Bump kubernetes to v1.24.0

Ref: https://github.com/siderolabs/kubelet/pull/45

Also update coredns [manifests](https://github.com/coredns/deployment/blob/master/kubernetes/coredns.yaml.sed)

Signed-off-by: Noel Georgi <git@frezbo.dev>

2022-05-05 00:34:35 +05:30

106 KiB

Raw Blame History

title	desription
Configuration	Talos node configuration file reference.

Package v1alpha1 configuration file contains all the options available for configuring a machine.

To generate a set of basic configuration files, run:

talosctl gen config --version v1alpha1 <cluster name> <cluster endpoint>

This will generate a machine config for each node type, and a talosconfig for the CLI.

Config

Config defines the v1alpha1 configuration file.

{{< highlight yaml >}} version: v1alpha1 persist: true machine: # ... cluster: # ... {{< /highlight >}}

Field	Type	Description	Value(s)
`version`	string	Indicates the schema used to decode the contents.	`v1alpha1`
`debug`	bool	Enable verbose logging to the console. All system containers logs will flow into serial console. Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.	`true` `yes` `false` `no`
`persist`	bool	Indicates whether to pull the machine config upon every boot.	`true` `yes` `false` `no`
`machine`	MachineConfig	Provides machine specific configuration options.
`cluster`	ClusterConfig	Provides cluster specific configuration options.

MachineConfig

MachineConfig represents the machine-specific config values.

Appears in:

Config.machine

{{< highlight yaml >}} type: controlplane

InstallConfig represents the installation options for preparing a node.

install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time.

# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
#     size: 4GB # Disk size.
#     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
#     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# # Allows for supplying additional system extension images to install on top of base Talos image.
# extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0

Field	Type	Description	Value(s)
`type`	string	Defines the role of the machine within the cluster. Control Plane Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. Worker Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as "join"; that value is still supported but deprecated.	`controlplane` `worker`
`token`	string	The `token` is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. Show example(s) {{< highlight yaml >}}
token: 328hom.uqjzh6jnn2eie9oi
{{< /highlight >}}
`ca`	PEMEncodedCertificateAndKey	The root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) {{< highlight yaml >}}
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`certSANs`	[]string	Extra certificate subject alternative names for the machine's certificate. By default, all non-loopback interface IPs are automatically added to the certificate's SANs. Show example(s) {{< highlight yaml >}}
certSANs:
- 10.0.0.10
- 172.16.0.10
- 192.168.0.10
{{< /highlight >}}
`controlPlane`	MachineControlPlaneConfig	Provides machine specific control plane configuration options. Show example(s) {{< highlight yaml >}}
controlPlane:
# Controller manager machine specific configuration options.
controllerManager:
disabled: false # Disable kube-controller-manager on the node.
# Scheduler machine specific configuration options.
scheduler:
disabled: true # Disable kube-scheduler on the node.
{{< /highlight >}}
`kubelet`	KubeletConfig	Used to provide additional options to the kubelet. Show example(s) {{< highlight yaml >}}
kubelet:
image: ghcr.io/siderolabs/kubelet:v1.24.0 # The `image` field is an optional reference to an alternative kubelet image.
# The `extraArgs` field is used to provide additional flags to the kubelet.
extraArgs:
feature-gates: ServerSideApply=true

# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
#     - 10.96.0.10
#     - 169.254.2.53

# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
#     - destination: /var/lib/example
#       type: bind
#       source: /var/lib/example
#       options:
#         - bind
#         - rshared
#         - rw

# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
#     serverTLSBootstrap: true

# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
#     # The `validSubnets` field configures the networks to pick kubelet node IP from.
#     validSubnets:
#         - 10.0.0.0/8
#         - '!10.0.0.3/32'
#         - fdc7::/16

{{< /highlight >}} | | |pods |[]Unstructured |

Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.

Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.

Show example(s)

{{< highlight yaml >}} pods: - apiVersion: v1 kind: pod metadata: name: nginx spec: containers: - image: nginx name: nginx {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} network: hostname: worker-1 # Used to statically set the hostname for the machine. # interfaces is used to define the network interface configuration. interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.

