Configuration
Package v1alpha1 configuration file contains all the options available for configuring a machine.
To generate a set of basic configuration files, run:
talosctl gen config --version v1alpha1 <cluster name> <cluster endpoint>
This will generate a machine config for each node type, and a talosconfig for the CLI.
Config
Config defines the v1alpha1 configuration file.
version: v1alpha1
persist: true
machine: # ...
cluster: # ...
version
string
Indicates the schema used to decode the contents.
Valid values:
v1alpha1
debug
bool
Enable verbose logging to the console. All system containers logs will flow into serial console.
Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
Valid values:
true
yes
false
no
persist
bool
Indicates whether to pull the machine config upon every boot.
Valid values:
true
yes
false
no
machine
MachineConfig
Provides machine specific configuration options.
cluster
ClusterConfig
Provides cluster specific configuration options.
MachineConfig
MachineConfig represents the machine-specific config values.
Appears in:
Config.machine
type: controlplane
# InstallConfig represents the installation options for preparing a node.
install:
disk: /dev/sda # The disk used for installations.
# Allows for supplying extra kernel args via the bootloader.
extraKernelArgs:
- console=ttyS1
- panic=10
image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation.
bootloader: true # Indicates if a bootloader should be installed.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk characteristics like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
type
string
Defines the role of the machine within the cluster.
Init
Init node type designates the first control plane node to come up. You can think of it like a bootstrap node. This node will perform the initial steps to bootstrap the cluster – generation of TLS assets, starting of the control plane, etc.
Control Plane
Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler.
Worker
Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads.
Valid values:
init
controlplane
join
token
string
The token
is used by a machine to join the PKI of the cluster.
Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.
Warning: It is important to ensure that this token is correct since a machine’s certificate has a short TTL by default.
Examples:
token: 328hom.uqjzh6jnn2eie9oi
ca
PEMEncodedCertificateAndKey
The root certificate authority of the PKI.
It is composed of a base64 encoded crt
and key
.
Examples:
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
certSANs
[]string
Extra certificate subject alternative names for the machine’s certificate. By default, all non-loopback interface IPs are automatically added to the certificate’s SANs.
Examples:
certSANs:
- 10.0.0.10
- 172.16.0.10
- 192.168.0.10
kubelet
KubeletConfig
Used to provide additional options to the kubelet.
Examples:
kubelet:
image: ghcr.io/talos-systems/kubelet:v1.21.0 # The `image` field is an optional reference to an alternative kubelet image.
# The `extraArgs` field is used to provide additional flags to the kubelet.
extraArgs:
feature-gates: ServerSideApply=true
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
# - destination: /var/lib/example
# type: bind
# source: /var/lib/example
# options:
# - rshared
# - rw
network
NetworkConfig
Provides machine specific network configuration options.
Examples:
network:
hostname: worker-1 # Used to statically set the hostname for the machine.
# `interfaces` is used to define the network interface configuration.
interfaces:
- interface: eth0 # The interface name.
cidr: 192.168.2.0/24 # Assigns a static IP address to the interface.
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network.
gateway: 192.168.2.1 # The route's gateway.
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.
# # Bond specific options.
# bond:
# # The interfaces that make up the bond.
# interfaces:
# - eth0
# - eth1
# mode: 802.3ad # A bond option.
# lacpRate: fast # A bond option.
# # Indicates if DHCP should be used to configure the interface.
# dhcp: true
# # DHCP specific options.
# dhcpOptions:
# routeMetric: 1024 # The priority of all routes received via DHCP.
# # Wireguard specific configuration.
# # wireguard server example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# listenPort: 51111 # Specifies a device's listening port.
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # wireguard peer example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
# persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # Virtual (shared) IP address configuration.
# vip:
# ip: 172.16.199.55 # Specifies the IP address to be used.
# Used to statically set the nameservers for the machine.
nameservers:
- 9.8.7.6
- 8.7.6.5
# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
# - ip: 192.168.1.100 # The IP of the host.
# # The host alias.
# aliases:
# - example
# - example.domain.tld
disks
[]MachineDisk
Used to partition, format and mount additional disks.
Since the rootfs is read only with the exception of /var
, mounts are only valid if they are under /var
.
Note that the partitioning and formating is done only once, if and only if no existing partitions are found.
If size:
is omitted, the partition is sized to occupy the full disk.
Note:
size
is in units of bytes.
Examples:
disks:
- device: /dev/sdb # The name of the disk to use.
# A list of partitions to create on the disk.
partitions:
- mountpoint: /var/mnt/extra # Where to mount the partition.
# # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
# # Human readable representation.
# size: 100 MB
# # Precise value in bytes.
# size: 1073741824
install
InstallConfig
Used to provide instructions for installations.
Examples:
install:
disk: /dev/sda # The disk used for installations.
# Allows for supplying extra kernel args via the bootloader.
extraKernelArgs:
- console=ttyS1
- panic=10
image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation.
bootloader: true # Indicates if a bootloader should be installed.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk characteristics like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
files
[]MachineFile
Allows the addition of user specified files.
