This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Configuration

Talos Linux machine configuration reference.

Talos Linux machine is fully configured via a single YAML file called machine configuration.

The file might contain one or more configuration documents separated by --- (three dashes) lines. At the moment, majority of the configuration options are within the v1alpha1 document, so this is the only mandatory document in the configuration file.

Configuration documents might be named (contain a name: field) or unnamed. Unnamed documents can be supplied to the machine configuration file only once, while named documents can be supplied multiple times with unique names.

The v1alpha1 document has its own (legacy) structure, while every other document has the following set of fields:

apiVersion: v1alpha1 # version of the document
kind: NetworkRuleConfig # type of document
name: rule1 # only for named documents

This section contains the configuration reference, to learn more about Talos Linux machine configuration management, please see:

1 - network

Package network provides network machine configuration documents.

1.1 - NetworkDefaultActionConfig

NetworkDefaultActionConfig is a ingress firewall default action configuration document.
apiVersion: v1alpha1
kind: NetworkDefaultActionConfig
ingress: accept # Default action for all not explicitly configured ingress traffic: accept or block.
FieldTypeDescriptionValue(s)
ingressDefaultActionDefault action for all not explicitly configured ingress traffic: accept or block.accept
block

1.2 - NetworkRuleConfig

NetworkRuleConfig is a network firewall rule config document.
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: ingress-apid # Name of the config document.
# Port selector defines which ports and protocols on the host are affected by the rule.
portSelector:
    # Ports defines a list of port ranges or single ports.
    ports:
        - 50000
    protocol: tcp # Protocol defines traffic protocol (e.g. TCP or UDP).
# Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`.
ingress:
    - subnet: 192.168.0.0/16 # Subnet defines a source subnet.
FieldTypeDescriptionValue(s)
namestringName of the config document.
portSelectorRulePortSelectorPort selector defines which ports and protocols on the host are affected by the rule.
ingress[]IngressRuleIngress defines which source subnets are allowed to access the host ports/protocols defined by the portSelector.

portSelector

RulePortSelector is a port selector for the network rule.

FieldTypeDescriptionValue(s)
portsPortRanges
Ports defines a list of port ranges or single ports.The port ranges are inclusive, and should not overlap.
Show example(s)
ports:
    - 80
    - 443
ports:
    - 1200-1299
    - 8080
protocolProtocolProtocol defines traffic protocol (e.g. TCP or UDP).tcp
udp
icmp
icmpv6

ingress[]

IngressRule is a ingress rule.

FieldTypeDescriptionValue(s)
subnetPrefixSubnet defines a source subnet.
Show example(s)
subnet: 10.3.4.0/24
subnet: 2001:db8::/32
subnet: 1.3.4.5/32
exceptPrefixExcept defines a source subnet to exclude from the rule, it gets excluded from the subnet.

2 - runtime

Package runtime provides runtime machine configuration documents.

2.1 - EventSinkConfig

EventSinkConfig is a event sink config document.
apiVersion: v1alpha1
kind: EventSinkConfig
endpoint: 192.168.10.3:3247 # The endpoint for the event sink as 'host:port'.
FieldTypeDescriptionValue(s)
endpointstringThe endpoint for the event sink as ‘host:port’.
Show example(s)
endpoint: 10.3.7.3:2810

2.2 - KmsgLogConfig

KmsgLogConfig is a event sink config document.
apiVersion: v1alpha1
kind: KmsgLogConfig
name: remote-log # Name of the config document.
url: tcp://192.168.3.7:3478/ # The URL encodes the log destination.
FieldTypeDescriptionValue(s)
namestringName of the config document.
urlURL
The URL encodes the log destination.The scheme must be tcp:// or udp://.
The path must be empty.
The port is required.
Show example(s)
url: udp://10.3.7.3:2810

3 - siderolink

Package siderolink provides SideroLink machine configuration documents.

3.1 - SideroLinkConfig

SideroLinkConfig is a SideroLink connection machine configuration document.
apiVersion: v1alpha1
kind: SideroLinkConfig
apiUrl: https://siderolink.api/join?token=secret # SideroLink API URL to connect to.
FieldTypeDescriptionValue(s)
apiUrlURLSideroLink API URL to connect to.
Show example(s)
apiUrl: https://siderolink.api/join?token=secret

4 - v1alpha1

Package v1alpha1 contains definition of the v1alpha1 configuration document.

Even though the machine configuration in Talos Linux is multi-document, at the moment this configuration document contains most of the configuration options.

It is expected that new configuration options will be added as new documents, and existing ones migrated to their own documents.

4.1 - Config

Config defines the v1alpha1.Config Talos machine configuration document.
version: v1alpha1
machine: # ...
cluster: # ...
FieldTypeDescriptionValue(s)
versionstringIndicates the schema used to decode the contents.v1alpha1
debugbool
Enable verbose logging to the console.All system containers logs will flow into serial console.

Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
true
yes
false
no
machineMachineConfigProvides machine specific configuration options.
clusterClusterConfigProvides cluster specific configuration options.

machine

MachineConfig represents the machine-specific config values.

machine:
    type: controlplane
    # InstallConfig represents the installation options for preparing a node.
    install:
        disk: /dev/sda # The disk used for installations.
        # Allows for supplying extra kernel args via the bootloader.
        extraKernelArgs:
            - console=ttyS1
            - panic=10
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

        # # Allows for supplying additional system extension images to install on top of base Talos image.
        # extensions:
        #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
FieldTypeDescriptionValue(s)
typestring
Defines the role of the machine within the cluster.
Control Plane

Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.

Worker

Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.

This node type was previously known as “join”; that value is still supported but deprecated.
controlplane
worker
tokenstring
The token is used by a machine to join the PKI of the cluster.Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.
Show example(s)
token: 328hom.uqjzh6jnn2eie9oi
caPEMEncodedCertificateAndKey
The root certificate authority of the PKI.It is composed of a base64 encoded crt and key.
Show example(s)
ca:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
certSANs[]string
Extra certificate subject alternative names for the machine’s certificate.By default, all non-loopback interface IPs are automatically added to the certificate’s SANs.
Show example(s)
certSANs:
    - 10.0.0.10
    - 172.16.0.10
    - 192.168.0.10
controlPlaneMachineControlPlaneConfigProvides machine specific control plane configuration options.
Show example(s)
controlPlane:
    # Controller manager machine specific configuration options.
    controllerManager:
        disabled: false # Disable kube-controller-manager on the node.
    # Scheduler machine specific configuration options.
    scheduler:
        disabled: true # Disable kube-scheduler on the node.
kubeletKubeletConfigUsed to provide additional options to the kubelet.
Show example(s)
kubelet:
    image: ghcr.io/siderolabs/kubelet:v1.29.0 # The `image` field is an optional reference to an alternative kubelet image.
    # The `extraArgs` field is used to provide additional flags to the kubelet.
    extraArgs:
        feature-gates: ServerSideApply=true

    # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
    # clusterDNS:
    #     - 10.96.0.10
    #     - 169.254.2.53

    # # The `extraMounts` field is used to add additional mounts to the kubelet container.
    # extraMounts:
    #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
    #       type: bind # Type specifies the mount kind.
    #       source: /var/lib/example # Source specifies the source path of the mount.
    #       # Options are fstab style mount options.
    #       options:
    #         - bind
    #         - rshared
    #         - rw

    # # The `extraConfig` field is used to provide kubelet configuration overrides.
    # extraConfig:
    #     serverTLSBootstrap: true

    # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
    # credentialProviderConfig:
    #     apiVersion: kubelet.config.k8s.io/v1
    #     kind: CredentialProviderConfig
    #     providers:
    #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
    #           defaultCacheDuration: 12h
    #           matchImages:
    #             - '*.dkr.ecr.*.amazonaws.com'
    #             - '*.dkr.ecr.*.amazonaws.com.cn'
    #             - '*.dkr.ecr-fips.*.amazonaws.com'
    #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
    #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
    #           name: ecr-credential-provider

    # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
    # nodeIP:
    #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
    #     validSubnets:
    #         - 10.0.0.0/8
    #         - '!10.0.0.3/32'
    #         - fdc7::/16
pods[]Unstructured
Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn’t validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.
Show example(s)
pods:
    - apiVersion: v1
      kind: pod
      metadata:
        name: nginx
      spec:
        containers:
            - image: nginx
              name: nginx
networkNetworkConfigProvides machine specific network configuration options.
Show example(s)
network:
    hostname: worker-1 # Used to statically set the hostname for the machine.
    # `interfaces` is used to define the network interface configuration.
    interfaces:
        - interface: enp0s1 # The interface name.
          # Assigns static IP addresses to the interface.
          addresses:
            - 192.168.2.0/24
          # A list of routes associated with the interface.
          routes:
            - network: 0.0.0.0/0 # The route's network (destination).
              gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
              metric: 1024 # The optional metric for the route.
          mtu: 1500 # The interface's MTU.

          # # Picks a network device using the selector.

          # # select a device with bus prefix 00:*.
          # deviceSelector:
          #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #     driver: virtio # Kernel driver, supports matching by wildcard.
          # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #       driver: virtio # Kernel driver, supports matching by wildcard.

          # # Bond specific options.
          # bond:
          #     # The interfaces that make up the bond.
          #     interfaces:
          #         - enp2s0
          #         - enp2s1
          #     # Picks a network device using the selector.
          #     deviceSelectors:
          #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #           driver: virtio # Kernel driver, supports matching by wildcard.
          #     mode: 802.3ad # A bond option.
          #     lacpRate: fast # A bond option.

          # # Bridge specific options.
          # bridge:
          #     # The interfaces that make up the bridge.
          #     interfaces:
          #         - enxda4042ca9a51
          #         - enxae2a6774c259
          #     # A bridge option.
          #     stp:
          #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

          # # Indicates if DHCP should be used to configure the interface.
          # dhcp: true

          # # DHCP specific options.
          # dhcpOptions:
          #     routeMetric: 1024 # The priority of all routes received via DHCP.

          # # Wireguard specific configuration.

          # # wireguard server example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     listenPort: 51111 # Specifies a device's listening port.
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24
          # # wireguard peer example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
          #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24

          # # Virtual (shared) IP address configuration.

          # # layer2 vip example
          # vip:
          #     ip: 172.16.199.55 # Specifies the IP address to be used.
    # Used to statically set the nameservers for the machine.
    nameservers:
        - 9.8.7.6
        - 8.7.6.5

    # # Allows for extra entries to be added to the `/etc/hosts` file
    # extraHostEntries:
    #     - ip: 192.168.1.100 # The IP of the host.
    #       # The host alias.
    #       aliases:
    #         - example
    #         - example.domain.tld

    # # Configures KubeSpan feature.
    # kubespan:
    #     enabled: true # Enable the KubeSpan feature.
disks[]MachineDisk
Used to partition, format and mount additional disks.Since the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.
Note that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.
If size: is omitted, the partition is sized to occupy the full disk.
Show example(s)
disks:
    - device: /dev/sdb # The name of the disk to use.
      # A list of partitions to create on the disk.
      partitions:
        - mountpoint: /var/mnt/extra # Where to mount the partition.

          # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

          # # Human readable representation.
          # size: 100 MB
          # # Precise value in bytes.
          # size: 1073741824
installInstallConfig
Used to provide instructions for installations.
Note that this configuration section gets silently ignored by Talos images that are considered pre-installed.
To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.
Show example(s)
install:
    disk: /dev/sda # The disk used for installations.
    # Allows for supplying extra kernel args via the bootloader.
    extraKernelArgs:
        - console=ttyS1
        - panic=10
    image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
    wipe: false # Indicates if the installation disk should be wiped at installation time.

    # # Look up disk using disk attributes like model, size, serial and others.
    # diskSelector:
    #     size: 4GB # Disk size.
    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

    # # Allows for supplying additional system extension images to install on top of base Talos image.
    # extensions:
    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
files[]MachineFile
Allows the addition of user specified files.The value of op can be create, overwrite, or append.
In the case of create, path must not exist.
In the case of overwrite, and append, path must be a valid file.
If an op value of append is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Show example(s)
files:
    - content: '...' # The contents of the file.
      permissions: 0o666 # The file's permissions in octal.
      path: /tmp/file.txt # The path of the file.
      op: append # The operation to use
envEnv
The env field allows for the addition of environment variables.All environment variables are set on PID 1 in addition to every service.
Show example(s)
env:
    GRPC_GO_LOG_SEVERITY_LEVEL: info
    GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
    https_proxy: http://SERVER:PORT/
env:
    GRPC_GO_LOG_SEVERITY_LEVEL: error
    https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
env:
    https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
GRPC_GO_LOG_VERBOSITY_LEVEL
GRPC_GO_LOG_SEVERITY_LEVEL
http_proxy
https_proxy
no_proxy
timeTimeConfigUsed to configure the machine’s time settings.
Show example(s)
time:
    disabled: false # Indicates if the time service is disabled for the machine.
    # Specifies time (NTP) servers to use for setting the system time.
    servers:
        - time.cloudflare.com
    bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
sysctlsmap[string]stringUsed to configure the machine’s sysctls.
Show example(s)
sysctls:
    kernel.domainname: talos.dev
    net.ipv4.ip_forward: "0"
    net/ipv6/conf/eth0.100/disable_ipv6: "1"
sysfsmap[string]stringUsed to configure the machine’s sysfs.
Show example(s)
sysfs:
    devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
registriesRegistriesConfig
Used to configure the machine’s container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.

The mirrors section allows to redirect requests for images to a non-default registry,
which might be a local registry or a caching mirror.

The config section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in .docker/config.json.

See also matching configuration for CRI containerd plugin.
Show example(s)
registries:
    # Specifies mirror configuration for each registry host namespace.
    mirrors:
        docker.io:
            # List of endpoints (URLs) for registry mirrors to use.
            endpoints:
                - https://registry.local
    # Specifies TLS & auth configuration for HTTPS image registries.
    config:
        registry.local:
            # The TLS configuration for the registry.
            tls:
                # Enable mutual TLS authentication with the registry.
                clientIdentity:
                    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
            # The auth configuration for this registry.
            auth:
                username: username # Optional registry authentication.
                password: password # Optional registry authentication.
systemDiskEncryptionSystemDiskEncryptionConfig
Machine system disk encryption configuration.Defines each system partition encryption parameters.
Show example(s)
systemDiskEncryption:
    # Ephemeral partition encryption.
    ephemeral:
        provider: luks2 # Encryption provider to use for the encryption.
        # Defines the encryption keys generation and storage method.
        keys:
            - # Deterministically generated key from the node UUID and PartitionLabel.
              nodeID: {}
              slot: 0 # Key slot number for LUKS2 encryption.

              # # KMS managed encryption key.
              # kms:
              #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

        # # Cipher kind to use for the encryption. Depends on the encryption provider.
        # cipher: aes-xts-plain64

        # # Defines the encryption sector size.
        # blockSize: 4096

        # # Additional --perf parameters for the LUKS2 encryption.
        # options:
        #     - no_read_workqueue
        #     - no_write_workqueue
featuresFeaturesConfigFeatures describe individual Talos features that can be switched on or off.
Show example(s)
features:
    rbac: true # Enable role-based access control (RBAC).

    # # Configure Talos API access from Kubernetes pods.
    # kubernetesTalosAPIAccess:
    #     enabled: true # Enable Talos API access from Kubernetes pods.
    #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
    #     allowedRoles:
    #         - os:reader
    #     # The list of Kubernetes namespaces Talos API access is available from.
    #     allowedKubernetesNamespaces:
    #         - kube-system
udevUdevConfigConfigures the udev system.
Show example(s)
udev:
    # List of udev rules to apply to the udev system
    rules:
        - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
loggingLoggingConfigConfigures the logging system.
Show example(s)
logging:
    # Logging destination.
    destinations:
        - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
          format: json_lines # Logs format.
kernelKernelConfigConfigures the kernel.
Show example(s)
kernel:
    # Kernel modules to load.
    modules:
        - name: brtfs # Module name.
seccompProfiles[]MachineSeccompProfileConfigures the seccomp profiles for the machine.
Show example(s)
seccompProfiles:
    - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
      # The `value` field is used to provide the seccomp profile.
      value:
        defaultAction: SCMP_ACT_LOG
nodeLabelsmap[string]string
Configures the node labels for the machine.
Note: In the default Kubernetes configuration, worker nodes are restricted to set
labels with some prefixes (see NodeRestriction admission plugin).
Show example(s)
nodeLabels:
    exampleLabel: exampleLabelValue
nodeTaintsmap[string]string
Configures the node taints for the machine. Effect is optional.
Note: In the default Kubernetes configuration, worker nodes are not allowed to
modify the taints (see NodeRestriction admission plugin).
Show example(s)
nodeTaints:
    exampleTaint: exampleTaintValue:NoSchedule

controlPlane

MachineControlPlaneConfig machine specific configuration options.

machine:
    controlPlane:
        # Controller manager machine specific configuration options.
        controllerManager:
            disabled: false # Disable kube-controller-manager on the node.
        # Scheduler machine specific configuration options.
        scheduler:
            disabled: true # Disable kube-scheduler on the node.
FieldTypeDescriptionValue(s)
controllerManagerMachineControllerManagerConfigController manager machine specific configuration options.
schedulerMachineSchedulerConfigScheduler machine specific configuration options.

controllerManager

MachineControllerManagerConfig represents the machine specific ControllerManager config values.

FieldTypeDescriptionValue(s)
disabledboolDisable kube-controller-manager on the node.

scheduler

MachineSchedulerConfig represents the machine specific Scheduler config values.

FieldTypeDescriptionValue(s)
disabledboolDisable kube-scheduler on the node.

kubelet

KubeletConfig represents the kubelet config values.

machine:
    kubelet:
        image: ghcr.io/siderolabs/kubelet:v1.29.0 # The `image` field is an optional reference to an alternative kubelet image.
        # The `extraArgs` field is used to provide additional flags to the kubelet.
        extraArgs:
            feature-gates: ServerSideApply=true

        # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
        # clusterDNS:
        #     - 10.96.0.10
        #     - 169.254.2.53

        # # The `extraMounts` field is used to add additional mounts to the kubelet container.
        # extraMounts:
        #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
        #       type: bind # Type specifies the mount kind.
        #       source: /var/lib/example # Source specifies the source path of the mount.
        #       # Options are fstab style mount options.
        #       options:
        #         - bind
        #         - rshared
        #         - rw

        # # The `extraConfig` field is used to provide kubelet configuration overrides.
        # extraConfig:
        #     serverTLSBootstrap: true

        # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
        # credentialProviderConfig:
        #     apiVersion: kubelet.config.k8s.io/v1
        #     kind: CredentialProviderConfig
        #     providers:
        #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
        #           defaultCacheDuration: 12h
        #           matchImages:
        #             - '*.dkr.ecr.*.amazonaws.com'
        #             - '*.dkr.ecr.*.amazonaws.com.cn'
        #             - '*.dkr.ecr-fips.*.amazonaws.com'
        #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
        #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
        #           name: ecr-credential-provider

        # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
        # nodeIP:
        #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
        #     validSubnets:
        #         - 10.0.0.0/8
        #         - '!10.0.0.3/32'
        #         - fdc7::/16
FieldTypeDescriptionValue(s)
imagestringThe image field is an optional reference to an alternative kubelet image.
Show example(s)
image: ghcr.io/siderolabs/kubelet:v1.29.0
clusterDNS[]stringThe ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.
Show example(s)
clusterDNS:
    - 10.96.0.10
    - 169.254.2.53
extraArgsmap[string]stringThe extraArgs field is used to provide additional flags to the kubelet.
Show example(s)
extraArgs:
    key: value
extraMounts[]ExtraMount
The extraMounts field is used to add additional mounts to the kubelet container.Note that either bind or rbind are required in the options.
Show example(s)
extraMounts:
    - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
      type: bind # Type specifies the mount kind.
      source: /var/lib/example # Source specifies the source path of the mount.
      # Options are fstab style mount options.
      options:
        - bind
        - rshared
        - rw
extraConfigUnstructured
The extraConfig field is used to provide kubelet configuration overrides.
Some fields are not allowed to be overridden: authentication and authorization, cgroups
configuration, ports, etc.
Show example(s)
extraConfig:
    serverTLSBootstrap: true
credentialProviderConfigUnstructuredThe KubeletCredentialProviderConfig field is used to provide kubelet credential configuration.
Show example(s)
credentialProviderConfig:
    apiVersion: kubelet.config.k8s.io/v1
    kind: CredentialProviderConfig
    providers:
        - apiVersion: credentialprovider.kubelet.k8s.io/v1
          defaultCacheDuration: 12h
          matchImages:
            - '*.dkr.ecr.*.amazonaws.com'
            - '*.dkr.ecr.*.amazonaws.com.cn'
            - '*.dkr.ecr-fips.*.amazonaws.com'
            - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
            - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
          name: ecr-credential-provider
defaultRuntimeSeccompProfileEnabledboolEnable container runtime default Seccomp profile.true
yes
false
no
registerWithFQDNbool
The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.This is required in clouds like AWS.
true
yes
false
no
nodeIPKubeletNodeIPConfig
The nodeIP field is used to configure --node-ip flag for the kubelet.This is used when a node has multiple addresses to choose from.
Show example(s)
nodeIP:
    # The `validSubnets` field configures the networks to pick kubelet node IP from.
    validSubnets:
        - 10.0.0.0/8
        - '!10.0.0.3/32'
        - fdc7::/16
skipNodeRegistrationbool
The skipNodeRegistration is used to run the kubelet without registering with the apiserver.This runs kubelet as standalone and only runs static pods.
true
yes
false
no
disableManifestsDirectorybool
The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.It’s recommended to configure static pods with the “pods” key instead.
true
yes
false
no

extraMounts[]

ExtraMount wraps OCI Mount specification.

machine:
    kubelet:
        extraMounts:
            - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
              type: bind # Type specifies the mount kind.
              source: /var/lib/example # Source specifies the source path of the mount.
              # Options are fstab style mount options.
              options:
                - bind
                - rshared
                - rw
FieldTypeDescriptionValue(s)
destinationstringDestination is the absolute path where the mount will be placed in the container.
typestringType specifies the mount kind.
sourcestringSource specifies the source path of the mount.
options[]stringOptions are fstab style mount options.
uidMappings[]LinuxIDMapping
UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.
gidMappings[]LinuxIDMapping
UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.
uidMappings[]

LinuxIDMapping represents the Linux ID mapping.

