Skip to content
Spinoza

Documentation

Command line

Every flag, the environment variable that sets it, and its default.

Serving

FlagEnvironmentDefault
--addrSPINOZA_ADDR127.0.0.1:34115
--openSPINOZA_OPENoff
--token-fileSPINOZA_TOKEN_FILEunset
--log-levelSPINOZA_LOG_LEVELinfo
--log-formatSPINOZA_LOG_FORMATtext locally, json in cluster mode
--metrics-addrSPINOZA_METRICS_ADDRunset
--pprofSPINOZA_PPROFoff
--version
--license

Local mode refuses a non-loopback --addr. Cluster mode defaults to 0.0.0.0:8080 when no address is supplied. --pprof stays behind the active authentication model.

--metrics-addr opens a second listener that serves only /metrics, with no session, for a scrape. It has to differ from --addr; keep it inside the cluster.

Audit and records

FlagEnvironmentDefault
--audit-intervalSPINOZA_AUDIT_INTERVALoff
--audit-webhookSPINOZA_AUDIT_WEBHOOKunset
--audit-retentionSPINOZA_AUDIT_RETENTION90 days or 50,000 rows
--record-sessionsSPINOZA_RECORD_SESSIONSoff

--audit-interval re-runs the checks on that interval, at least a minute apart. --audit-webhook posts a summary when a run differs from the one before. --audit-retention sets how long the audit trail, check runs and transcripts are kept. --record-sessions keeps a transcript of every exec and node shell.

Cluster mode

FlagEnvironmentDefault
--cluster-modeSPINOZA_CLUSTER_MODEoff
--public-urlSPINOZA_PUBLIC_URLunset
--unsafe-allow-httpSPINOZA_UNSAFE_ALLOW_HTTPoff
--impersonateSPINOZA_IMPERSONATEon
--auth-modeSPINOZA_AUTH_MODEnone
--allow-anonymous-adminSPINOZA_ALLOW_ANONYMOUS_ADMINoff
--session-secret-fileSPINOZA_SESSION_SECRET_FILEunset
--session-ttlSPINOZA_SESSION_TTL8h
--session-max-ageSPINOZA_SESSION_MAX_AGE24h
--auth-default-roleSPINOZA_AUTH_DEFAULT_ROLEviewer
--auth-admin-groupsSPINOZA_AUTH_ADMIN_GROUPSunset
--auth-editor-groupsSPINOZA_AUTH_EDITOR_GROUPSunset
--auth-viewer-groupsSPINOZA_AUTH_VIEWER_GROUPSunset

The binary impersonates by default; the Helm chart sets impersonate to false and runs from its read-only service account until you turn it on. --unsafe-allow-http permits plaintext browser sessions on a non-loopback address, which exposes sessions and cluster data to the network.

Authentication proxy

FlagEnvironmentDefault
--auth-user-headerSPINOZA_AUTH_USER_HEADERX-Forwarded-User
--auth-groups-headerSPINOZA_AUTH_GROUPS_HEADERX-Forwarded-Groups
--auth-proxy-secret-headerSPINOZA_AUTH_PROXY_SECRET_HEADERX-Spinoza-Proxy-Secret
--auth-proxy-secret-fileSPINOZA_AUTH_PROXY_SECRET_FILEunset
--auth-proxy-logout-urlSPINOZA_AUTH_PROXY_LOGOUT_URLunset
--auth-proxy-websocket-max-ageSPINOZA_AUTH_PROXY_WEBSOCKET_MAX_AGE5m

An open WebSocket keeps the identity headers it was opened with, so a proxy-authenticated live session is closed after its maximum age and the browser reconnects through the proxy with current headers.

OIDC

FlagEnvironmentDefault
--auth-oidc-issuerSPINOZA_AUTH_OIDC_ISSUERunset
--auth-oidc-internal-issuerSPINOZA_AUTH_OIDC_INTERNAL_ISSUERunset
--auth-oidc-client-idSPINOZA_AUTH_OIDC_CLIENT_IDunset
--auth-oidc-client-secretSPINOZA_AUTH_OIDC_CLIENT_SECRETunset
--auth-oidc-client-secret-fileSPINOZA_AUTH_OIDC_CLIENT_SECRET_FILEunset
--auth-oidc-redirect-urlSPINOZA_AUTH_OIDC_REDIRECT_URLpublic URL + /auth/callback
--auth-oidc-scopesSPINOZA_AUTH_OIDC_SCOPESopenid,profile,email,groups
--auth-oidc-groups-claimSPINOZA_AUTH_OIDC_GROUPS_CLAIMgroups
--auth-oidc-username-claimsSPINOZA_AUTH_OIDC_USERNAME_CLAIMSpreferred_username,email,sub
--auth-oidc-username-prefixSPINOZA_AUTH_OIDC_USERNAME_PREFIXunset
--auth-oidc-groups-prefixSPINOZA_AUTH_OIDC_GROUPS_PREFIXunset
--auth-oidc-post-logout-urlSPINOZA_AUTH_OIDC_POST_LOGOUT_URLpublic URL + /
--auth-oidc-ca-certSPINOZA_AUTH_OIDC_CA_CERTunset
--auth-oidc-insecure-skip-verifySPINOZA_AUTH_OIDC_INSECURE_SKIP_VERIFYoff
--auth-oidc-unsafe-allow-httpSPINOZA_AUTH_OIDC_UNSAFE_ALLOW_HTTPoff
--auth-oidc-backchannel-logoutSPINOZA_AUTH_OIDC_BACKCHANNEL_LOGOUToff

Cluster access

FlagEnvironmentDefault
--kubeconfigSPINOZA_KUBECONFIGthe usual lookup
--contextSPINOZA_START_CONTEXTcurrent context
--viewSPINOZA_START_VIEWlast view
--prometheusSPINOZA_PROMETHEUSdiscovered
--qpsSPINOZA_QPS50
--burstSPINOZA_BURST100

Shells and helpers

FlagEnvironmentDefault
--kubectlSPINOZA_KUBECTLkubectl
--helmSPINOZA_HELMhelm
--debug-imageSPINOZA_DEBUG_IMAGEbusybox:1.37
--node-shellSPINOZA_NODE_SHELLoff
--node-shell-imageSPINOZA_NODE_SHELL_IMAGEbusybox:1.37
--node-shell-namespaceSPINOZA_NODE_SHELL_NAMESPACEkube-system

Caches and budgets

FlagEnvironmentDefault
--sync-timeoutSPINOZA_SYNC_TIMEOUT30s
--warm-concurrencySPINOZA_WARM_CONCURRENCY8
--count-budgetSPINOZA_COUNT_BUDGET20s
--count-timeoutSPINOZA_COUNT_TIMEOUT5s
--count-concurrencySPINOZA_COUNT_CONCURRENCY24

The count flags bound how long the sidebar may spend counting objects. A type that runs out of time shows a dash rather than a wrong number.