The value of op
can be create
, overwrite
, or append
.
In the case of create
, path
must not exist.
In the case of overwrite
, and append
, path
must be a valid file.
If an op
value of append
is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Note: The specified
path
is relative to/var
.
Examples:
files:
- content: '...' # The contents of the file.
permissions: 0o666 # The file's permissions in octal.
path: /tmp/file.txt # The path of the file.
op: append # The operation to use
env
Env
The env
field allows for the addition of environment variables.
All environment variables are set on PID 1 in addition to every service.
Valid values:
GRPC_GO_LOG_VERBOSITY_LEVEL
GRPC_GO_LOG_SEVERITY_LEVEL
http_proxy
https_proxy
no_proxy
Examples:
env:
GRPC_GO_LOG_SEVERITY_LEVEL: info
GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
https_proxy: http://SERVER:PORT/
env:
GRPC_GO_LOG_SEVERITY_LEVEL: error
https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
env:
https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
time
TimeConfig
Used to configure the machine’s time settings.
Examples:
time:
disabled: false # Indicates if the time service is disabled for the machine.
# Specifies time (NTP) servers to use for setting the system time.
servers:
- time.cloudflare.com
sysctls
map[string]string
Used to configure the machine’s sysctls.
Examples:
sysctls:
kernel.domainname: talos.dev
net.ipv4.ip_forward: "0"
registries
RegistriesConfig
Used to configure the machine’s container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.
The mirrors
section allows to redirect requests for images to non-default registry,
which might be local registry or caching mirror.
The config
section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in .docker/config.json
.
See also matching configuration for CRI containerd plugin.
Examples:
registries:
# Specifies mirror configuration for each registry.
mirrors:
docker.io:
# List of endpoints (URLs) for registry mirrors to use.
endpoints:
- https://registry.local
# Specifies TLS & auth configuration for HTTPS image registries.
config:
registry.local:
# The TLS configuration for the registry.
tls:
# Enable mutual TLS authentication with the registry.
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# The auth configuration for this registry.
auth:
username: username # Optional registry authentication.
password: password # Optional registry authentication.
systemDiskEncryption
SystemDiskEncryptionConfig
Machine system disk encryption configuration. Defines each system partition encryption parameters.
Examples:
systemDiskEncryption:
# Ephemeral partition encryption.
ephemeral:
provider: luks2 # Encryption provider to use for the encryption.
# Defines the encryption keys generation and storage method.
keys:
- # Deterministically generated key from the node UUID and PartitionLabel.
nodeID: {}
slot: 0 # Key slot number for luks2 encryption.
ClusterConfig
ClusterConfig represents the cluster-wide config values.
Appears in:
Config.cluster
# ControlPlaneConfig represents the control plane configuration options.
controlPlane:
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
clusterName: talos.local
# ClusterNetworkConfig represents kube networking configuration options.
network:
# The CNI used.
cni:
name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
controlPlane
ControlPlaneConfig
Provides control plane specific configuration options.
Examples:
controlPlane:
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
clusterName
string
Configures the cluster’s name.
network
ClusterNetworkConfig
Provides cluster specific network configuration options.
Examples:
network:
# The CNI used.
cni:
name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
token
string
aescbcEncryptionSecret
string
The key used for the encryption of secret data at rest.
Examples:
aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
ca
PEMEncodedCertificateAndKey
The base64 encoded root certificate authority used by Kubernetes.
Examples:
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
aggregatorCA
PEMEncodedCertificateAndKey
The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.
Examples:
aggregatorCA:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
serviceAccount
PEMEncodedKey
The base64 encoded private key for service account token generation.
Examples:
serviceAccount:
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
apiServer
APIServerConfig
API server specific configuration options.
Examples:
apiServer:
image: k8s.gcr.io/kube-apiserver:v1.21.0 # The container image used in the API server manifest.
# Extra arguments to supply to the API server.
extraArgs:
feature-gates: ServerSideApply=true
http2-max-streams-per-connection: "32"
# Extra certificate subject alternative names for the API server's certificate.
certSANs:
- 1.2.3.4
- 4.5.6.7
controllerManager
ControllerManagerConfig
Controller manager server specific configuration options.
Examples:
controllerManager:
image: k8s.gcr.io/kube-controller-manager:v1.21.0 # The container image used in the controller manager manifest.
# Extra arguments to supply to the controller manager.
extraArgs:
feature-gates: ServerSideApply=true
proxy
ProxyConfig
Kube-proxy server-specific configuration options
Examples:
proxy:
image: k8s.gcr.io/kube-proxy:v1.21.0 # The container image used in the kube-proxy manifest.
mode: ipvs # proxy mode of kube-proxy.
# Extra arguments to supply to kube-proxy.
extraArgs:
proxy-mode: iptables
scheduler
SchedulerConfig
Scheduler server specific configuration options.
Examples:
scheduler:
image: k8s.gcr.io/kube-scheduler:v1.21.0 # The container image used in the scheduler manifest.