FieldTypeDescriptionValue(s)
containerIDuint32ContainerID is the starting UID/GID in the container.
hostIDuint32HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.
sizeuint32Size is the number of IDs to be mapped.
gidMappings[]

LinuxIDMapping represents the Linux ID mapping.

FieldTypeDescriptionValue(s)
containerIDuint32ContainerID is the starting UID/GID in the container.
hostIDuint32HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.
sizeuint32Size is the number of IDs to be mapped.

nodeIP

KubeletNodeIPConfig represents the kubelet node IP configuration.

machine:
    kubelet:
        nodeIP:
            # The `validSubnets` field configures the networks to pick kubelet node IP from.
            validSubnets:
                - 10.0.0.0/8
                - '!10.0.0.3/32'
                - fdc7::/16
FieldTypeDescriptionValue(s)
validSubnets[]string
The validSubnets field configures the networks to pick kubelet node IP from.For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

network

NetworkConfig represents the machine’s networking config values.

machine:
    network:
        hostname: worker-1 # Used to statically set the hostname for the machine.
        # `interfaces` is used to define the network interface configuration.
        interfaces:
            - interface: enp0s1 # The interface name.
              # Assigns static IP addresses to the interface.
              addresses:
                - 192.168.2.0/24
              # A list of routes associated with the interface.
              routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
                  metric: 1024 # The optional metric for the route.
              mtu: 1500 # The interface's MTU.

              # # Picks a network device using the selector.

              # # select a device with bus prefix 00:*.
              # deviceSelector:
              #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #     driver: virtio # Kernel driver, supports matching by wildcard.
              # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #       driver: virtio # Kernel driver, supports matching by wildcard.

              # # Bond specific options.
              # bond:
              #     # The interfaces that make up the bond.
              #     interfaces:
              #         - enp2s0
              #         - enp2s1
              #     # Picks a network device using the selector.
              #     deviceSelectors:
              #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #           driver: virtio # Kernel driver, supports matching by wildcard.
              #     mode: 802.3ad # A bond option.
              #     lacpRate: fast # A bond option.

              # # Bridge specific options.
              # bridge:
              #     # The interfaces that make up the bridge.
              #     interfaces:
              #         - enxda4042ca9a51
              #         - enxae2a6774c259
              #     # A bridge option.
              #     stp:
              #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

              # # Indicates if DHCP should be used to configure the interface.
              # dhcp: true

              # # DHCP specific options.
              # dhcpOptions:
              #     routeMetric: 1024 # The priority of all routes received via DHCP.

              # # Wireguard specific configuration.

              # # wireguard server example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     listenPort: 51111 # Specifies a device's listening port.
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24
              # # wireguard peer example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
              #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24

              # # Virtual (shared) IP address configuration.

              # # layer2 vip example
              # vip:
              #     ip: 172.16.199.55 # Specifies the IP address to be used.
        # Used to statically set the nameservers for the machine.
        nameservers:
            - 9.8.7.6
            - 8.7.6.5

        # # Allows for extra entries to be added to the `/etc/hosts` file
        # extraHostEntries:
        #     - ip: 192.168.1.100 # The IP of the host.
        #       # The host alias.
        #       aliases:
        #         - example
        #         - example.domain.tld

        # # Configures KubeSpan feature.
        # kubespan:
        #     enabled: true # Enable the KubeSpan feature.
FieldTypeDescriptionValue(s)
hostnamestringUsed to statically set the hostname for the machine.
interfaces[]Device
interfaces is used to define the network interface configuration.By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Show example(s)
interfaces:
    - interface: enp0s1 # The interface name.
      # Assigns static IP addresses to the interface.
      addresses:
        - 192.168.2.0/24
      # A list of routes associated with the interface.
      routes:
        - network: 0.0.0.0/0 # The route's network (destination).
          gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
          metric: 1024 # The optional metric for the route.
      mtu: 1500 # The interface's MTU.

      # # Picks a network device using the selector.

      # # select a device with bus prefix 00:*.
      # deviceSelector:
      #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
      # deviceSelector:
      #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #     driver: virtio # Kernel driver, supports matching by wildcard.
      # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
      # deviceSelector:
      #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #       driver: virtio # Kernel driver, supports matching by wildcard.

      # # Bond specific options.
      # bond:
      #     # The interfaces that make up the bond.
      #     interfaces:
      #         - enp2s0
      #         - enp2s1
      #     # Picks a network device using the selector.
      #     deviceSelectors:
      #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #           driver: virtio # Kernel driver, supports matching by wildcard.
      #     mode: 802.3ad # A bond option.
      #     lacpRate: fast # A bond option.

      # # Bridge specific options.
      # bridge:
      #     # The interfaces that make up the bridge.
      #     interfaces:
      #         - enxda4042ca9a51
      #         - enxae2a6774c259
      #     # A bridge option.
      #     stp:
      #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

      # # Indicates if DHCP should be used to configure the interface.
      # dhcp: true

      # # DHCP specific options.
      # dhcpOptions:
      #     routeMetric: 1024 # The priority of all routes received via DHCP.

      # # Wireguard specific configuration.

      # # wireguard server example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     listenPort: 51111 # Specifies a device's listening port.
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24
      # # wireguard peer example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
      #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24

      # # Virtual (shared) IP address configuration.

      # # layer2 vip example
      # vip:
      #     ip: 172.16.199.55 # Specifies the IP address to be used.
nameservers[]string
Used to statically set the nameservers for the machine.Defaults to 1.1.1.1 and 8.8.8.8
Show example(s)
nameservers:
    - 8.8.8.8
    - 1.1.1.1
extraHostEntries[]ExtraHostAllows for extra entries to be added to the /etc/hosts file
Show example(s)
extraHostEntries:
    - ip: 192.168.1.100 # The IP of the host.
      # The host alias.
      aliases:
        - example
        - example.domain.tld
kubespanNetworkKubeSpanConfigures KubeSpan feature.
Show example(s)
kubespan:
    enabled: true # Enable the KubeSpan feature.
disableSearchDomainbool
Disable generating a default search domain in /etc/resolv.confbased on the machine hostname.
Defaults to false.
true
yes
false
no

interfaces[]

Device represents a network interface.

machine:
    network:
        interfaces:
            - interface: enp0s1 # The interface name.
              # Assigns static IP addresses to the interface.
              addresses:
                - 192.168.2.0/24
              # A list of routes associated with the interface.
              routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
                  metric: 1024 # The optional metric for the route.
              mtu: 1500 # The interface's MTU.

              # # Picks a network device using the selector.

              # # select a device with bus prefix 00:*.
              # deviceSelector:
              #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #     driver: virtio # Kernel driver, supports matching by wildcard.
              # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
              # deviceSelector:
              #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #       driver: virtio # Kernel driver, supports matching by wildcard.

              # # Bond specific options.
              # bond:
              #     # The interfaces that make up the bond.
              #     interfaces:
              #         - enp2s0
              #         - enp2s1
              #     # Picks a network device using the selector.
              #     deviceSelectors:
              #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
              #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
              #           driver: virtio # Kernel driver, supports matching by wildcard.
              #     mode: 802.3ad # A bond option.
              #     lacpRate: fast # A bond option.

              # # Bridge specific options.
              # bridge:
              #     # The interfaces that make up the bridge.
              #     interfaces:
              #         - enxda4042ca9a51
              #         - enxae2a6774c259
              #     # A bridge option.
              #     stp:
              #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

              # # Indicates if DHCP should be used to configure the interface.
              # dhcp: true

              # # DHCP specific options.
              # dhcpOptions:
              #     routeMetric: 1024 # The priority of all routes received via DHCP.

              # # Wireguard specific configuration.

              # # wireguard server example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     listenPort: 51111 # Specifies a device's listening port.
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24
              # # wireguard peer example
              # wireguard:
              #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
              #     # Specifies a list of peer configurations to apply to a device.
              #     peers:
              #         - publicKey: ABCDEF... # Specifies the public key of this peer.
              #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
              #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
              #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
              #           allowedIPs:
              #             - 192.168.1.0/24

              # # Virtual (shared) IP address configuration.

              # # layer2 vip example
              # vip:
              #     ip: 172.16.199.55 # Specifies the IP address to be used.
FieldTypeDescriptionValue(s)
interfacestring
The interface name.Mutually exclusive with deviceSelector.
Show example(s)
interface: enp0s3
deviceSelectorNetworkDeviceSelector
Picks a network device using the selector.Mutually exclusive with interface.
Supports partial match using wildcard syntax.
Show example(s)
deviceSelector:
    busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
deviceSelector:
    hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
    driver: virtio # Kernel driver, supports matching by wildcard.
addresses[]string
Assigns static IP addresses to the interface.An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).
Show example(s)
addresses:
    - 10.5.0.0/16
    - 192.168.3.7
routes[]Route
A list of routes associated with the interface.If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Show example(s)
routes:
    - network: 0.0.0.0/0 # The route's network (destination).
      gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
    - network: 10.2.0.0/16 # The route's network (destination).
      gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
bondBondBond specific options.
Show example(s)
bond:
    # The interfaces that make up the bond.
    interfaces:
        - enp2s0
        - enp2s1
    mode: 802.3ad # A bond option.
    lacpRate: fast # A bond option.

