Skip to main content
Kubernetes Dashboard modules accept command-line arguments to customize their behavior. Arguments are passed via Helm values under <module>.containers.args.

​
API Module Arguments

The API module is the backend that communicates with the Kubernetes API server and serves Dashboard data.

​
Configuration in Helm

api:
  containers:
    args:
      - --openapi-enabled=true
      - --prometheus-enabled=true
      - --system-banner="Production Cluster"

​
Available Arguments

​
disable-csrf-protection
boolean
default:"false"
Disable CSRF (Cross-Site Request Forgery) protection.
api:
  containers:
    args:
      - --disable-csrf-protection=false
Never enable this in production. CSRF protection is critical for security.
​
act-as-proxy
boolean
default:"false"
Force Dashboard to work in full proxy mode, disabling in-cluster client calls.
api:
  containers:
    args:
      - --act-as-proxy=true
Useful when Dashboard runs outside the cluster and must proxy all requests.
​
openapi-enabled
boolean
default:"false"
Enable OpenAPI v2 endpoint at /apidocs.json.
api:
  containers:
    args:
      - --openapi-enabled=true
Used to autogenerate OpenAPI/GraphQL schemas.
​
profiler
boolean
default:"false"
Enable pprof profiling endpoint.
api:
  containers:
    args:
      - --profiler=true
Exposes profiling data at localhost:8070/debug/pprof for performance debugging.
​
prometheus-enabled
boolean
default:"false"
Enable Prometheus metrics endpoint.
api:
  containers:
    args:
      - --prometheus-enabled=true
Exposes metrics at localhost:8080/metrics for Prometheus scraping.
​
apiserver-skip-tls-verify
boolean
default:"false"
Skip TLS certificate verification when connecting to Kubernetes API server.
api:
  containers:
    args:
      - --apiserver-skip-tls-verify=true
Only use for development/testing. Never in production.
​
auto-generate-certificates
boolean
default:"false"
Automatically generate self-signed certificates for HTTPS.
api:
  containers:
    args:
      - --auto-generate-certificates=true
Certificates are stored in --default-cert-dir.
​
cache-enabled
boolean
default:"true"
Enable client-side caching.
api:
  containers:
    args:
      - --cache-enabled=true
Improves performance by caching Kubernetes API responses.
​
cluster-context-enabled
boolean
default:"false"
Enable multi-cluster cache context support.
api:
  containers:
    args:
      - --cluster-context-enabled=true
      - --token-exchange-endpoint=http://token-service:8000/exchange
Requires a token exchange endpoint for multi-cluster scenarios.
​
cache-size
number
default:"1000"
Maximum number of cache entries.
api:
  containers:
    args:
      - --cache-size=5000
​
cache-ttl
duration
default:"10m"
Time-to-live for each cache entry.
api:
  containers:
    args:
      - --cache-ttl=15m
​
cache-refresh-debounce
duration
default:"5s"
Minimum time between cache refreshes in background.
api:
  containers:
    args:
      - --cache-refresh-debounce=10s
​
insecure-port
number
default:"8000"
Port for HTTP requests.
api:
  containers:
    args:
      - --insecure-port=8000
​
port
number
default:"8001"
Port for HTTPS requests.
api:
  containers:
    args:
      - --port=8443
​
metric-client-check-period
number
default:"30"
Seconds between metric client health checks.
api:
  containers:
    args:
      - --metric-client-check-period=60
​
insecure-bind-address
string
default:"127.0.0.1"
IP address for --insecure-port.
api:
  containers:
    args:
      - --insecure-bind-address=0.0.0.0
​
bind-address
string
default:"0.0.0.0"
IP address for --port.
api:
  containers:
    args:
      - --bind-address=0.0.0.0
​
token-exchange-endpoint
string
default:""
Endpoint for token exchange when --cluster-context-enabled=true.
api:
  containers:
    args:
      - --token-exchange-endpoint=http://auth-service:8000/exchange
​
default-cert-dir
string
default:"/certs"
Directory for TLS certificates.
api:
  containers:
    args:
      - --default-cert-dir=/etc/dashboard/certs
Path is relative to the container, not the host.
​
apiserver-ca-bundle
string
default:""
Path to CA bundle for API server HTTPS connections.
api:
  containers:
    args:
      - --apiserver-ca-bundle=/etc/ssl/certs/ca-bundle.crt
​
tls-cert-file
string
default:""
Path to TLS certificate file.
api:
  containers:
    args:
      - --tls-cert-file=/certs/tls.crt
​
tls-key-file
string
default:""
Path to TLS private key file.
api:
  containers:
    args:
      - --tls-key-file=/certs/tls.key
​
apiserver-host
string
default:""
Kubernetes API server address.
api:
  containers:
    args:
      - --apiserver-host=https://kubernetes.default.svc:443
If not specified, uses in-cluster service discovery.
​
metrics-provider
string
default:"sidecar"
Metrics provider type.
api:
  containers:
    args:
      - --metrics-provider=sidecar
Options:
  • sidecar - Use metrics-scraper sidecar
  • none - Disable metrics
​
sidecar-host
string
default:""
Address of the metrics scraper sidecar.
api:
  containers:
    args:
      - --sidecar-host=http://metrics-scraper:8000
If not specified, uses service proxy.
​
kubeconfig
string
default:""
Path to kubeconfig file.
api:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/admin.conf
​
namespace
string
default:"kubernetes-dashboard"
Namespace for Dashboard-specific resources.
api:
  containers:
    args:
      - --namespace=kube-system
​
metrics-scraper-service-name
string
default:"kubernetes-dashboard-metrics-scraper"
Name of the metrics scraper service.
api:
  containers:
    args:
      - --metrics-scraper-service-name=custom-metrics-scraper
​
csrf-key
string
default:""
Base64 encoded 256-byte CSRF key.
api:
  containers:
    args:
      - --csrf-key=<base64-encoded-key>
Can also be loaded from CSRF_KEY environment variable (preferred).
​
v
number
default:"1"
Log verbosity level.
api:
  containers:
    args:
      - --v=2
Higher values = more verbose logging.