# Extra arguments to supply to the scheduler.
extraArgs:
feature-gates: AllBeta=true
etcd
EtcdConfig
Etcd specific configuration options.
Examples:
etcd:
image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service.
# The `ca` is the root certificate authority of the PKI.
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# Extra arguments to supply to etcd.
extraArgs:
election-timeout: "5000"
coreDNS
CoreDNS
Core DNS specific configuration options.
Examples:
coreDNS:
image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image.
externalCloudProvider
ExternalCloudProviderConfig
External cloud provider configuration.
Examples:
externalCloudProvider:
enabled: true # Enable external cloud provider.
# A list of urls that point to additional manifests for an external cloud provider.
manifests:
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
extraManifests
[]string
A list of urls that point to additional manifests. These will get automatically deployed as part of the bootstrap.
Examples:
extraManifests:
- https://www.example.com/manifest1.yaml
- https://www.example.com/manifest2.yaml
extraManifestHeaders
map[string]string
A map of key value pairs that will be added while fetching the extraManifests.
Examples:
extraManifestHeaders:
Token: "1234567"
X-ExtraInfo: info
inlineManifests
ClusterInlineManifests
A list of inline Kubernetes manifests. These will get automatically deployed as part of the bootstrap.
Examples:
inlineManifests:
- name: namespace-ci # Name of the manifest.
contents: |- # Manifest contents as a string.
apiVersion: v1
kind: Namespace
metadata:
name: ci
adminKubeconfig
AdminKubeconfigConfig
Settings for admin kubeconfig generation. Certificate lifetime can be configured.
Examples:
adminKubeconfig:
certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
allowSchedulingOnMasters
bool
Allows running workload on master nodes.
Valid values:
true
yes
false
no
KubeletConfig
KubeletConfig represents the kubelet config values.
Appears in:
MachineConfig.kubelet
image: ghcr.io/talos-systems/kubelet:v1.21.0 # The `image` field is an optional reference to an alternative kubelet image.
# The `extraArgs` field is used to provide additional flags to the kubelet.
extraArgs:
feature-gates: ServerSideApply=true
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
# - destination: /var/lib/example
# type: bind
# source: /var/lib/example
# options:
# - rshared
# - rw
image
string
The image
field is an optional reference to an alternative kubelet image.
Examples:
image: ghcr.io/talos-systems/kubelet:v1.21.0
extraArgs
map[string]string
The extraArgs
field is used to provide additional flags to the kubelet.
Examples:
extraArgs:
key: value
extraMounts
[]Mount
The extraMounts
field is used to add additional mounts to the kubelet container.
Examples:
extraMounts:
- destination: /var/lib/example
type: bind
source: /var/lib/example
options:
- rshared
- rw
registerWithFQDN
bool
The registerWithFQDN
field is used to force kubelet to use the node FQDN for registration.
This is required in clouds like AWS.
Valid values:
true
yes
false
no
NetworkConfig
NetworkConfig represents the machine’s networking config values.
Appears in:
MachineConfig.network
hostname: worker-1 # Used to statically set the hostname for the machine.
# `interfaces` is used to define the network interface configuration.
interfaces:
- interface: eth0 # The interface name.
cidr: 192.168.2.0/24 # Assigns a static IP address to the interface.
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network.
gateway: 192.168.2.1 # The route's gateway.
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.
# # Bond specific options.
# bond:
# # The interfaces that make up the bond.
# interfaces:
# - eth0
# - eth1
# mode: 802.3ad # A bond option.
# lacpRate: fast # A bond option.
# # Indicates if DHCP should be used to configure the interface.
# dhcp: true
# # DHCP specific options.
# dhcpOptions:
# routeMetric: 1024 # The priority of all routes received via DHCP.
# # Wireguard specific configuration.
# # wireguard server example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# listenPort: 51111 # Specifies a device's listening port.
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # wireguard peer example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
# persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # Virtual (shared) IP address configuration.
# vip:
# ip: 172.16.199.55 # Specifies the IP address to be used.
# Used to statically set the nameservers for the machine.
nameservers:
- 9.8.7.6
- 8.7.6.5
# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
# - ip: 192.168.1.100 # The IP of the host.
# # The host alias.
# aliases:
# - example
# - example.domain.tld
hostname
string
Used to statically set the hostname for the machine.
interfaces
[]Device
interfaces
is used to define the network interface configuration.
By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Examples:
interfaces:
- interface: eth0 # The interface name.
cidr: 192.168.2.0/24 # Assigns a static IP address to the interface.
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network.
gateway: 192.168.2.1 # The route's gateway.
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.
# # Bond specific options.
# bond:
# # The interfaces that make up the bond.
# interfaces:
# - eth0
# - eth1
# mode: 802.3ad # A bond option.
# lacpRate: fast # A bond option.
# # Indicates if DHCP should be used to configure the interface.
# dhcp: true
# # DHCP specific options.
# dhcpOptions:
# routeMetric: 1024 # The priority of all routes received via DHCP.
# # Wireguard specific configuration.
# # wireguard server example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# listenPort: 51111 # Specifies a device's listening port.