    # # Picks a network device using the selector.

    # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
    # deviceSelectors:
    #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
    #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
    #       driver: virtio # Kernel driver, supports matching by wildcard.
bridgeBridgeBridge specific options.
Show example(s)
bridge:
    # The interfaces that make up the bridge.
    interfaces:
        - enxda4042ca9a51
        - enxae2a6774c259
    # A bridge option.
    stp:
        enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
vlans[]VlanVLAN specific options.
mtuint
The interface’s MTU.If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
dhcpbool
Indicates if DHCP should be used to configure the interface.The following DHCP options are supported:

- OptionClasslessStaticRoute
- OptionDomainNameServer
- OptionDNSDomainSearchList
- OptionHostName
Show example(s)
dhcp: true
ignoreboolIndicates if the interface should be ignored (skips configuration).
dummybool
Indicates if the interface is a dummy interface.dummy is used to specify that this interface should be a virtual-only, dummy interface.
dhcpOptionsDHCPOptions
DHCP specific options.dhcp must be set to true for these to take effect.
Show example(s)
dhcpOptions:
    routeMetric: 1024 # The priority of all routes received via DHCP.
wireguardDeviceWireguardConfig
Wireguard specific configuration.Includes things like private key, listen port, peers.
Show example(s)
wireguard:
    privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
    listenPort: 51111 # Specifies a device's listening port.
    # Specifies a list of peer configurations to apply to a device.
    peers:
        - publicKey: ABCDEF... # Specifies the public key of this peer.
          endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
          # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          allowedIPs:
            - 192.168.1.0/24
wireguard:
    privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
    # Specifies a list of peer configurations to apply to a device.
    peers:
        - publicKey: ABCDEF... # Specifies the public key of this peer.
          endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
          persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
          # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          allowedIPs:
            - 192.168.1.0/24
vipDeviceVIPConfigVirtual (shared) IP address configuration.
Show example(s)
vip:
    ip: 172.16.199.55 # Specifies the IP address to be used.
deviceSelector

NetworkDeviceSelector struct describes network device selector.

machine:
    network:
        interfaces:
            - deviceSelector:
                busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
machine:
    network:
        interfaces:
            - deviceSelector:
                hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
                driver: virtio # Kernel driver, supports matching by wildcard.
machine:
    network:
        interfaces:
            - deviceSelector:
                - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
                  driver: virtio # Kernel driver, supports matching by wildcard.
FieldTypeDescriptionValue(s)
busPathstringPCI, USB bus prefix, supports matching by wildcard.
hardwareAddrstringDevice hardware address, supports matching by wildcard.
pciIDstringPCI ID (vendor ID, product ID), supports matching by wildcard.
driverstringKernel driver, supports matching by wildcard.
routes[]

Route represents a network route.

machine:
    network:
        interfaces:
            - routes:
                - network: 0.0.0.0/0 # The route's network (destination).
                  gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
                - network: 10.2.0.0/16 # The route's network (destination).
                  gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
FieldTypeDescriptionValue(s)
networkstringThe route’s network (destination).
gatewaystringThe route’s gateway (if empty, creates link scope route).
sourcestringThe route’s source address (optional).
metricuint32The optional metric for the route.
mtuuint32The optional MTU for the route.
bond

Bond contains the various options for configuring a bonded interface.

machine:
    network:
        interfaces:
            - bond:
                # The interfaces that make up the bond.
                interfaces:
                    - enp2s0
                    - enp2s1
                mode: 802.3ad # A bond option.
                lacpRate: fast # A bond option.

                # # Picks a network device using the selector.

                # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
                # deviceSelectors:
                #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
                #       driver: virtio # Kernel driver, supports matching by wildcard.
FieldTypeDescriptionValue(s)
interfaces[]stringThe interfaces that make up the bond.
deviceSelectors[]NetworkDeviceSelector
Picks a network device using the selector.Mutually exclusive with interfaces.
Supports partial match using wildcard syntax.
Show example(s)
deviceSelectors:
    - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
    - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      driver: virtio # Kernel driver, supports matching by wildcard.
arpIPTarget[]string
A bond option.Please see the official kernel documentation.
Not supported at the moment.
modestring
A bond option.Please see the official kernel documentation.
xmitHashPolicystring
A bond option.Please see the official kernel documentation.
lacpRatestring
A bond option.Please see the official kernel documentation.
adActorSystemstring
A bond option.Please see the official kernel documentation.
Not supported at the moment.
arpValidatestring
A bond option.Please see the official kernel documentation.
arpAllTargetsstring
A bond option.Please see the official kernel documentation.
primarystring
A bond option.Please see the official kernel documentation.
primaryReselectstring
A bond option.Please see the official kernel documentation.
failOverMacstring
A bond option.Please see the official kernel documentation.
adSelectstring
A bond option.Please see the official kernel documentation.
miimonuint32
A bond option.Please see the official kernel documentation.
updelayuint32
A bond option.Please see the official kernel documentation.
downdelayuint32
A bond option.Please see the official kernel documentation.
arpIntervaluint32
A bond option.Please see the official kernel documentation.
resendIgmpuint32
A bond option.Please see the official kernel documentation.
minLinksuint32
A bond option.Please see the official kernel documentation.
lpIntervaluint32
A bond option.Please see the official kernel documentation.
packetsPerSlaveuint32
A bond option.Please see the official kernel documentation.
numPeerNotifuint8
A bond option.Please see the official kernel documentation.
tlbDynamicLbuint8
A bond option.Please see the official kernel documentation.
allSlavesActiveuint8
A bond option.Please see the official kernel documentation.
useCarrierbool
A bond option.Please see the official kernel documentation.
adActorSysPriouint16
A bond option.Please see the official kernel documentation.
adUserPortKeyuint16
A bond option.Please see the official kernel documentation.
peerNotifyDelayuint32
A bond option.Please see the official kernel documentation.
deviceSelectors[]

NetworkDeviceSelector struct describes network device selector.

machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
                    driver: virtio # Kernel driver, supports matching by wildcard.
machine:
    network:
        interfaces:
            - bond:
                deviceSelectors:
                    - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
                    - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
                      driver: virtio # Kernel driver, supports matching by wildcard.
FieldTypeDescriptionValue(s)
busPathstringPCI, USB bus prefix, supports matching by wildcard.
hardwareAddrstringDevice hardware address, supports matching by wildcard.
pciIDstringPCI ID (vendor ID, product ID), supports matching by wildcard.
driverstringKernel driver, supports matching by wildcard.
bridge

Bridge contains the various options for configuring a bridge interface.

machine:
    network:
        interfaces:
            - bridge:
                # The interfaces that make up the bridge.
                interfaces:
                    - enxda4042ca9a51
                    - enxae2a6774c259
                # A bridge option.
                stp:
                    enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
FieldTypeDescriptionValue(s)
interfaces[]stringThe interfaces that make up the bridge.
stpSTP
A bridge option.Please see the official kernel documentation.
stp

STP contains the various options for configuring the STP properties of a bridge interface.

FieldTypeDescriptionValue(s)
enabledboolWhether Spanning Tree Protocol (STP) is enabled.
vlans[]

Vlan represents vlan settings for a device.

FieldTypeDescriptionValue(s)
addresses[]stringThe addresses in CIDR notation or as plain IPs to use.
routes[]RouteA list of routes associated with the VLAN.
dhcpboolIndicates if DHCP should be used.
vlanIduint16The VLAN’s ID.
mtuuint32The VLAN’s MTU.
vipDeviceVIPConfigThe VLAN’s virtual IP address configuration.
dhcpOptionsDHCPOptions
DHCP specific options.dhcp must be set to true for these to take effect.
routes[]

Route represents a network route.

machine:
    network:
        interfaces:
            - vlans:
                - routes:
                    - network: 0.0.0.0/0 # The route's network (destination).
                      gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
                    - network: 10.2.0.0/16 # The route's network (destination).
                      gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
FieldTypeDescriptionValue(s)
networkstringThe route’s network (destination).
gatewaystringThe route’s gateway (if empty, creates link scope route).
sourcestringThe route’s source address (optional).
metricuint32The optional metric for the route.
mtuuint32The optional MTU for the route.
vip

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

machine:
    network:
        interfaces:
            - vlans:
                - vip:
                    ip: 172.16.199.55 # Specifies the IP address to be used.
FieldTypeDescriptionValue(s)
ipstringSpecifies the IP address to be used.
equinixMetalVIPEquinixMetalConfigSpecifies the Equinix Metal API settings to assign VIP to the node.
hcloudVIPHCloudConfigSpecifies the Hetzner Cloud API settings to assign VIP to the node.
equinixMetal

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

FieldTypeDescriptionValue(s)
apiTokenstringSpecifies the Equinix Metal API Token.
hcloud

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

FieldTypeDescriptionValue(s)
apiTokenstringSpecifies the Hetzner Cloud API Token.
dhcpOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

machine:
    network:
        interfaces:
            - vlans:
                - dhcpOptions:
                    routeMetric: 1024 # The priority of all routes received via DHCP.
FieldTypeDescriptionValue(s)
routeMetricuint32The priority of all routes received via DHCP.
ipv4boolEnables DHCPv4 protocol for the interface (default is enabled).
ipv6boolEnables DHCPv6 protocol for the interface (default is disabled).
duidv6stringSet client DUID (hex string).
dhcpOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

machine:
    network:
        interfaces:
            - dhcpOptions:
                routeMetric: 1024 # The priority of all routes received via DHCP.
FieldTypeDescriptionValue(s)
routeMetricuint32The priority of all routes received via DHCP.
ipv4boolEnables DHCPv4 protocol for the interface (default is enabled).
ipv6boolEnables DHCPv6 protocol for the interface (default is disabled).
duidv6stringSet client DUID (hex string).
wireguard

DeviceWireguardConfig contains settings for configuring Wireguard network interface.

machine:
    network:
        interfaces:
            - wireguard:
                privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
                listenPort: 51111 # Specifies a device's listening port.
                # Specifies a list of peer configurations to apply to a device.
                peers:
                    - publicKey: ABCDEF... # Specifies the public key of this peer.
                      endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
                      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
                      allowedIPs:
                        - 192.168.1.0/24
machine:
    network:
        interfaces:
            - wireguard:
                privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
                # Specifies a list of peer configurations to apply to a device.
                peers:
                    - publicKey: ABCDEF... # Specifies the public key of this peer.
                      endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
                      persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
                      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
                      allowedIPs:
                        - 192.168.1.0/24
FieldTypeDescriptionValue(s)
privateKeystring
Specifies a private key configuration (base64 encoded).Can be generated by wg genkey.
listenPortintSpecifies a device’s listening port.
firewallMarkintSpecifies a device’s firewall mark.
peers[]DeviceWireguardPeerSpecifies a list of peer configurations to apply to a device.
peers[]

DeviceWireguardPeer a WireGuard device peer configuration.

