - --port=8443

metric-client-check-period · number · default: "30"

Seconds between metric client health checks.

api:
  containers:
    args:
      - --metric-client-check-period=60

insecure-bind-address · string · default: "127.0.0.1"

IP address for --insecure-port.

api:
  containers:
    args:
      - --insecure-bind-address=0.0.0.0

bind-address · string · default: "0.0.0.0"

IP address for --port.

api:
  containers:
    args:
      - --bind-address=0.0.0.0

token-exchange-endpoint · string · default: ""

Endpoint for token exchange when --cluster-context-enabled=true.

api:
  containers:
    args:
      - --token-exchange-endpoint=http://auth-service:8000/exchange

default-cert-dir · string · default: "/certs"

Directory for TLS certificates.

api:
  containers:
    args:
      - --default-cert-dir=/etc/dashboard/certs

Path is relative to the container, not the host.

apiserver-ca-bundle · string · default: ""

Path to CA bundle for API server HTTPS connections.

api:
  containers:
    args:
      - --apiserver-ca-bundle=/etc/ssl/certs/ca-bundle.crt

tls-cert-file · string · default: ""

Path to TLS certificate file.

api:
  containers:
    args:
      - --tls-cert-file=/certs/tls.crt

tls-key-file · string · default: ""

Path to TLS private key file.

api:
  containers:
    args:
      - --tls-key-file=/certs/tls.key

apiserver-host · string · default: ""

Kubernetes API server address.

api:
  containers:
    args:
      - --apiserver-host=https://kubernetes.default.svc:443

If not specified, uses in-cluster service discovery.

metrics-provider · string · default: "sidecar"

Metrics provider type.

api:
  containers:
    args:
      - --metrics-provider=sidecar

Options:

• sidecar - Use metrics-scraper sidecar
• none - Disable metrics

sidecar-host · string · default: ""

Address of the metrics scraper sidecar.

api:
  containers:
    args:
      - --sidecar-host=http://metrics-scraper:8000

If not specified, uses service proxy.

kubeconfig · string · default: ""

Path to kubeconfig file.

api:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/admin.conf

namespace · string · default: "kubernetes-dashboard"

Namespace for Dashboard-specific resources.

api:
  containers:
    args:
      - --namespace=kube-system

metrics-scraper-service-name · string · default: "kubernetes-dashboard-metrics-scraper"

Name of the metrics scraper service.

api:
  containers:
    args:
      - --metrics-scraper-service-name=custom-metrics-scraper

csrf-key · string · default: ""

Base64 encoded 256-byte CSRF key.

api:
  containers:
    args:
      - --csrf-key=<base64-encoded-key>

Can also be loaded from CSRF_KEY environment variable (preferred).

v · number · default: "1"

Log verbosity level.

api:
  containers:
    args:
      - --v=2

Higher values = more verbose logging.

Auth Module Arguments

The Auth module handles user authentication and token management.

Configuration in Helm

auth:
  containers:
    args:
      - --v=2

Available Arguments

apiserver-skip-tls-verify · boolean · default: "false"

Skip TLS verification for API server connections.

auth:
  containers:
    args:
      - --apiserver-skip-tls-verify=false

apiserver-ca-bundle · string · default: ""

Path to CA bundle for API server HTTPS.

auth:
  containers:
    args:
      - --apiserver-ca-bundle=/etc/ssl/certs/ca-bundle.crt

port · number · default: "8000"

Port for HTTPS requests.

auth:
  containers:
    args:
      - --port=8000

address · string · default: "0.0.0.0"

IP address to bind to.

auth:
  containers:
    args:
      - --address=0.0.0.0

kubeconfig · string · default: ""

Path to kubeconfig file.

auth:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config

apiserver-host · string · default: ""

Kubernetes API server address.

auth:
  containers:
    args:
      - --apiserver-host=https://kubernetes.default.svc

csrf-key · string · default: ""

Base64 encoded CSRF key.

auth:
  containers:
    args:
      - --csrf-key=<base64-key>

Preferably loaded from CSRF_KEY environment variable.

v · number · default: "1"

Log verbosity level.

auth:
  containers:
    args:
      - --v=2

Web Module Arguments

The Web module serves the Dashboard frontend UI.