​
Auth Module Arguments

The Auth module handles user authentication and token management.

​
Configuration in Helm

auth:
  containers:
    args:
      - --v=2

​
Available Arguments

​
apiserver-skip-tls-verify
boolean
default:"false"
Skip TLS verification for API server connections.
auth:
  containers:
    args:
      - --apiserver-skip-tls-verify=false
​
apiserver-ca-bundle
string
default:""
Path to CA bundle for API server HTTPS.
auth:
  containers:
    args:
      - --apiserver-ca-bundle=/etc/ssl/certs/ca-bundle.crt
​
port
number
default:"8000"
Port for HTTPS requests.
auth:
  containers:
    args:
      - --port=8000
​
address
string
default:"0.0.0.0"
IP address to bind to.
auth:
  containers:
    args:
      - --address=0.0.0.0
​
kubeconfig
string
default:""
Path to kubeconfig file.
auth:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config
​
apiserver-host
string
default:""
Kubernetes API server address.
auth:
  containers:
    args:
      - --apiserver-host=https://kubernetes.default.svc
​
csrf-key
string
default:""
Base64 encoded CSRF key.
auth:
  containers:
    args:
      - --csrf-key=<base64-key>
Preferably loaded from CSRF_KEY environment variable.
​
v
number
default:"1"
Log verbosity level.
auth:
  containers:
    args:
      - --v=2

​
Web Module Arguments

The Web module serves the Dashboard frontend UI.

​
Configuration in Helm

web:
  containers:
    args:
      - --system-banner="Production Environment"
      - --system-banner-severity=WARNING