FieldTypeDescriptionValue(s)
publicKeystring
Specifies the public key of this peer.Can be extracted from private key by running wg pubkey < private.key > public.key && cat public.key.
endpointstringSpecifies the endpoint of this peer entry.
persistentKeepaliveIntervalDuration
Specifies the persistent keepalive interval for this peer.Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
allowedIPs[]stringAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
vip

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

machine:
    network:
        interfaces:
            - vip:
                ip: 172.16.199.55 # Specifies the IP address to be used.
FieldTypeDescriptionValue(s)
ipstringSpecifies the IP address to be used.
equinixMetalVIPEquinixMetalConfigSpecifies the Equinix Metal API settings to assign VIP to the node.
hcloudVIPHCloudConfigSpecifies the Hetzner Cloud API settings to assign VIP to the node.
equinixMetal

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

FieldTypeDescriptionValue(s)
apiTokenstringSpecifies the Equinix Metal API Token.
hcloud

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

FieldTypeDescriptionValue(s)
apiTokenstringSpecifies the Hetzner Cloud API Token.

extraHostEntries[]

ExtraHost represents a host entry in /etc/hosts.

machine:
    network:
        extraHostEntries:
            - ip: 192.168.1.100 # The IP of the host.
              # The host alias.
              aliases:
                - example
                - example.domain.tld
FieldTypeDescriptionValue(s)
ipstringThe IP of the host.
aliases[]stringThe host alias.

kubespan

NetworkKubeSpan struct describes KubeSpan configuration.

machine:
    network:
        kubespan:
            enabled: true # Enable the KubeSpan feature.
FieldTypeDescriptionValue(s)
enabledbool
Enable the KubeSpan feature.Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
advertiseKubernetesNetworksbool
Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,
and KubeSpan handles the node-to-node traffic.
If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.
When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which
is not always the case with CNIs not relying on Kubernetes for IPAM.
allowDownPeerBypassbool
Skip sending traffic via KubeSpan if the peer connection state is not up.This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can’t be established.
harvestExtraEndpointsbool
KubeSpan can collect and publish extra endpoints for each member of the clusterbased on Wireguard endpoint information for each peer.
This feature is enabled by default to help discover additional endpoints,
but with high number of peers (>50) in the KubeSpan network it can cause performance issues.
mtuuint32
KubeSpan link MTU size.Default value is 1420.
filtersKubeSpanFilters
KubeSpan advanced filtering of network addresses .
Settings in this section are optional, and settings apply only to the node.
filters

KubeSpanFilters struct describes KubeSpan advanced network addresses filtering.

FieldTypeDescriptionValue(s)
endpoints[]string
Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.

Default value: no filtering.
Show example(s)
endpoints:
    - 0.0.0.0/0
    - '!192.168.0.0/16'
    - ::/0

disks[]

MachineDisk represents the options available for partitioning, formatting, and mounting extra disks.

machine:
    disks:
        - device: /dev/sdb # The name of the disk to use.
          # A list of partitions to create on the disk.
          partitions:
            - mountpoint: /var/mnt/extra # Where to mount the partition.

              # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

              # # Human readable representation.
              # size: 100 MB
              # # Precise value in bytes.
              # size: 1073741824
FieldTypeDescriptionValue(s)
devicestringThe name of the disk to use.
partitions[]DiskPartitionA list of partitions to create on the disk.

partitions[]

DiskPartition represents the options for a disk partition.

FieldTypeDescriptionValue(s)
sizeDiskSizeThe size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.
Show example(s)
size: 100 MB
size: 1073741824
mountpointstringWhere to mount the partition.

install

InstallConfig represents the installation options for preparing a node.

machine:
    install:
        disk: /dev/sda # The disk used for installations.
        # Allows for supplying extra kernel args via the bootloader.
        extraKernelArgs:
            - console=ttyS1
            - panic=10
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

        # # Allows for supplying additional system extension images to install on top of base Talos image.
        # extensions:
        #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
FieldTypeDescriptionValue(s)
diskstringThe disk used for installations.
Show example(s)
disk: /dev/sda
disk: /dev/nvme0
diskSelectorInstallDiskSelector
Look up disk using disk attributes like model, size, serial and others.Always has priority over disk.
Show example(s)
diskSelector:
    size: '>= 1TB' # Disk size.
    model: WDC* # Disk model `/sys/block/<dev>/device/model`.

    # # Disk bus path.
    # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
    # busPath: /pci0000:00/*
extraKernelArgs[]string
Allows for supplying extra kernel args via the bootloader.Existing kernel args can be removed by prefixing the argument with a -.
For example -console removes all console=<value> arguments, whereas -console=tty0 removes the console=tty0 default argument.
Show example(s)
extraKernelArgs:
    - talos.platform=metal
    - reboot=k
imagestring
Allows for supplying the image used to perform the installation.Image reference for each Talos release can be found on
GitHub releases page.
Show example(s)
image: ghcr.io/siderolabs/installer:latest
extensions[]InstallExtensionConfigAllows for supplying additional system extension images to install on top of base Talos image.
Show example(s)
extensions:
    - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
wipebool
Indicates if the installation disk should be wiped at installation time.Defaults to true.
true
yes
false
no
legacyBIOSSupportbool
Indicates if MBR partition should be marked as bootable (active).Should be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.

diskSelector

InstallDiskSelector represents a disk query parameters for the install disk lookup.

machine:
    install:
        diskSelector:
            size: '>= 1TB' # Disk size.
            model: WDC* # Disk model `/sys/block/<dev>/device/model`.

            # # Disk bus path.
            # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
            # busPath: /pci0000:00/*
FieldTypeDescriptionValue(s)
sizeInstallDiskSizeMatcherDisk size.
Show example(s)
size: 4GB
size: '> 1TB'
size: <= 2TB
namestringDisk name /sys/block/<dev>/device/name.
modelstringDisk model /sys/block/<dev>/device/model.
serialstringDisk serial number /sys/block/<dev>/serial.
modaliasstringDisk modalias /sys/block/<dev>/device/modalias.
uuidstringDisk UUID /sys/block/<dev>/uuid.
wwidstringDisk WWID /sys/block/<dev>/wwid.
typeInstallDiskTypeDisk Type.ssd
hdd
nvme
sd
busPathstringDisk bus path.
Show example(s)
busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
busPath: /pci0000:00/*

extensions[]

InstallExtensionConfig represents a configuration for a system extension.

machine:
    install:
        extensions:
            - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
FieldTypeDescriptionValue(s)
imagestringSystem extension image.

files[]

MachineFile represents a file to write to disk.

machine:
    files:
        - content: '...' # The contents of the file.
          permissions: 0o666 # The file's permissions in octal.
          path: /tmp/file.txt # The path of the file.
          op: append # The operation to use
FieldTypeDescriptionValue(s)
contentstringThe contents of the file.
permissionsFileModeThe file’s permissions in octal.
pathstringThe path of the file.
opstringThe operation to usecreate
append
overwrite

time

TimeConfig represents the options for configuring time on a machine.

machine:
    time:
        disabled: false # Indicates if the time service is disabled for the machine.
        # Specifies time (NTP) servers to use for setting the system time.
        servers:
            - time.cloudflare.com
        bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
FieldTypeDescriptionValue(s)
disabledbool
Indicates if the time service is disabled for the machine.Defaults to false.
servers[]string
Specifies time (NTP) servers to use for setting the system time.Defaults to pool.ntp.org
bootTimeoutDuration
Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.NTP sync will be still running in the background.
Defaults to “infinity” (waiting forever for time sync)

registries

RegistriesConfig represents the image pull options.

machine:
    registries:
        # Specifies mirror configuration for each registry host namespace.
        mirrors:
            docker.io:
                # List of endpoints (URLs) for registry mirrors to use.
                endpoints:
                    - https://registry.local
        # Specifies TLS & auth configuration for HTTPS image registries.
        config:
            registry.local:
                # The TLS configuration for the registry.
                tls:
                    # Enable mutual TLS authentication with the registry.
                    clientIdentity:
                        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
                # The auth configuration for this registry.
                auth:
                    username: username # Optional registry authentication.
                    password: password # Optional registry authentication.
FieldTypeDescriptionValue(s)
mirrorsmap[string]RegistryMirrorConfig
Specifies mirror configuration for each registry host namespace.This setting allows to configure local pull-through caching registires,
air-gapped installations, etc.

For example, when pulling an image with the reference example.com:123/image:v1,
the example.com:123 key will be used to lookup the mirror configuration.

Optionally the * key can be used to configure a fallback mirror.

Registry name is the first segment of image identifier, with ‘docker.io’
being default one.
Show example(s)
mirrors:
    ghcr.io:
        # List of endpoints (URLs) for registry mirrors to use.
        endpoints:
            - https://registry.insecure
            - https://ghcr.io/v2/
configmap[string]RegistryConfig
Specifies TLS & auth configuration for HTTPS image registries.Mutual TLS can be enabled with ‘clientIdentity’ option.

The full hostname and port (if not using a default port 443)
should be used as the key.
The fallback key * can’t be used for TLS configuration.

TLS configuration can be skipped if registry has trusted
server certificate.
Show example(s)
config:
    registry.insecure:
        # The TLS configuration for the registry.
        tls:
            insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

            # # Enable mutual TLS authentication with the registry.
            # clientIdentity:
            #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

        # # The auth configuration for this registry.
        # auth:
        #     username: username # Optional registry authentication.
        #     password: password # Optional registry authentication.

mirrors.*

RegistryMirrorConfig represents mirror configuration for a registry.

machine:
    registries:
        mirrors:
            ghcr.io:
                # List of endpoints (URLs) for registry mirrors to use.
                endpoints:
                    - https://registry.insecure
                    - https://ghcr.io/v2/
FieldTypeDescriptionValue(s)
endpoints[]string
List of endpoints (URLs) for registry mirrors to use.Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to /v2).
overridePathbool
Use the exact path specified for the endpoint (don’t append /v2/).This setting is often required for setting up multiple mirrors
on a single instance of a registry.

config.*

RegistryConfig specifies auth & TLS config per registry.

machine:
    registries:
        config:
            registry.insecure:
                # The TLS configuration for the registry.
                tls:
                    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                    # # Enable mutual TLS authentication with the registry.
                    # clientIdentity:
                    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

                # # The auth configuration for this registry.
                # auth:
                #     username: username # Optional registry authentication.
                #     password: password # Optional registry authentication.
FieldTypeDescriptionValue(s)
tlsRegistryTLSConfigThe TLS configuration for the registry.
Show example(s)
tls:
    # Enable mutual TLS authentication with the registry.
    clientIdentity:
        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
tls:
    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

    # # Enable mutual TLS authentication with the registry.
    # clientIdentity:
    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
authRegistryAuthConfig
The auth configuration for this registry.Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.
Show example(s)
auth:
    username: username # Optional registry authentication.
    password: password # Optional registry authentication.
tls

RegistryTLSConfig specifies TLS config for HTTPS registries.

machine:
    registries:
        config:
            example.com:
                tls:
                    # Enable mutual TLS authentication with the registry.
                    clientIdentity:
                        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
machine:
    registries:
        config:
            example.com:
                tls:
                    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                    # # Enable mutual TLS authentication with the registry.
                    # clientIdentity:
                    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
FieldTypeDescriptionValue(s)
clientIdentityPEMEncodedCertificateAndKey
Enable mutual TLS authentication with the registry.Client certificate and key should be base64-encoded.
Show example(s)
clientIdentity:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
caBase64Bytes
CA registry certificate to add the list of trusted certificates.Certificate should be base64-encoded.
insecureSkipVerifyboolSkip TLS server certificate verification (not recommended).
auth

RegistryAuthConfig specifies authentication configuration for a registry.

machine:
    registries:
        config:
            example.com:
                auth:
                    username: username # Optional registry authentication.
                    password: password # Optional registry authentication.
FieldTypeDescriptionValue(s)
usernamestring
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
passwordstring
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
authstring
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
identityTokenstring
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.

systemDiskEncryption

SystemDiskEncryptionConfig specifies system disk partitions encryption settings.

machine:
    systemDiskEncryption:
        # Ephemeral partition encryption.
        ephemeral:
            provider: luks2 # Encryption provider to use for the encryption.
            # Defines the encryption keys generation and storage method.
            keys:
                - # Deterministically generated key from the node UUID and PartitionLabel.
                  nodeID: {}
                  slot: 0 # Key slot number for LUKS2 encryption.