      # # Bond specific options.
      # bond:
      #     # The interfaces that make up the bond.
      #     interfaces:
      #         - eth0
      #         - eth1
      #     mode: 802.3ad # A bond option.
      #     lacpRate: fast # A bond option.

      # # Indicates if DHCP should be used to configure the interface.
      # dhcp: true

      # # DHCP specific options.
      # dhcpOptions:
      #     routeMetric: 1024 # The priority of all routes received via DHCP.

      # # Wireguard specific configuration.

      # # wireguard server example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     listenPort: 51111 # Specifies a device's listening port.
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24
      # # wireguard peer example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
      #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24

      # # Virtual (shared) IP address configuration.
      # vip:
      #     ip: 172.16.199.55 # Specifies the IP address to be used.
# Used to statically set the nameservers for the machine.
nameservers:
    - 9.8.7.6
    - 8.7.6.5

# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
#     - ip: 192.168.1.100 # The IP of the host.
#       # The host alias.
#       aliases:
#         - example
#         - example.domain.tld

# # Configures KubeSpan feature.
# kubespan:
#     enabled: true # Enable the KubeSpan feature.

Used to partition, format and mount additional disks.

Since the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.
Note that the partitioning and formating is done only once, if and only if no existing partitions are found.
If size: is omitted, the partition is sized to occupy the full disk.

Show example(s)

{{< highlight yaml >}} disks: - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition.

      # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

      # # Human readable representation.
      # size: 100 MB
      # # Precise value in bytes.
      # size: 1073741824

Show example(s)

{{< highlight yaml >}} install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time.

# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
#     size: 4GB # Disk size.
#     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
#     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# # Allows for supplying additional system extension images to install on top of base Talos image.
# extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0

Allows the addition of user specified files.

The value of op can be create, overwrite, or append.
In the case of create, path must not exist.
In the case of overwrite, and append, path must be a valid file.
If an op value of append is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.

Show example(s)

{{< highlight yaml >}} files: - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use {{< /highlight >}}

| | |env |Env |

The env field allows for the addition of environment variables.

All environment variables are set on PID 1 in addition to every service.

Show example(s)

{{< highlight yaml >}} env: GRPC_GO_LOG_SEVERITY_LEVEL: info GRPC_GO_LOG_VERBOSITY_LEVEL: "99" https_proxy: http://SERVER:PORT/ {{< /highlight >}}{{< highlight yaml >}} env: GRPC_GO_LOG_SEVERITY_LEVEL: error https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ {{< /highlight >}}{{< highlight yaml >}} env: https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} time: disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} sysctls: kernel.domainname: talos.dev net.ipv4.ip_forward: "0" {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} sysfs: devices.system.cpu.cpu0.cpufreq.scaling_governor: performance {{< /highlight >}}

Used to configure the machine's container image registry mirrors.

Automatically generates matching CRI configuration for registry mirrors.

The mirrors section allows to redirect requests for images to non-default registry,
which might be local registry or caching mirror.

The config section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in .docker/config.json.

See also matching configuration for CRI containerd plugin.

Show example(s)

{{< highlight yaml >}} registries: # Specifies mirror configuration for each registry. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

Machine system disk encryption configuration.

Defines each system partition encryption parameters.

Show example(s)

{{< highlight yaml >}} systemDiskEncryption: # Ephemeral partition encryption. ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption.

    # # Cipher kind to use for the encryption. Depends on the encryption provider.
    # cipher: aes-xts-plain64

    # # Defines the encryption sector size.
    # blockSize: 4096

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue

Show example(s)

{{< highlight yaml >}} features: rbac: true # Enable role-based access control (RBAC). {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} udev: # List of udev rules to apply to the udev system rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} kernel: # Kernel modules to load. modules: - name: brtfs # Module name. {{< /highlight >}}

| |

ClusterConfig

ClusterConfig represents the cluster-wide config values.