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # wireguard peer example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
# persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # Virtual (shared) IP address configuration.
# vip:
# ip: 172.16.199.55 # Specifies the IP address to be used.
nameservers
[]string
Used to statically set the nameservers for the machine.
Defaults to 1.1.1.1
and 8.8.8.8
Examples:
nameservers:
- 8.8.8.8
- 1.1.1.1
extraHostEntries
[]ExtraHost
Allows for extra entries to be added to the /etc/hosts
file
Examples:
extraHostEntries:
- ip: 192.168.1.100 # The IP of the host.
# The host alias.
aliases:
- example
- example.domain.tld
InstallConfig
InstallConfig represents the installation options for preparing a node.
Appears in:
MachineConfig.install
disk: /dev/sda # The disk used for installations.
# Allows for supplying extra kernel args via the bootloader.
extraKernelArgs:
- console=ttyS1
- panic=10
image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation.
bootloader: true # Indicates if a bootloader should be installed.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk characteristics like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
disk
string
The disk used for installations.
Examples:
disk: /dev/sda
disk: /dev/nvme0
diskSelector
InstallDiskSelector
Look up disk using disk characteristics like model, size, serial and others.
Always has priority over disk
.
Examples:
diskSelector:
size: 4GB # Disk size.
model: WDC* # Disk model `/sys/block/<dev>/device/model`.
extraKernelArgs
[]string
Allows for supplying extra kernel args via the bootloader.
Examples:
extraKernelArgs:
- talos.platform=metal
- reboot=k
image
string
Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on GitHub releases page.
Examples:
image: ghcr.io/talos-systems/installer:latest
bootloader
bool
Indicates if a bootloader should be installed.
Valid values:
true
yes
false
no
wipe
bool
Indicates if the installation disk should be wiped at installation time.
Defaults to true
.
Valid values:
true
yes
false
no
InstallDiskSizeMatcher
InstallDiskSizeMatcher disk size condition parser.
Appears in:
InstallDiskSelector.size
4GB
'> 1TB'
<= 2TB
InstallDiskSelector
InstallDiskSelector represents a disk query parameters for the install disk lookup.
Appears in:
InstallConfig.diskSelector
size: 4GB # Disk size.
model: WDC* # Disk model `/sys/block/<dev>/device/model`.
Disk size.
Examples:
size: 4GB
size: '> 1TB'
size: <= 2TB
name
string
Disk name /sys/block/<dev>/device/name
.
model
string
Disk model /sys/block/<dev>/device/model
.
serial
string
Disk serial number /sys/block/<dev>/serial
.
modalias
string
Disk modalias /sys/block/<dev>/device/modalias
.
uuid
string
Disk UUID /sys/block/<dev>/uuid
.
wwid
string
Disk WWID /sys/block/<dev>/wwid
.
type
InstallDiskType
Disk Type.
Valid values:
ssd
hdd
nvme
sd
TimeConfig
TimeConfig represents the options for configuring time on a machine.
Appears in:
MachineConfig.time
disabled: false # Indicates if the time service is disabled for the machine.
# Specifies time (NTP) servers to use for setting the system time.
servers:
- time.cloudflare.com
disabled
bool
Indicates if the time service is disabled for the machine.
Defaults to false
.
servers
[]string
Specifies time (NTP) servers to use for setting the system time.
Defaults to pool.ntp.org
This parameter only supports a single time server.
RegistriesConfig
RegistriesConfig represents the image pull options.
Appears in:
MachineConfig.registries
# Specifies mirror configuration for each registry.
mirrors:
docker.io:
# List of endpoints (URLs) for registry mirrors to use.
endpoints:
- https://registry.local
# Specifies TLS & auth configuration for HTTPS image registries.
config:
registry.local:
# The TLS configuration for the registry.
tls:
# Enable mutual TLS authentication with the registry.
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# The auth configuration for this registry.
auth:
username: username # Optional registry authentication.
password: password # Optional registry authentication.
mirrors
map[string]RegistryMirrorConfig
Specifies mirror configuration for each registry. This setting allows to use local pull-through caching registires, air-gapped installations, etc.
Registry name is the first segment of image identifier, with ‘docker.io’ being default one. To catch any registry names not specified explicitly, use ‘*’.
Examples:
mirrors:
ghcr.io:
# List of endpoints (URLs) for registry mirrors to use.
endpoints:
- https://registry.insecure
- https://ghcr.io/v2/
config
map[string]RegistryConfig
Specifies TLS & auth configuration for HTTPS image registries. Mutual TLS can be enabled with ‘clientIdentity’ option.
TLS configuration can be skipped if registry has trusted server certificate.
Examples:
config:
registry.insecure:
# The TLS configuration for the registry.
tls:
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
# # Enable mutual TLS authentication with the registry.
# clientIdentity:
# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# # The auth configuration for this registry.
# auth:
# username: username # Optional registry authentication.
# password: password # Optional registry authentication.
PodCheckpointer
PodCheckpointer represents the pod-checkpointer config values.
image
string
The image
field is an override to the default pod-checkpointer image.