                  # # KMS managed encryption key.
                  # kms:
                  #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

            # # Cipher kind to use for the encryption. Depends on the encryption provider.
            # cipher: aes-xts-plain64

            # # Defines the encryption sector size.
            # blockSize: 4096

            # # Additional --perf parameters for the LUKS2 encryption.
            # options:
            #     - no_read_workqueue
            #     - no_write_workqueue
FieldTypeDescriptionValue(s)
stateEncryptionConfigState partition encryption.
ephemeralEncryptionConfigEphemeral partition encryption.

state

EncryptionConfig represents partition encryption settings.

FieldTypeDescriptionValue(s)
providerstringEncryption provider to use for the encryption.
Show example(s)
provider: luks2
keys[]EncryptionKeyDefines the encryption keys generation and storage method.
cipherstringCipher kind to use for the encryption. Depends on the encryption provider.
Show example(s)
cipher: aes-xts-plain64
aes-xts-plain64
xchacha12,aes-adiantum-plain64
xchacha20,aes-adiantum-plain64
keySizeuintDefines the encryption key length.
blockSizeuint64Defines the encryption sector size.
Show example(s)
blockSize: 4096
options[]stringAdditional –perf parameters for the LUKS2 encryption.
Show example(s)
options:
    - no_read_workqueue
    - no_write_workqueue
no_read_workqueue
no_write_workqueue
same_cpu_crypt
keys[]

EncryptionKey represents configuration for disk encryption key.

FieldTypeDescriptionValue(s)
staticEncryptionKeyStaticKey which value is stored in the configuration file.
nodeIDEncryptionKeyNodeIDDeterministically generated key from the node UUID and PartitionLabel.
kmsEncryptionKeyKMSKMS managed encryption key.
Show example(s)
kms:
    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
slotintKey slot number for LUKS2 encryption.
tpmEncryptionKeyTPMEnable TPM based disk encryption.
static

EncryptionKeyStatic represents throw away key type.

FieldTypeDescriptionValue(s)
passphrasestringDefines the static passphrase value.
nodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

machine:
    systemDiskEncryption:
        state:
            keys:
                - kms:
                    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
FieldTypeDescriptionValue(s)
endpointstringKMS endpoint to Seal/Unseal the key.
tpm

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

ephemeral

EncryptionConfig represents partition encryption settings.

FieldTypeDescriptionValue(s)
providerstringEncryption provider to use for the encryption.
Show example(s)
provider: luks2
keys[]EncryptionKeyDefines the encryption keys generation and storage method.
cipherstringCipher kind to use for the encryption. Depends on the encryption provider.
Show example(s)
cipher: aes-xts-plain64
aes-xts-plain64
xchacha12,aes-adiantum-plain64
xchacha20,aes-adiantum-plain64
keySizeuintDefines the encryption key length.
blockSizeuint64Defines the encryption sector size.
Show example(s)
blockSize: 4096
options[]stringAdditional –perf parameters for the LUKS2 encryption.
Show example(s)
options:
    - no_read_workqueue
    - no_write_workqueue
no_read_workqueue
no_write_workqueue
same_cpu_crypt
keys[]

EncryptionKey represents configuration for disk encryption key.

FieldTypeDescriptionValue(s)
staticEncryptionKeyStaticKey which value is stored in the configuration file.
nodeIDEncryptionKeyNodeIDDeterministically generated key from the node UUID and PartitionLabel.
kmsEncryptionKeyKMSKMS managed encryption key.
Show example(s)
kms:
    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
slotintKey slot number for LUKS2 encryption.
tpmEncryptionKeyTPMEnable TPM based disk encryption.
static

EncryptionKeyStatic represents throw away key type.

FieldTypeDescriptionValue(s)
passphrasestringDefines the static passphrase value.
nodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

machine:
    systemDiskEncryption:
        ephemeral:
            keys:
                - kms:
                    endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
FieldTypeDescriptionValue(s)
endpointstringKMS endpoint to Seal/Unseal the key.
tpm

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

features

FeaturesConfig describes individual Talos features that can be switched on or off.

machine:
    features:
        rbac: true # Enable role-based access control (RBAC).

        # # Configure Talos API access from Kubernetes pods.
        # kubernetesTalosAPIAccess:
        #     enabled: true # Enable Talos API access from Kubernetes pods.
        #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
        #     allowedRoles:
        #         - os:reader
        #     # The list of Kubernetes namespaces Talos API access is available from.
        #     allowedKubernetesNamespaces:
        #         - kube-system
FieldTypeDescriptionValue(s)
rbacboolEnable role-based access control (RBAC).
stableHostnameboolEnable stable default hostname.
kubernetesTalosAPIAccessKubernetesTalosAPIAccessConfig
Configure Talos API access from Kubernetes pods.
This feature is disabled if the feature config is not specified.
Show example(s)
kubernetesTalosAPIAccess:
    enabled: true # Enable Talos API access from Kubernetes pods.
    # The list of Talos API roles which can be granted for access from Kubernetes pods.
    allowedRoles:
        - os:reader
    # The list of Kubernetes namespaces Talos API access is available from.
    allowedKubernetesNamespaces:
        - kube-system
apidCheckExtKeyUsageboolEnable checks for extended key usage of client certificates in apid.
diskQuotaSupportbool
Enable XFS project quota support for EPHEMERAL partition and user disks.Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.
kubePrismKubePrism
KubePrism - local proxy/load balancer on defined port that will distributerequests to all API servers in the cluster.

kubernetesTalosAPIAccess

KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods.

machine:
    features:
        kubernetesTalosAPIAccess:
            enabled: true # Enable Talos API access from Kubernetes pods.
            # The list of Talos API roles which can be granted for access from Kubernetes pods.
            allowedRoles:
                - os:reader
            # The list of Kubernetes namespaces Talos API access is available from.
            allowedKubernetesNamespaces:
                - kube-system
FieldTypeDescriptionValue(s)
enabledboolEnable Talos API access from Kubernetes pods.
allowedRoles[]string
The list of Talos API roles which can be granted for access from Kubernetes pods.
Empty list means that no roles can be granted, so access is blocked.
allowedKubernetesNamespaces[]stringThe list of Kubernetes namespaces Talos API access is available from.

kubePrism

KubePrism describes the configuration for the KubePrism load balancer.

FieldTypeDescriptionValue(s)
enabledboolEnable KubePrism support - will start local load balacing proxy.
portintKubePrism port.

udev

UdevConfig describes how the udev system should be configured.

machine:
    udev:
        # List of udev rules to apply to the udev system
        rules:
            - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
FieldTypeDescriptionValue(s)
rules[]stringList of udev rules to apply to the udev system

logging

LoggingConfig struct configures Talos logging.

machine:
    logging:
        # Logging destination.
        destinations:
            - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
              format: json_lines # Logs format.
FieldTypeDescriptionValue(s)
destinations[]LoggingDestinationLogging destination.

destinations[]

LoggingDestination struct configures Talos logging destination.

FieldTypeDescriptionValue(s)
endpointEndpointWhere to send logs. Supported protocols are “tcp” and “udp”.
Show example(s)
endpoint: udp://127.0.0.1:12345
endpoint: tcp://1.2.3.4:12345
formatstringLogs format.json_lines
endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

machine:
    logging:
        destinations:
            - endpoint: https://1.2.3.4:6443
machine:
    logging:
        destinations:
            - endpoint: https://cluster1.internal:6443
machine:
    logging:
        destinations:
            - endpoint: udp://127.0.0.1:12345
machine:
    logging:
        destinations:
            - endpoint: tcp://1.2.3.4:12345
FieldTypeDescriptionValue(s)

kernel

KernelConfig struct configures Talos Linux kernel.

machine:
    kernel:
        # Kernel modules to load.
        modules:
            - name: brtfs # Module name.
FieldTypeDescriptionValue(s)
modules[]KernelModuleConfigKernel modules to load.

modules[]

KernelModuleConfig struct configures Linux kernel modules to load.