Appears in:

Config.cluster

ControlPlaneConfig represents the control plane configuration options.

controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. clusterName: talos.local

ClusterNetworkConfig represents kube networking configuration options.

network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}

Field	Type	Description
`id`	string	Globally unique identifier for this cluster (base64 encoded random 32 bytes).
`secret`	string	Shared secret of cluster (base64 encoded random 32 bytes). This secret is shared among cluster members but should never be sent over the network.
`controlPlane`	ControlPlaneConfig	Provides control plane specific configuration options. Show example(s) {{< highlight yaml >}}
controlPlane:
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.
{{< /highlight >}}
`clusterName`	string	Configures the cluster's name.
`network`	ClusterNetworkConfig	Provides cluster specific network configuration options. Show example(s) {{< highlight yaml >}}
network:
# The CNI used.
cni:
name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
{{< /highlight >}}
`token`	string	The bootstrap token used to join the cluster. Show example(s) {{< highlight yaml >}}
token: wlzjyw.bei2zfylhs2by0wd
{{< /highlight >}}
`aescbcEncryptionSecret`	string	The key used for the encryption of secret data at rest. Show example(s) {{< highlight yaml >}}
aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
{{< /highlight >}}
`ca`	PEMEncodedCertificateAndKey	The base64 encoded root certificate authority used by Kubernetes. Show example(s) {{< highlight yaml >}}
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`aggregatorCA`	PEMEncodedCertificateAndKey	The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. This CA can be self-signed. Show example(s) {{< highlight yaml >}}
aggregatorCA:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`serviceAccount`	PEMEncodedKey	The base64 encoded private key for service account token generation. Show example(s) {{< highlight yaml >}}
serviceAccount:
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`apiServer`	APIServerConfig	API server specific configuration options. Show example(s) {{< highlight yaml >}}
apiServer:
image: k8s.gcr.io/kube-apiserver:v1.24.0 # The container image used in the API server manifest.
# Extra arguments to supply to the API server.
extraArgs:
feature-gates: ServerSideApply=true
http2-max-streams-per-connection: "32"
# Extra certificate subject alternative names for the API server's certificate.
certSANs:
- 1.2.3.4
- 4.5.6.7

# # Configure the API server admission plugins.
# admissionControl:
#     - name: PodSecurity # Name is the name of the admission controller.
#       # Configuration is an embedded configuration object to be used as the plugin's
#       configuration:
#         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
#         defaults:
#             audit: restricted
#             audit-version: latest
#             enforce: baseline
#             enforce-version: latest
#             warn: restricted
#             warn-version: latest
#         exemptions:
#             namespaces:
#                 - kube-system
#             runtimeClasses: []
#             usernames: []
#         kind: PodSecurityConfiguration

{{< /highlight >}} | | |controllerManager |ControllerManagerConfig |Controller manager server specific configuration options.

Show example(s)

{{< highlight yaml >}} controllerManager: image: k8s.gcr.io/kube-controller-manager:v1.24.0 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} proxy: image: k8s.gcr.io/kube-proxy:v1.24.0 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} scheduler: image: k8s.gcr.io/kube-scheduler:v1.24.0 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint. {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} etcd: image: gcr.io/etcd-development/etcd:v3.5.4 # The container image used to create the etcd service. # The ca is the root certificate authority of the PKI. ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000"

# # The subnet from which the advertise URL should be.
# subnet: 10.0.0.0/8

Show example(s)

{{< highlight yaml >}} coreDNS: image: docker.io/coredns/coredns:1.9.1 # The image field is an override to the default coredns image. {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}

A list of urls that point to additional manifests.

These will get automatically deployed as part of the bootstrap.

Show example(s)

{{< highlight yaml >}} extraManifests: - https://www.example.com/manifest1.yaml - https://www.example.com/manifest2.yaml {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} extraManifestHeaders: Token: "1234567" X-ExtraInfo: info {{< /highlight >}}

A list of inline Kubernetes manifests.

These will get automatically deployed as part of the bootstrap.

Show example(s)

{{< highlight yaml >}} inlineManifests: - name: namespace-ci # Name of the manifest. contents: |- # Manifest contents as a string. apiVersion: v1 kind: Namespace metadata: name: ci {{< /highlight >}}

Settings for admin kubeconfig generation.

Certificate lifetime can be configured.

Show example(s)

{{< highlight yaml >}} adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}

ExtraMount

ExtraMount wraps OCI Mount specification.