CoreDNS
CoreDNS represents the CoreDNS config values.
Appears in:
ClusterConfig.coreDNS
image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image.
image
string
The image
field is an override to the default coredns image.
Endpoint
Endpoint represents the endpoint URL parsed out of the machine config.
Appears in:
ControlPlaneConfig.endpoint
https://1.2.3.4:6443
https://cluster1.internal:6443
ControlPlaneConfig
ControlPlaneConfig represents the control plane configuration options.
Appears in:
ClusterConfig.controlPlane
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
endpoint
Endpoint
Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number.
Examples:
endpoint: https://1.2.3.4:6443
endpoint: https://cluster1.internal:6443
localAPIServerPort
int
The port that the API server listens on internally.
This may be different than the port portion listed in the endpoint field above.
The default is 6443
.
APIServerConfig
APIServerConfig represents the kube apiserver configuration options.
Appears in:
ClusterConfig.apiServer
image: k8s.gcr.io/kube-apiserver:v1.21.0 # The container image used in the API server manifest.
# Extra arguments to supply to the API server.
extraArgs:
feature-gates: ServerSideApply=true
http2-max-streams-per-connection: "32"
# Extra certificate subject alternative names for the API server's certificate.
certSANs:
- 1.2.3.4
- 4.5.6.7
image
string
The container image used in the API server manifest.
Examples:
image: k8s.gcr.io/kube-apiserver:v1.21.0
extraArgs
map[string]string
Extra arguments to supply to the API server.
extraVolumes
[]VolumeMountConfig
Extra volumes to mount to the API server static pod.
certSANs
[]string
Extra certificate subject alternative names for the API server’s certificate.
ControllerManagerConfig
ControllerManagerConfig represents the kube controller manager configuration options.
Appears in:
ClusterConfig.controllerManager
image: k8s.gcr.io/kube-controller-manager:v1.21.0 # The container image used in the controller manager manifest.
# Extra arguments to supply to the controller manager.
extraArgs:
feature-gates: ServerSideApply=true
image
string
The container image used in the controller manager manifest.
Examples:
image: k8s.gcr.io/kube-controller-manager:v1.21.0
extraArgs
map[string]string
Extra arguments to supply to the controller manager.
extraVolumes
[]VolumeMountConfig
Extra volumes to mount to the controller manager static pod.
ProxyConfig
ProxyConfig represents the kube proxy configuration options.
Appears in:
ClusterConfig.proxy
image: k8s.gcr.io/kube-proxy:v1.21.0 # The container image used in the kube-proxy manifest.
mode: ipvs # proxy mode of kube-proxy.
# Extra arguments to supply to kube-proxy.
extraArgs:
proxy-mode: iptables
disabled
bool
Disable kube-proxy deployment on cluster bootstrap.
Examples:
disabled: false
image
string
The container image used in the kube-proxy manifest.
Examples:
image: k8s.gcr.io/kube-proxy:v1.21.0
mode
string
proxy mode of kube-proxy. The default is ‘iptables’.
extraArgs
map[string]string
Extra arguments to supply to kube-proxy.
SchedulerConfig
SchedulerConfig represents the kube scheduler configuration options.
Appears in:
ClusterConfig.scheduler
image: k8s.gcr.io/kube-scheduler:v1.21.0 # The container image used in the scheduler manifest.
# Extra arguments to supply to the scheduler.
extraArgs:
feature-gates: AllBeta=true
image
string
The container image used in the scheduler manifest.
Examples:
image: k8s.gcr.io/kube-scheduler:v1.21.0
extraArgs
map[string]string
Extra arguments to supply to the scheduler.
extraVolumes
[]VolumeMountConfig
Extra volumes to mount to the scheduler static pod.
EtcdConfig
EtcdConfig represents the etcd configuration options.
Appears in:
ClusterConfig.etcd
image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service.
# The `ca` is the root certificate authority of the PKI.
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# Extra arguments to supply to etcd.
extraArgs:
election-timeout: "5000"
image
string
The container image used to create the etcd service.
Examples:
image: gcr.io/etcd-development/etcd:v3.4.15
ca
PEMEncodedCertificateAndKey
The ca
is the root certificate authority of the PKI.
It is composed of a base64 encoded crt
and key
.
Examples:
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
extraArgs
map[string]string
Extra arguments to supply to etcd. Note that the following args are not allowed:
name
data-dir
initial-cluster-state
listen-peer-urls
listen-client-urls
cert-file
key-file
trusted-ca-file
peer-client-cert-auth
peer-cert-file
peer-trusted-ca-file
peer-key-file
ClusterNetworkConfig
ClusterNetworkConfig represents kube networking configuration options.
Appears in:
ClusterConfig.network
# The CNI used.
cni:
name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
cni
CNIConfig
The CNI used. Composed of “name” and “urls”. The “name” key supports the following options: “flannel”, “custom”, and “none”. “flannel” uses Talos-managed Flannel CNI, and that’s the default option. “custom” uses custom manifests that should be provided in “urls”. “none” indicates that Talos will not manage any CNI installation.