FieldTypeDescriptionValue(s)
namestringModule name.
parameters[]stringModule parameters, changes applied after reboot.

seccompProfiles[]

MachineSeccompProfile defines seccomp profiles for the machine.

machine:
    seccompProfiles:
        - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
          # The `value` field is used to provide the seccomp profile.
          value:
            defaultAction: SCMP_ACT_LOG
FieldTypeDescriptionValue(s)
namestringThe name field is used to provide the file name of the seccomp profile.
valueUnstructuredThe value field is used to provide the seccomp profile.

cluster

ClusterConfig represents the cluster-wide config values.

cluster:
    # ControlPlaneConfig represents the control plane configuration options.
    controlPlane:
        endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
        localAPIServerPort: 443 # The port that the API server listens on internally.
    clusterName: talos.local
    # ClusterNetworkConfig represents kube networking configuration options.
    network:
        # The CNI used.
        cni:
            name: flannel # Name of CNI to use.
        dnsDomain: cluster.local # The domain used by Kubernetes DNS.
        # The pod subnet CIDR.
        podSubnets:
            - 10.244.0.0/16
        # The service subnet CIDR.
        serviceSubnets:
            - 10.96.0.0/12
FieldTypeDescriptionValue(s)
idstringGlobally unique identifier for this cluster (base64 encoded random 32 bytes).
secretstring
Shared secret of cluster (base64 encoded random 32 bytes).This secret is shared among cluster members but should never be sent over the network.
controlPlaneControlPlaneConfigProvides control plane specific configuration options.
Show example(s)
controlPlane:
    endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
    localAPIServerPort: 443 # The port that the API server listens on internally.
clusterNamestringConfigures the cluster’s name.
networkClusterNetworkConfigProvides cluster specific network configuration options.
Show example(s)
network:
    # The CNI used.
    cni:
        name: flannel # Name of CNI to use.
    dnsDomain: cluster.local # The domain used by Kubernetes DNS.
    # The pod subnet CIDR.
    podSubnets:
        - 10.244.0.0/16
    # The service subnet CIDR.
    serviceSubnets:
        - 10.96.0.0/12
tokenstringThe bootstrap token used to join the cluster.
Show example(s)
token: wlzjyw.bei2zfylhs2by0wd
aescbcEncryptionSecretstring
A key used for the encryption of secret data at rest.Enables encryption with AESCBC.
Show example(s)
aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
secretboxEncryptionSecretstring
A key used for the encryption of secret data at rest.Enables encryption with secretbox.
Secretbox has precedence over AESCBC.
Show example(s)
secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
caPEMEncodedCertificateAndKeyThe base64 encoded root certificate authority used by Kubernetes.
Show example(s)
ca:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
aggregatorCAPEMEncodedCertificateAndKey
The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.
Show example(s)
aggregatorCA:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
serviceAccountPEMEncodedKeyThe base64 encoded private key for service account token generation.
Show example(s)
serviceAccount:
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
apiServerAPIServerConfigAPI server specific configuration options.
Show example(s)
apiServer:
    image: registry.k8s.io/kube-apiserver:v1.29.0 # The container image used in the API server manifest.
    # Extra arguments to supply to the API server.
    extraArgs:
        feature-gates: ServerSideApply=true
        http2-max-streams-per-connection: "32"
    # Extra certificate subject alternative names for the API server's certificate.
    certSANs:
        - 1.2.3.4
        - 4.5.6.7

    # # Configure the API server admission plugins.
    # admissionControl:
    #     - name: PodSecurity # Name is the name of the admission controller.
    #       # Configuration is an embedded configuration object to be used as the plugin's
    #       configuration:
    #         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
    #         defaults:
    #             audit: restricted
    #             audit-version: latest
    #             enforce: baseline
    #             enforce-version: latest
    #             warn: restricted
    #             warn-version: latest
    #         exemptions:
    #             namespaces:
    #                 - kube-system
    #             runtimeClasses: []
    #             usernames: []
    #         kind: PodSecurityConfiguration

    # # Configure the API server audit policy.
    # auditPolicy:
    #     apiVersion: audit.k8s.io/v1
    #     kind: Policy
    #     rules:
    #         - level: Metadata
controllerManagerControllerManagerConfigController manager server specific configuration options.
Show example(s)
controllerManager:
    image: registry.k8s.io/kube-controller-manager:v1.29.0 # The container image used in the controller manager manifest.
    # Extra arguments to supply to the controller manager.
    extraArgs:
        feature-gates: ServerSideApply=true
proxyProxyConfigKube-proxy server-specific configuration options
Show example(s)
proxy:
    image: registry.k8s.io/kube-proxy:v1.29.0 # The container image used in the kube-proxy manifest.
    mode: ipvs # proxy mode of kube-proxy.
    # Extra arguments to supply to kube-proxy.
    extraArgs:
        proxy-mode: iptables

    # # Disable kube-proxy deployment on cluster bootstrap.
    # disabled: false
schedulerSchedulerConfigScheduler server specific configuration options.
Show example(s)
scheduler:
    image: registry.k8s.io/kube-scheduler:v1.29.0 # The container image used in the scheduler manifest.
    # Extra arguments to supply to the scheduler.
    extraArgs:
        feature-gates: AllBeta=true
discoveryClusterDiscoveryConfigConfigures cluster member discovery.
Show example(s)
discovery:
    enabled: true # Enable the cluster membership discovery feature.
    # Configure registries used for cluster member discovery.
    registries:
        # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
        kubernetes: {}
        # Service registry is using an external service to push and pull information about cluster members.
        service:
            endpoint: https://discovery.talos.dev/ # External service endpoint.
etcdEtcdConfigEtcd specific configuration options.
Show example(s)
etcd:
    image: gcr.io/etcd-development/etcd:v3.5.11 # The container image used to create the etcd service.
    # The `ca` is the root certificate authority of the PKI.
    ca:
        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
    # Extra arguments to supply to etcd.
    extraArgs:
        election-timeout: "5000"

    # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
    # advertisedSubnets:
    #     - 10.0.0.0/8
coreDNSCoreDNSCore DNS specific configuration options.
Show example(s)
coreDNS:
    image: registry.k8s.io/coredns/coredns:v1.11.1 # The `image` field is an override to the default coredns image.
externalCloudProviderExternalCloudProviderConfigExternal cloud provider configuration.
Show example(s)
externalCloudProvider:
    enabled: true # Enable external cloud provider.
    # A list of urls that point to additional manifests for an external cloud provider.
    manifests:
        - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
        - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
extraManifests[]string
A list of urls that point to additional manifests.These will get automatically deployed as part of the bootstrap.
Show example(s)
extraManifests:
    - https://www.example.com/manifest1.yaml
    - https://www.example.com/manifest2.yaml
extraManifestHeadersmap[string]stringA map of key value pairs that will be added while fetching the extraManifests.
Show example(s)
extraManifestHeaders:
    Token: "1234567"
    X-ExtraInfo: info
inlineManifests[]ClusterInlineManifest
A list of inline Kubernetes manifests.These will get automatically deployed as part of the bootstrap.
Show example(s)
inlineManifests:
    - name: namespace-ci # Name of the manifest.
      contents: |- # Manifest contents as a string.
        apiVersion: v1
        kind: Namespace
        metadata:
        	name: ci
adminKubeconfigAdminKubeconfigConfig
Settings for admin kubeconfig generation.Certificate lifetime can be configured.
Show example(s)
adminKubeconfig:
    certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
allowSchedulingOnControlPlanesboolAllows running workload on control-plane nodes.
Show example(s)
allowSchedulingOnControlPlanes: true
true
yes
false
no

controlPlane

ControlPlaneConfig represents the control plane configuration options.

cluster:
    controlPlane:
        endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
        localAPIServerPort: 443 # The port that the API server listens on internally.
FieldTypeDescriptionValue(s)
endpointEndpoint
Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.It is single-valued, and may optionally include a port number.
Show example(s)
endpoint: https://1.2.3.4:6443
endpoint: https://cluster1.internal:6443
localAPIServerPortint
The port that the API server listens on internally.This may be different than the port portion listed in the endpoint field above.
The default is 6443.

endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

cluster:
    controlPlane:
        endpoint: https://1.2.3.4:6443
cluster:
    controlPlane:
        endpoint: https://cluster1.internal:6443
cluster:
    controlPlane:
        endpoint: udp://127.0.0.1:12345
cluster:
    controlPlane:
        endpoint: tcp://1.2.3.4:12345
FieldTypeDescriptionValue(s)

network

ClusterNetworkConfig represents kube networking configuration options.

cluster:
    network:
        # The CNI used.
        cni:
            name: flannel # Name of CNI to use.
        dnsDomain: cluster.local # The domain used by Kubernetes DNS.
        # The pod subnet CIDR.
        podSubnets:
            - 10.244.0.0/16
        # The service subnet CIDR.
        serviceSubnets:
            - 10.96.0.0/12
FieldTypeDescriptionValue(s)
cniCNIConfig
The CNI used.Composed of “name” and “urls”.
The “name” key supports the following options: “flannel”, “custom”, and “none”.
“flannel” uses Talos-managed Flannel CNI, and that’s the default option.
“custom” uses custom manifests that should be provided in “urls”.
“none” indicates that Talos will not manage any CNI installation.
Show example(s)
cni:
    name: custom # Name of CNI to use.
    # URLs containing manifests to apply for the CNI.
    urls:
        - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
dnsDomainstring
The domain used by Kubernetes DNS.The default is cluster.local
Show example(s)
dnsDomain: cluser.local
podSubnets[]stringThe pod subnet CIDR.
Show example(s)
podSubnets:
    - 10.244.0.0/16
serviceSubnets[]stringThe service subnet CIDR.
Show example(s)
serviceSubnets:
    - 10.96.0.0/12

cni

CNIConfig represents the CNI configuration options.

cluster:
    network:
        cni:
            name: custom # Name of CNI to use.
            # URLs containing manifests to apply for the CNI.
            urls:
                - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
FieldTypeDescriptionValue(s)
namestringName of CNI to use.flannel
custom
none
urls[]string
URLs containing manifests to apply for the CNI.Should be present for “custom”, must be empty for “flannel” and “none”.
flannelFlannelCNIConfig
description:
Flannel configuration options.
flannel

FlannelCNIConfig represents the Flannel CNI configuration options.

FieldTypeDescriptionValue(s)
extraArgs[]stringExtra arguments for ‘flanneld’.
Show example(s)
extraArgs:
    - --iface-can-reach=192.168.1.1

apiServer

APIServerConfig represents the kube apiserver configuration options.

cluster:
    apiServer:
        image: registry.k8s.io/kube-apiserver:v1.29.0 # The container image used in the API server manifest.
        # Extra arguments to supply to the API server.
        extraArgs:
            feature-gates: ServerSideApply=true
            http2-max-streams-per-connection: "32"
        # Extra certificate subject alternative names for the API server's certificate.
        certSANs:
            - 1.2.3.4
            - 4.5.6.7

        # # Configure the API server admission plugins.
        # admissionControl:
        #     - name: PodSecurity # Name is the name of the admission controller.
        #       # Configuration is an embedded configuration object to be used as the plugin's
        #       configuration:
        #         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
        #         defaults:
        #             audit: restricted
        #             audit-version: latest
        #             enforce: baseline
        #             enforce-version: latest
        #             warn: restricted
        #             warn-version: latest
        #         exemptions:
        #             namespaces:
        #                 - kube-system
        #             runtimeClasses: []
        #             usernames: []
        #         kind: PodSecurityConfiguration

        # # Configure the API server audit policy.
        # auditPolicy:
        #     apiVersion: audit.k8s.io/v1
        #     kind: Policy
        #     rules:
        #         - level: Metadata
FieldTypeDescriptionValue(s)
imagestringThe container image used in the API server manifest.
Show example(s)
image: registry.k8s.io/kube-apiserver:v1.29.0
extraArgsmap[string]stringExtra arguments to supply to the API server.
extraVolumes[]VolumeMountConfigExtra volumes to mount to the API server static pod.
envEnvThe env field allows for the addition of environment variables for the control plane component.
certSANs[]stringExtra certificate subject alternative names for the API server’s certificate.
disablePodSecurityPolicyboolDisable PodSecurityPolicy in the API server and default manifests.
admissionControl[]AdmissionPluginConfigConfigure the API server admission plugins.
Show example(s)
admissionControl:
    - name: PodSecurity # Name is the name of the admission controller.
      # Configuration is an embedded configuration object to be used as the plugin's
      configuration:
        apiVersion: pod-security.admission.config.k8s.io/v1alpha1
        defaults:
            audit: restricted
            audit-version: latest
            enforce: baseline
            enforce-version: latest
            warn: restricted
            warn-version: latest
        exemptions:
            namespaces:
                - kube-system
            runtimeClasses: []
            usernames: []
        kind: PodSecurityConfiguration
auditPolicyUnstructuredConfigure the API server audit policy.
Show example(s)
auditPolicy:
    apiVersion: audit.k8s.io/v1
    kind: Policy
    rules:
        - level: Metadata
resourcesResourcesConfigConfigure the API server resources.