Appears in:

KubeletConfig.extraMounts

destination: /var/lib/example type: bind source: /var/lib/example options:
- bind
- rshared
- rw {{< /highlight >}}

MachineControlPlaneConfig

MachineControlPlaneConfig machine specific configuration options.

Appears in:

MachineConfig.controlPlane

Controller manager machine specific configuration options.

controllerManager: disabled: false # Disable kube-controller-manager on the node.

Scheduler machine specific configuration options.

scheduler: disabled: true # Disable kube-scheduler on the node. {{< /highlight >}}

Field	Type	Description	Value(s)
`controllerManager`	MachineControllerManagerConfig	Controller manager machine specific configuration options.
`scheduler`	MachineSchedulerConfig	Scheduler machine specific configuration options.

MachineControllerManagerConfig

MachineControllerManagerConfig represents the machine specific ControllerManager config values.

Appears in:

MachineControlPlaneConfig.controllerManager

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-controller-manager on the node.

MachineSchedulerConfig

MachineSchedulerConfig represents the machine specific Scheduler config values.

Appears in:

MachineControlPlaneConfig.scheduler

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-scheduler on the node.

KubeletConfig

KubeletConfig represents the kubelet config values.

Appears in:

MachineConfig.kubelet

{{< highlight yaml >}} image: ghcr.io/siderolabs/kubelet:v1.24.0 # The image field is an optional reference to an alternative kubelet image.

The `extraArgs` field is used to provide additional flags to the kubelet.

extraArgs: feature-gates: ServerSideApply=true

# The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.

clusterDNS:

- 10.96.0.10

- 169.254.2.53

# The `extraMounts` field is used to add additional mounts to the kubelet container.

extraMounts:

- destination: /var/lib/example

type: bind

source: /var/lib/example

options:

- bind

- rshared

- rw

# The `extraConfig` field is used to provide kubelet configuration overrides.

extraConfig:

serverTLSBootstrap: true

# The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.

nodeIP:

# The `validSubnets` field configures the networks to pick kubelet node IP from.

validSubnets:

- 10.0.0.0/8

- '!10.0.0.3/32'

- fdc7::/16

Field	Type	Description	Value(s)
`image`	string	The `image` field is an optional reference to an alternative kubelet image. Show example(s) {{< highlight yaml >}}
image: ghcr.io/siderolabs/kubelet:v1.24.0
{{< /highlight >}}
`clusterDNS`	[]string	The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. Show example(s) {{< highlight yaml >}}
clusterDNS:
- 10.96.0.10
- 169.254.2.53
{{< /highlight >}}
`extraArgs`	map[string]string	The `extraArgs` field is used to provide additional flags to the kubelet. Show example(s) {{< highlight yaml >}}
extraArgs:
key: value
{{< /highlight >}}
`extraMounts`	[]ExtraMount	The `extraMounts` field is used to add additional mounts to the kubelet container. Note that either `bind` or `rbind` are required in the `options`. Show example(s) {{< highlight yaml >}}
extraMounts:
- destination: /var/lib/example
type: bind
source: /var/lib/example
options:
- bind
- rshared
- rw
{{< /highlight >}}
`extraConfig`	Unstructured	The `extraConfig` field is used to provide kubelet configuration overrides. Some fields are not allowed to be overridden: authentication and authorization, cgroups configuration, ports, etc. Show example(s) {{< highlight yaml >}}
extraConfig:
serverTLSBootstrap: true
{{< /highlight >}}
`registerWithFQDN`	bool	The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. This is required in clouds like AWS.	`true` `yes` `false` `no`
`nodeIP`	KubeletNodeIPConfig	The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. This is used when a node has multiple addresses to choose from. Show example(s) {{< highlight yaml >}}
nodeIP:
# The `validSubnets` field configures the networks to pick kubelet node IP from.
validSubnets:
- 10.0.0.0/8
- '!10.0.0.3/32'
- fdc7::/16
{{< /highlight >}}

KubeletNodeIPConfig

KubeletNodeIPConfig represents the kubelet node IP configuration.

Appears in:

KubeletConfig.nodeIP

The `validSubnets` field configures the networks to pick kubelet node IP from.

validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16 {{< /highlight >}}

Field	Type	Description	Value(s)
`validSubnets`	[]string	The `validSubnets` field configures the networks to pick kubelet node IP from. For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

NetworkConfig

NetworkConfig represents the machine's networking config values.