Examples:
cni:
name: custom # Name of CNI to use.
# URLs containing manifests to apply for the CNI.
urls:
- https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml
dnsDomain
string
The domain used by Kubernetes DNS.
The default is cluster.local
Examples:
dnsDomain: cluser.local
podSubnets
[]string
The pod subnet CIDR.
Examples:
podSubnets:
- 10.244.0.0/16
serviceSubnets
[]string
The service subnet CIDR.
Examples:
serviceSubnets:
- 10.96.0.0/12
CNIConfig
CNIConfig represents the CNI configuration options.
Appears in:
name: custom # Name of CNI to use.
# URLs containing manifests to apply for the CNI.
urls:
- https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml
name
string
Name of CNI to use.
Valid values:
flannel
custom
none
urls
[]string
URLs containing manifests to apply for the CNI. Should be present for “custom”, must be empty for “flannel” and “none”.
ExternalCloudProviderConfig
ExternalCloudProviderConfig contains external cloud provider configuration.
Appears in:
ClusterConfig.externalCloudProvider
enabled: true # Enable external cloud provider.
# A list of urls that point to additional manifests for an external cloud provider.
manifests:
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
enabled
bool
Enable external cloud provider.
Valid values:
true
yes
false
no
manifests
[]string
A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap.
Examples:
manifests:
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
AdminKubeconfigConfig
AdminKubeconfigConfig contains admin kubeconfig settings.
Appears in:
ClusterConfig.adminKubeconfig
certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
certLifetime
Duration
Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
MachineDisk
MachineDisk represents the options available for partitioning, formatting, and mounting extra disks.
Appears in:
MachineConfig.disks
- device: /dev/sdb # The name of the disk to use.
# A list of partitions to create on the disk.
partitions:
- mountpoint: /var/mnt/extra # Where to mount the partition.
# # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
# # Human readable representation.
# size: 100 MB
# # Precise value in bytes.
# size: 1073741824
device
string
The name of the disk to use.
partitions
[]DiskPartition
A list of partitions to create on the disk.
DiskPartition
DiskPartition represents the options for a disk partition.
Appears in:
MachineDisk.partitions
size
DiskSize
The size of partition: either bytes or human readable representation. If size:
is omitted, the partition is sized to occupy the full disk.
Examples:
size: 100 MB
size: 1073741824
mountpoint
string
Where to mount the partition.
EncryptionConfig
EncryptionConfig represents partition encryption settings.
Appears in:
SystemDiskEncryptionConfig.ephemeral
provider
string
Encryption provider to use for the encryption.
Examples:
provider: luks2
keys
[]EncryptionKey
Defines the encryption keys generation and storage method.
cipher
string
Cipher kind to use for the encryption. Depends on the encryption provider.
EncryptionKey
EncryptionKey represents configuration for disk encryption key.
Appears in:
EncryptionConfig.keys
static
EncryptionKeyStatic
Key which value is stored in the configuration file.
nodeID
EncryptionKeyNodeID
Deterministically generated key from the node UUID and PartitionLabel.
slot
int
Key slot number for luks2 encryption.
EncryptionKeyStatic
EncryptionKeyStatic represents throw away key type.
Appears in:
EncryptionKey.static
passphrase
string
Defines the static passphrase value.
EncryptionKeyNodeID
EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.
Appears in:
EncryptionKey.nodeID
MachineFile
MachineFile represents a file to write to disk.
Appears in:
MachineConfig.files
- content: '...' # The contents of the file.
permissions: 0o666 # The file's permissions in octal.
path: /tmp/file.txt # The path of the file.
op: append # The operation to use
content
string
The contents of the file.
permissions
FileMode
The file’s permissions in octal.
path
string
The path of the file.
op
string
The operation to use
Valid values:
create
append
overwrite
ExtraHost
ExtraHost represents a host entry in /etc/hosts.
Appears in:
NetworkConfig.extraHostEntries
- ip: 192.168.1.100 # The IP of the host.
# The host alias.
aliases:
- example
- example.domain.tld
ip
string
The IP of the host.
aliases
[]string
The host alias.
Device
Device represents a network interface.
Appears in:
NetworkConfig.interfaces
- interface: eth0 # The interface name.
cidr: 192.168.2.0/24 # Assigns a static IP address to the interface.
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network.
gateway: 192.168.2.1 # The route's gateway.
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.
# # Bond specific options.
# bond:
# # The interfaces that make up the bond.
# interfaces:
# - eth0
# - eth1
# mode: 802.3ad # A bond option.
# lacpRate: fast # A bond option.
# # Indicates if DHCP should be used to configure the interface.
# dhcp: true
# # DHCP specific options.
# dhcpOptions:
# routeMetric: 1024 # The priority of all routes received via DHCP.
# # Wireguard specific configuration.
# # wireguard server example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# listenPort: 51111 # Specifies a device's listening port.