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

FieldTypeDescriptionValue(s)
hostPathstringPath on the host.
Show example(s)
hostPath: /var/lib/auth
mountPathstringPath in the container.
Show example(s)
mountPath: /etc/kubernetes/auth
readonlyboolMount the volume read only.
Show example(s)
readonly: true

admissionControl[]

AdmissionPluginConfig represents the API server admission plugin configuration.

cluster:
    apiServer:
        admissionControl:
            - name: PodSecurity # Name is the name of the admission controller.
              # Configuration is an embedded configuration object to be used as the plugin's
              configuration:
                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
                defaults:
                    audit: restricted
                    audit-version: latest
                    enforce: baseline
                    enforce-version: latest
                    warn: restricted
                    warn-version: latest
                exemptions:
                    namespaces:
                        - kube-system
                    runtimeClasses: []
                    usernames: []
                kind: PodSecurityConfiguration
FieldTypeDescriptionValue(s)
namestring
Name is the name of the admission controller.It must match the registered admission plugin name.
configurationUnstructured
Configuration is an embedded configuration object to be used as the plugin’sconfiguration.

resources

ResourcesConfig represents the pod resources.

FieldTypeDescriptionValue(s)
requestsUnstructuredRequests configures the reserved cpu/memory resources.
Show example(s)
requests:
    cpu: 1
    memory: 1Gi
limitsUnstructuredLimits configures the maximum cpu/memory resources a container can use.
Show example(s)
limits:
    cpu: 2
    memory: 2500Mi

controllerManager

ControllerManagerConfig represents the kube controller manager configuration options.

cluster:
    controllerManager:
        image: registry.k8s.io/kube-controller-manager:v1.29.0 # The container image used in the controller manager manifest.
        # Extra arguments to supply to the controller manager.
        extraArgs:
            feature-gates: ServerSideApply=true
FieldTypeDescriptionValue(s)
imagestringThe container image used in the controller manager manifest.
Show example(s)
image: registry.k8s.io/kube-controller-manager:v1.29.0
extraArgsmap[string]stringExtra arguments to supply to the controller manager.
extraVolumes[]VolumeMountConfigExtra volumes to mount to the controller manager static pod.
envEnvThe env field allows for the addition of environment variables for the control plane component.
resourcesResourcesConfigConfigure the controller manager resources.

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

FieldTypeDescriptionValue(s)
hostPathstringPath on the host.
Show example(s)
hostPath: /var/lib/auth
mountPathstringPath in the container.
Show example(s)
mountPath: /etc/kubernetes/auth
readonlyboolMount the volume read only.
Show example(s)
readonly: true

resources

ResourcesConfig represents the pod resources.

FieldTypeDescriptionValue(s)
requestsUnstructuredRequests configures the reserved cpu/memory resources.
Show example(s)
requests:
    cpu: 1
    memory: 1Gi
limitsUnstructuredLimits configures the maximum cpu/memory resources a container can use.
Show example(s)
limits:
    cpu: 2
    memory: 2500Mi

proxy

ProxyConfig represents the kube proxy configuration options.

cluster:
    proxy:
        image: registry.k8s.io/kube-proxy:v1.29.0 # The container image used in the kube-proxy manifest.
        mode: ipvs # proxy mode of kube-proxy.
        # Extra arguments to supply to kube-proxy.
        extraArgs:
            proxy-mode: iptables

        # # Disable kube-proxy deployment on cluster bootstrap.
        # disabled: false
FieldTypeDescriptionValue(s)
disabledboolDisable kube-proxy deployment on cluster bootstrap.
Show example(s)
disabled: false
imagestringThe container image used in the kube-proxy manifest.
Show example(s)
image: registry.k8s.io/kube-proxy:v1.29.0
modestring
proxy mode of kube-proxy.The default is ‘iptables’.
extraArgsmap[string]stringExtra arguments to supply to kube-proxy.

scheduler

SchedulerConfig represents the kube scheduler configuration options.

cluster:
    scheduler:
        image: registry.k8s.io/kube-scheduler:v1.29.0 # The container image used in the scheduler manifest.
        # Extra arguments to supply to the scheduler.
        extraArgs:
            feature-gates: AllBeta=true
FieldTypeDescriptionValue(s)
imagestringThe container image used in the scheduler manifest.
Show example(s)
image: registry.k8s.io/kube-scheduler:v1.29.0
extraArgsmap[string]stringExtra arguments to supply to the scheduler.
extraVolumes[]VolumeMountConfigExtra volumes to mount to the scheduler static pod.
envEnvThe env field allows for the addition of environment variables for the control plane component.
resourcesResourcesConfigConfigure the scheduler resources.
configUnstructuredSpecify custom kube-scheduler configuration.

extraVolumes[]

VolumeMountConfig struct describes extra volume mount for the static pods.

FieldTypeDescriptionValue(s)
hostPathstringPath on the host.
Show example(s)
hostPath: /var/lib/auth
mountPathstringPath in the container.
Show example(s)
mountPath: /etc/kubernetes/auth
readonlyboolMount the volume read only.
Show example(s)
readonly: true

resources

ResourcesConfig represents the pod resources.

FieldTypeDescriptionValue(s)
requestsUnstructuredRequests configures the reserved cpu/memory resources.
Show example(s)
requests:
    cpu: 1
    memory: 1Gi
limitsUnstructuredLimits configures the maximum cpu/memory resources a container can use.
Show example(s)
limits:
    cpu: 2
    memory: 2500Mi

discovery

ClusterDiscoveryConfig struct configures cluster membership discovery.

cluster:
    discovery:
        enabled: true # Enable the cluster membership discovery feature.
        # Configure registries used for cluster member discovery.
        registries:
            # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
            kubernetes: {}
            # Service registry is using an external service to push and pull information about cluster members.
            service:
                endpoint: https://discovery.talos.dev/ # External service endpoint.
FieldTypeDescriptionValue(s)
enabledbool
Enable the cluster membership discovery feature.Cluster discovery is based on individual registries which are configured under the registries field.
registriesDiscoveryRegistriesConfigConfigure registries used for cluster member discovery.

registries

DiscoveryRegistriesConfig struct configures cluster membership discovery.

FieldTypeDescriptionValue(s)
kubernetesRegistryKubernetesConfig
Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional informationas annotations on the Node resources.
serviceRegistryServiceConfigService registry is using an external service to push and pull information about cluster members.
kubernetes

RegistryKubernetesConfig struct configures Kubernetes discovery registry.

FieldTypeDescriptionValue(s)
disabledboolDisable Kubernetes discovery registry.
service

RegistryServiceConfig struct configures Kubernetes discovery registry.

FieldTypeDescriptionValue(s)
disabledboolDisable external service discovery registry.
endpointstringExternal service endpoint.
Show example(s)
endpoint: https://discovery.talos.dev/

etcd

EtcdConfig represents the etcd configuration options.

cluster:
    etcd:
        image: gcr.io/etcd-development/etcd:v3.5.11 # The container image used to create the etcd service.
        # The `ca` is the root certificate authority of the PKI.
        ca:
            crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
        # Extra arguments to supply to etcd.
        extraArgs:
            election-timeout: "5000"

        # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
        # advertisedSubnets:
        #     - 10.0.0.0/8
FieldTypeDescriptionValue(s)
imagestringThe container image used to create the etcd service.
Show example(s)
image: gcr.io/etcd-development/etcd:v3.5.11
caPEMEncodedCertificateAndKey
The ca is the root certificate authority of the PKI.It is composed of a base64 encoded crt and key.
Show example(s)
ca:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
extraArgsmap[string]string
Extra arguments to supply to etcd.Note that the following args are not allowed:

- name
- data-dir
- initial-cluster-state
- listen-peer-urls
- listen-client-urls
- cert-file
- key-file
- trusted-ca-file
- peer-client-cert-auth
- peer-cert-file
- peer-trusted-ca-file
- peer-key-file
advertisedSubnets[]string
The advertisedSubnets field configures the networks to pick etcd advertised IP from.
IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
Show example(s)
advertisedSubnets:
    - 10.0.0.0/8
listenSubnets[]string
The listenSubnets field configures the networks for the etcd to listen for peer and client connections.
If listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to
advertisedSubnets.

If neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.

IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.

coreDNS

CoreDNS represents the CoreDNS config values.

cluster:
    coreDNS:
        image: registry.k8s.io/coredns/coredns:v1.11.1 # The `image` field is an override to the default coredns image.
FieldTypeDescriptionValue(s)
disabledboolDisable coredns deployment on cluster bootstrap.
imagestringThe image field is an override to the default coredns image.

externalCloudProvider

ExternalCloudProviderConfig contains external cloud provider configuration.

cluster:
    externalCloudProvider:
        enabled: true # Enable external cloud provider.
        # A list of urls that point to additional manifests for an external cloud provider.
        manifests:
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
            - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
FieldTypeDescriptionValue(s)
enabledboolEnable external cloud provider.true
yes
false
no
manifests[]string
A list of urls that point to additional manifests for an external cloud provider.These will get automatically deployed as part of the bootstrap.
Show example(s)
manifests:
    - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
    - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

inlineManifests[]

ClusterInlineManifest struct describes inline bootstrap manifests for the user.

cluster:
    inlineManifests:
        - name: namespace-ci # Name of the manifest.
          contents: |- # Manifest contents as a string.
            apiVersion: v1
            kind: Namespace
            metadata:
            	name: ci
FieldTypeDescriptionValue(s)
namestring
Name of the manifest.Name should be unique.
Show example(s)
name: csi
contentsstringManifest contents as a string.
Show example(s)
contents: /etc/kubernetes/auth

adminKubeconfig

AdminKubeconfigConfig contains admin kubeconfig settings.

cluster:
    adminKubeconfig:
        certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
FieldTypeDescriptionValue(s)
certLifetimeDuration
Admin kubeconfig certificate lifetime (default is 1 year).Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).