Appears in:

MachineConfig.network

{{< highlight yaml >}} hostname: worker-1 # Used to statically set the hostname for the machine.

`interfaces` is used to define the network interface configuration.

interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.

  # # Bond specific options.
  # bond:
  #     # The interfaces that make up the bond.
  #     interfaces:
  #         - eth0
  #         - eth1
  #     mode: 802.3ad # A bond option.
  #     lacpRate: fast # A bond option.

  # # Indicates if DHCP should be used to configure the interface.
  # dhcp: true

  # # DHCP specific options.
  # dhcpOptions:
  #     routeMetric: 1024 # The priority of all routes received via DHCP.

  # # Wireguard specific configuration.

  # # wireguard server example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     listenPort: 51111 # Specifies a device's listening port.
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24
  # # wireguard peer example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
  #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24

  # # Virtual (shared) IP address configuration.
  # vip:
  #     ip: 172.16.199.55 # Specifies the IP address to be used.

Used to statically set the nameservers for the machine.

nameservers: - 9.8.7.6 - 8.7.6.5

# Allows for extra entries to be added to the `/etc/hosts` file

extraHostEntries:

- ip: 192.168.1.100 # The IP of the host.

# The host alias.

aliases:

- example

- example.domain.tld

# Configures KubeSpan feature.

kubespan:

enabled: true # Enable the KubeSpan feature.

Field	Type	Description
`hostname`	string	Used to statically set the hostname for the machine.
`interfaces`	[]Device	`interfaces` is used to define the network interface configuration. By default all network interfaces will attempt a DHCP discovery. This can be further tuned through this configuration parameter. Show example(s) {{< highlight yaml >}}
interfaces:
- interface: eth0 # The interface name.
# Assigns static IP addresses to the interface.
addresses:
- 192.168.2.0/24
# A list of routes associated with the interface.
routes:
- network: 0.0.0.0/0 # The route's network (destination).
gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
metric: 1024 # The optional metric for the route.
mtu: 1500 # The interface's MTU.

  # # Bond specific options.
  # bond:
  #     # The interfaces that make up the bond.
  #     interfaces:
  #         - eth0
  #         - eth1
  #     mode: 802.3ad # A bond option.
  #     lacpRate: fast # A bond option.

  # # Indicates if DHCP should be used to configure the interface.
  # dhcp: true

  # # DHCP specific options.
  # dhcpOptions:
  #     routeMetric: 1024 # The priority of all routes received via DHCP.

  # # Wireguard specific configuration.

  # # wireguard server example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     listenPort: 51111 # Specifies a device's listening port.
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24
  # # wireguard peer example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
  #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24

  # # Virtual (shared) IP address configuration.
  # vip:
  #     ip: 172.16.199.55 # Specifies the IP address to be used.

{{< /highlight >}} | | |nameservers |[]string |

Used to statically set the nameservers for the machine.

Defaults to 1.1.1.1 and 8.8.8.8

Show example(s)

{{< highlight yaml >}} nameservers: - 8.8.8.8 - 1.1.1.1 {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} extraHostEntries: - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld {{< /highlight >}}

Show example(s)

{{< highlight yaml >}} kubespan: enabled: true # Enable the KubeSpan feature. {{< /highlight >}}

| |

InstallConfig

InstallConfig represents the installation options for preparing a node.

Appears in:

MachineConfig.install

{{< highlight yaml >}} disk: /dev/sda # The disk used for installations.

Allows for supplying extra kernel args via the bootloader.

extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time.