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # wireguard peer example
# wireguard:
# privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # Specifies a list of peer configurations to apply to a device.
# peers:
# - publicKey: ABCDEF... # Specifies the public key of this peer.
# endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
# persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# allowedIPs:
# - 192.168.1.0/24
# # Virtual (shared) IP address configuration.
# vip:
# ip: 172.16.199.55 # Specifies the IP address to be used.
interface
string
The interface name.
Examples:
interface: eth0
cidr
string
Assigns a static IP address to the interface. This should be in proper CIDR notation.
Note: This option is mutually exclusive with DHCP option.
Examples:
cidr: 10.5.0.0/16
routes
[]Route
A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Examples:
routes:
- network: 0.0.0.0/0 # The route's network.
gateway: 10.5.0.1 # The route's gateway.
- network: 10.2.0.0/16 # The route's network.
gateway: 10.2.0.1 # The route's gateway.
bond
Bond
Bond specific options.
Examples:
bond:
# The interfaces that make up the bond.
interfaces:
- eth0
- eth1
mode: 802.3ad # A bond option.
lacpRate: fast # A bond option.
vlans
[]Vlan
VLAN specific options.
mtu
int
The interface’s MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
dhcp
bool
Indicates if DHCP should be used to configure the interface. The following DHCP options are supported:
OptionClasslessStaticRoute
OptionDomainNameServer
OptionDNSDomainSearchList
OptionHostName
Note: This option is mutually exclusive with CIDR.
Note: To configure an interface with only IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false in order for Talos to skip configuration of addresses. All other options will still apply.
Examples:
dhcp: true
ignore
bool
Indicates if the interface should be ignored (skips configuration).
dummy
bool
Indicates if the interface is a dummy interface.
dummy
is used to specify that this interface should be a virtual-only, dummy interface.
dhcpOptions
DHCPOptions
DHCP specific options.
dhcp
must be set to true for these to take effect.
Examples:
dhcpOptions:
routeMetric: 1024 # The priority of all routes received via DHCP.
wireguard
DeviceWireguardConfig
Wireguard specific configuration. Includes things like private key, listen port, peers.
Examples:
wireguard:
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
listenPort: 51111 # Specifies a device's listening port.
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
wireguard:
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
vip
DeviceVIPConfig
Virtual (shared) IP address configuration.
Examples:
vip:
ip: 172.16.199.55 # Specifies the IP address to be used.
DHCPOptions
DHCPOptions contains options for configuring the DHCP settings for a given interface.
Appears in:
Device.dhcpOptions
routeMetric: 1024 # The priority of all routes received via DHCP.
routeMetric
uint32
The priority of all routes received via DHCP.
ipv4
bool
Enables DHCPv4 protocol for the interface (default is enabled).
ipv6
bool
Enables DHCPv6 protocol for the interface (default is disabled).
DeviceWireguardConfig
DeviceWireguardConfig contains settings for configuring Wireguard network interface.
Appears in:
Device.wireguard
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
listenPort: 51111 # Specifies a device's listening port.
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
privateKey
string
Specifies a private key configuration (base64 encoded).
Can be generated by wg genkey
.
listenPort
int
Specifies a device’s listening port.
firewallMark
int
Specifies a device’s firewall mark.
peers
[]DeviceWireguardPeer
Specifies a list of peer configurations to apply to a device.
DeviceWireguardPeer
DeviceWireguardPeer a WireGuard device peer configuration.
Appears in:
DeviceWireguardConfig.peers
publicKey
string
Specifies the public key of this peer.
Can be extracted from private key by running wg pubkey < private.key > public.key && cat public.key
.
endpoint
string
Specifies the endpoint of this peer entry.
persistentKeepaliveInterval
Duration
Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
allowedIPs
[]string
AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
DeviceVIPConfig
DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.
Appears in:
Device.vip
ip: 172.16.199.55 # Specifies the IP address to be used.
ip
string
Specifies the IP address to be used.
Bond
Bond contains the various options for configuring a bonded interface.
Appears in:
Device.bond
# The interfaces that make up the bond.
interfaces:
- eth0
- eth1
mode: 802.3ad # A bond option.
lacpRate: fast # A bond option.
interfaces
[]string
The interfaces that make up the bond.
arpIPTarget
[]string
A bond option. Please see the official kernel documentation.
mode
string
A bond option. Please see the official kernel documentation.
xmitHashPolicy
string
A bond option. Please see the official kernel documentation.
lacpRate
string
A bond option. Please see the official kernel documentation.
adActorSystem
string
A bond option. Please see the official kernel documentation.
arpValidate
string
A bond option. Please see the official kernel documentation.
arpAllTargets
string
A bond option. Please see the official kernel documentation.
primary
string
A bond option. Please see the official kernel documentation.
primaryReselect
string
A bond option. Please see the official kernel documentation.
failOverMac
string
A bond option. Please see the official kernel documentation.
adSelect
string
A bond option. Please see the official kernel documentation.
miimon
uint32
A bond option. Please see the official kernel documentation.
updelay
uint32
A bond option. Please see the official kernel documentation.