​
Available Arguments

​
auto-generate-certificates
boolean
default:"false"
Automatically generate self-signed certificates.
web:
  containers:
    args:
      - --auto-generate-certificates=true
​
insecure-port
number
default:"8000"
HTTP port.
web:
  containers:
    args:
      - --insecure-port=8000
​
port
number
default:"8001"
HTTPS port.
web:
  containers:
    args:
      - --port=8443
​
insecure-bind-address
string
default:"127.0.0.1"
IP address for HTTP.
web:
  containers:
    args:
      - --insecure-bind-address=127.0.0.1
​
bind-address
string
default:"0.0.0.0"
IP address for HTTPS.
web:
  containers:
    args:
      - --bind-address=0.0.0.0
​
namespace
string
default:"kube-system"
Namespace for Dashboard resources.
web:
  containers:
    args:
      - --namespace=kubernetes-dashboard
​
default-cert-dir
string
default:"/certs"
Directory for TLS certificates.
web:
  containers:
    args:
      - --default-cert-dir=/etc/certs
​
tls-cert-file
string
default:""
TLS certificate file path.
web:
  containers:
    args:
      - --tls-cert-file=/certs/tls.crt
​
tls-key-file
string
default:""
TLS private key file path.
web:
  containers:
    args:
      - --tls-key-file=/certs/tls.key
​
settings-config-map-name
string
default:"kubernetes-dashboard-settings"
ConfigMap name for Dashboard settings.
web:
  containers:
    args:
      - --settings-config-map-name=custom-settings
See Settings Configuration for details.
​
system-banner
string
default:""
Banner message displayed to all users.
web:
  containers:
    args:
      - --system-banner="Production Environment - Make changes carefully"
Accepts simple HTML tags:
web:
  containers:
    args:
      - --system-banner="<strong>Warning:</strong> Production Cluster"
​
system-banner-severity
string
default:"INFO"
Banner severity level (affects color/styling).
web:
  containers:
    args:
      - --system-banner="Production Environment"
      - --system-banner-severity=WARNING
Options:
  • INFO - Blue banner
  • WARNING - Yellow/orange banner
  • ERROR - Red banner
​
locale-config
string
default:"./locale_conf.json"
Path to locale configuration file.
web:
  containers:
    args:
      - --locale-config=/etc/dashboard/locale.json
​
kubeconfig
string
default:""
Path to kubeconfig file.
web:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config
​
v
number
default:"1"
Log verbosity level.
web:
  containers:
    args:
      - --v=3

​
Metrics Scraper Arguments

The Metrics Scraper polls and stores metrics from the Kubernetes Metrics Server.

​
Configuration in Helm

metricsScraper:
  containers:
    args:
      - --metric-resolution=30s
      - --metric-duration=30m

​
Available Arguments

​
metric-resolution
duration
default:"1m"
Polling interval for metrics.
metricsScraper:
  containers:
    args:
      - --metric-resolution=30s
Lower values = more frequent updates, higher resource usage.
​
metric-duration
duration
default:"15m"
Time to retain metrics before purging.
metricsScraper:
  containers:
    args:
      - --metric-duration=30m
​
kubeconfig
string
default:""
Path to kubeconfig file.
metricsScraper:
  containers:
    args:
      - --kubeconfig=/etc/kubernetes/config
​
db-file
string
default:"/tmp/metrics.db"
SQLite database file path.
metricsScraper:
  containers:
    args:
      - --db-file=/data/metrics.db
​
namespaces
string
default:""
Comma-separated list of namespaces to monitor.
metricsScraper:
  containers:
    args:
      - --namespaces=default,kube-system,production
When provided, node metrics are skipped.
​
v
number
default:"1"
Log verbosity level.
metricsScraper:
  containers:
    args:
      - --v=2

​
Example Configurations

​
Production API with Monitoring

api:
  containers:
    args:
      - --prometheus-enabled=true
      - --cache-size=5000
      - --cache-ttl=15m
      - --metric-client-check-period=60
      - --v=1

​
Development with Debugging

api:
  containers:
    args:
      - --openapi-enabled=true
      - --profiler=true
      - --prometheus-enabled=true
      - --v=3

web:
  containers:
    args:
      - --system-banner="Development Cluster"
      - --system-banner-severity=INFO
      - --v=3

​
High-Performance Configuration

api:
  containers:
    args:
      - --cache-enabled=true
      - --cache-size=10000
      - --cache-ttl=30m
      - --cache-refresh-debounce=10s
      - --metric-client-check-period=120

metricsScraper:
  containers:
    args:
      - --metric-resolution=2m
      - --metric-duration=60m

​
Multi-Cluster Setup

api:
  containers:
    args:
      - --cluster-context-enabled=true
      - --token-exchange-endpoint=http://token-service:8000/exchange
      - --cache-enabled=true

Build docs developers (and LLMs) love

Get started for freeTalk to us