Configuration in Helm

web:
  containers:
    args:
      - --system-banner="Production Environment"
      - --system-banner-severity=WARNING

Available Arguments

auto-generate-certificates · boolean · default: "false"

Automatically generate self-signed certificates.

web:
  containers:
    args:
      - --auto-generate-certificates=true

insecure-port · number · default: "8000"

HTTP port.

web:
  containers:
    args:
      - --insecure-port=8000

port · number · default: "8001"

HTTPS port.

web:
  containers:
    args:
      - --port=8443

insecure-bind-address · string · default: "127.0.0.1"

IP address for HTTP.

web:
  containers:
    args:
      - --insecure-bind-address=127.0.0.1

bind-address · string · default: "0.0.0.0"

IP address for HTTPS.

web:
  containers:
    args:
      - --bind-address=0.0.0.0

namespace · string · default: "kube-system"

Namespace for Dashboard resources.

web:
  containers:
    args:
      - --namespace=kubernetes-dashboard

default-cert-dir · string · default: "/certs"

Directory for TLS certificates.

web:
  containers:
    args:
      - --default-cert-dir=/etc/certs

tls-cert-file · string · default: ""

TLS certificate file path.

web:
  containers:
    args:
      - --tls-cert-file=/certs/tls.crt

tls-key-file · string · default: ""

TLS private key file path.

web:
  containers:
    args:
      - --tls-key-file=/certs/tls.key

settings-config-map-name · string · default: "kubernetes-dashboard-settings"

ConfigMap name for Dashboard settings.

web:
  containers:
    args:
      - --settings-config-map-name=custom-settings

See Settings Configuration for details.

system-banner · string · default: ""

Banner message displayed to all users.

web:
  containers:
    args:
      - --system-banner="Production Environment - Make changes carefully"

Accepts simple HTML tags:

web:
  containers:
    args:
      - --system-banner="<strong>Warning:</strong> Production Cluster"

system-banner-severity · string · default: "INFO"

Banner severity level (affects color/styling).

web:
  containers:
    args:
      - --system-banner="Production Environment"
      - --system-banner-severity=WARNING

Options:

• INFO - Blue banner
• WARNING - Yellow/orange banner
• ERROR - Red banner

locale-config · string · default: "./locale_conf.json"

Path to locale configuration file.

web:
  containers:
    args:
      - --locale-config=/etc/dashboard/locale.json

kubeconfig · string · default: ""

Path to kubeconfig file.

web:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config

v · number · default: "1"

Log verbosity level.

web:
  containers:
    args:
      - --v=3

Metrics Scraper Arguments

The Metrics Scraper polls and stores metrics from the Kubernetes Metrics Server.

Configuration in Helm

metricsScraper:
  containers:
    args:
      - --metric-resolution=30s
      - --metric-duration=30m

Available Arguments

metric-resolution · duration · default: "1m"

Polling interval for metrics.

metricsScraper:
  containers:
    args:
      - --metric-resolution=30s

Lower values = more frequent updates, higher resource usage.

metric-duration · duration · default: "15m"

Time to retain metrics before purging.

metricsScraper:
  containers:
    args:
      - --metric-duration=30m

kubeconfig · string · default: ""

Path to kubeconfig file.

metricsScraper:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config

db-file · string · default: "/tmp/metrics.db"

SQLite database file path.

metricsScraper:
  containers:
    args:
      - --db-file=/data/metrics.db

namespaces · string · default: ""

Comma-separated list of namespaces to monitor.

metricsScraper:
  containers:
    args:
      - --namespaces=default,kube-system,production

When provided, node metrics are skipped.

v · number · default: "1"

Log verbosity level.

metricsScraper:
  containers:
    args:
      - --v=2

Example Configurations

Production API with Monitoring

api:
  containers:
    args:
      - --prometheus-enabled=true
      - --cache-size=5000
      - --cache-ttl=15m
      - --metric-client-check-period=60
      - --v=1

Development with Debugging

api:
  containers:
    args:
      - --openapi-enabled=true
      - --profiler=true
      - --prometheus-enabled=true
      - --v=3

web:
  containers:
    args:
      - --system-banner="Development Cluster"
      - --system-banner-severity=INFO
      - --v=3

High-Performance Configuration

api:
  containers:
    args:
      - --cache-enabled=true
      - --cache-size=10000
      - --cache-ttl=30m
      - --cache-refresh-debounce=10s
      - --metric-client-check-period=120

metricsScraper:
  containers:
    args:
      - --metric-resolution=2m
      - --metric-duration=60m

Multi-Cluster Setup

api:
  containers:
    args:
      - --cluster-context-enabled=true
      - --token-exchange-endpoint=http://token-service:8000/exchange
      - --cache-enabled=true

Related Configuration

• Helm Values Reference - Container args configuration
• Settings Configuration - UI behavior settings
• Security Configuration - CSRF and TLS configuration