downdelay
uint32
A bond option. Please see the official kernel documentation.
arpInterval
uint32
A bond option. Please see the official kernel documentation.
resendIgmp
uint32
A bond option. Please see the official kernel documentation.
minLinks
uint32
A bond option. Please see the official kernel documentation.
lpInterval
uint32
A bond option. Please see the official kernel documentation.
packetsPerSlave
uint32
A bond option. Please see the official kernel documentation.
numPeerNotif
uint8
A bond option. Please see the official kernel documentation.
tlbDynamicLb
uint8
A bond option. Please see the official kernel documentation.
allSlavesActive
uint8
A bond option. Please see the official kernel documentation.
useCarrier
bool
A bond option. Please see the official kernel documentation.
adActorSysPrio
uint16
A bond option. Please see the official kernel documentation.
adUserPortKey
uint16
A bond option. Please see the official kernel documentation.
peerNotifyDelay
uint32
A bond option. Please see the official kernel documentation.
Vlan
Vlan represents vlan settings for a device.
Appears in:
Device.vlans
cidr
string
The CIDR to use.
routes
[]Route
A list of routes associated with the VLAN.
dhcp
bool
Indicates if DHCP should be used.
vlanId
uint16
The VLAN’s ID.
Route
Route represents a network route.
Appears in:
- network: 0.0.0.0/0 # The route's network.
gateway: 10.5.0.1 # The route's gateway.
- network: 10.2.0.0/16 # The route's network.
gateway: 10.2.0.1 # The route's gateway.
network
string
The route’s network.
gateway
string
The route’s gateway.
metric
uint32
The optional metric for the route.
RegistryMirrorConfig
RegistryMirrorConfig represents mirror configuration for a registry.
Appears in:
RegistriesConfig.mirrors
ghcr.io:
# List of endpoints (URLs) for registry mirrors to use.
endpoints:
- https://registry.insecure
- https://ghcr.io/v2/
endpoints
[]string
List of endpoints (URLs) for registry mirrors to use.
Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to /v2
).
RegistryConfig
RegistryConfig specifies auth & TLS config per registry.
Appears in:
RegistriesConfig.config
registry.insecure:
# The TLS configuration for the registry.
tls:
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
# # Enable mutual TLS authentication with the registry.
# clientIdentity:
# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
# # The auth configuration for this registry.
# auth:
# username: username # Optional registry authentication.
# password: password # Optional registry authentication.
The TLS configuration for the registry.
Examples:
tls:
# Enable mutual TLS authentication with the registry.
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
tls:
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
# # Enable mutual TLS authentication with the registry.
# clientIdentity:
# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
auth
RegistryAuthConfig
The auth configuration for this registry.
Examples:
auth:
username: username # Optional registry authentication.
password: password # Optional registry authentication.
RegistryAuthConfig
RegistryAuthConfig specifies authentication configuration for a registry.
Appears in:
RegistryConfig.auth
username: username # Optional registry authentication.
password: password # Optional registry authentication.
username
string
Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
password
string
Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
auth
string
Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
identityToken
string
Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
RegistryTLSConfig
RegistryTLSConfig specifies TLS config for HTTPS registries.
Appears in:
RegistryConfig.tls
# Enable mutual TLS authentication with the registry.
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
# # Enable mutual TLS authentication with the registry.
# clientIdentity:
# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
clientIdentity
PEMEncodedCertificateAndKey
Enable mutual TLS authentication with the registry. Client certificate and key should be base64-encoded.
Examples:
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
ca
Base64Bytes
CA registry certificate to add the list of trusted certificates. Certificate should be base64-encoded.
insecureSkipVerify
bool
Skip TLS server certificate verification (not recommended).
SystemDiskEncryptionConfig
SystemDiskEncryptionConfig specifies system disk partitions encryption settings.
Appears in:
MachineConfig.systemDiskEncryption
# Ephemeral partition encryption.
ephemeral:
provider: luks2 # Encryption provider to use for the encryption.
# Defines the encryption keys generation and storage method.
keys:
- # Deterministically generated key from the node UUID and PartitionLabel.
nodeID: {}
slot: 0 # Key slot number for luks2 encryption.
state
EncryptionConfig
State partition encryption.
ephemeral
EncryptionConfig
Ephemeral partition encryption.
VolumeMountConfig
VolumeMountConfig struct describes extra volume mount for the static pods.
Appears in:
APIServerConfig.extraVolumes
ControllerManagerConfig.extraVolumes
SchedulerConfig.extraVolumes
hostPath
string
Path on the host.
Examples:
hostPath: /var/lib/auth
mountPath
string
Path in the container.
Examples:
mountPath: /etc/kubernetes/auth
readonly
bool
Mount the volume read only.
Examples:
readonly: true
ClusterInlineManifest
ClusterInlineManifest struct describes inline bootstrap manifests for the user.
name
string
Name of the manifest. Name should be unique.
Examples:
name: csi
contents
string
Manifest contents as a string.
Examples:
contents: /etc/kubernetes/auth