# Look up disk using disk attributes like model, size, serial and others.

diskSelector:

size: 4GB # Disk size.

model: WDC* # Disk model `/sys/block/<dev>/device/model`.

busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# Allows for supplying additional system extension images to install on top of base Talos image.

extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0

Field	Type	Description	Value(s)
`disk`	string	The disk used for installations. Show example(s) {{< highlight yaml >}}
disk: /dev/sda
{{< /highlight >}}{{< highlight yaml >}}
disk: /dev/nvme0
{{< /highlight >}}
`diskSelector`	InstallDiskSelector	Look up disk using disk attributes like model, size, serial and others. Always has priority over `disk`. Show example(s) {{< highlight yaml >}}
diskSelector:
size: 4GB # Disk size.
model: WDC* # Disk model `/sys/block/<dev>/device/model`.
busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
{{< /highlight >}}
`extraKernelArgs`	[]string	Allows for supplying extra kernel args via the bootloader. Show example(s) {{< highlight yaml >}}
extraKernelArgs:
- talos.platform=metal
- reboot=k
{{< /highlight >}}
`image`	string	Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on GitHub releases page. Show example(s) {{< highlight yaml >}}
image: ghcr.io/siderolabs/installer:latest
{{< /highlight >}}
`extensions`	[]InstallExtensionConfig	Allows for supplying additional system extension images to install on top of base Talos image. Show example(s) {{< highlight yaml >}}
extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0
{{< /highlight >}}
`bootloader`	bool	Indicates if a bootloader should be installed.	`true` `yes` `false` `no`
`wipe`	bool	Indicates if the installation disk should be wiped at installation time. Defaults to `true`.	`true` `yes` `false` `no`
`legacyBIOSSupport`	bool	Indicates if MBR partition should be marked as bootable (active). Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.

InstallDiskSelector

InstallDiskSelector represents a disk query parameters for the install disk lookup.

Appears in:

InstallConfig.diskSelector

{{< highlight yaml >}} size: 4GB # Disk size. model: WDC* # Disk model /sys/block/<dev>/device/model. busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. {{< /highlight >}}

Field	Type	Description	Value(s)
`size`	InstallDiskSizeMatcher	Disk size. Show example(s) {{< highlight yaml >}}
size: 4GB
{{< /highlight >}}{{< highlight yaml >}}
size: '> 1TB'
{{< /highlight >}}{{< highlight yaml >}}
size: <= 2TB
{{< /highlight >}}
`name`	string	Disk name `/sys/block/<dev>/device/name`.
`model`	string	Disk model `/sys/block/<dev>/device/model`.
`serial`	string	Disk serial number `/sys/block/<dev>/serial`.
`modalias`	string	Disk modalias `/sys/block/<dev>/device/modalias`.
`uuid`	string	Disk UUID `/sys/block/<dev>/uuid`.
`wwid`	string	Disk WWID `/sys/block/<dev>/wwid`.
`type`	InstallDiskType	Disk Type.	`ssd` `hdd` `nvme` `sd`
`busPath`	string	Disk bus path. Show example(s) {{< highlight yaml >}}
busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
{{< /highlight >}}{{< highlight yaml >}}
busPath: /pci0000:00/*
{{< /highlight >}}

InstallExtensionConfig

InstallExtensionConfig represents a configuration for a system extension.

Appears in:

InstallConfig.extensions

{{< highlight yaml >}} ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 {{< /highlight >}}

Field	Type	Description	Value(s)
`image`	string	System extension image.

TimeConfig

TimeConfig represents the options for configuring time on a machine.

Appears in:

MachineConfig.time

{{< highlight yaml >}} disabled: false # Indicates if the time service is disabled for the machine.

Specifies time (NTP) servers to use for setting the system time.

servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. {{< /highlight >}}

Field	Type	Description
`disabled`	bool	Indicates if the time service is disabled for the machine. Defaults to `false`.
`servers`	[]string	Specifies time (NTP) servers to use for setting the system time. Defaults to `pool.ntp.org`
`bootTimeout`	Duration	Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. NTP sync will be still running in the background. Defaults to "infinity" (waiting forever for time sync)

RegistriesConfig

RegistriesConfig represents the image pull options.

Appears in:

MachineConfig.registries

Specifies mirror configuration for each registry.

mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local

Specifies TLS & auth configuration for HTTPS image registries.

config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

Field	Type	Description
`mirrors`	map[string]RegistryMirrorConfig	Specifies mirror configuration for each registry. This setting allows to use local pull-through caching registires, air-gapped installations, etc. Registry name is the first segment of image identifier, with 'docker.io' being default one. Show example(s) {{< highlight yaml >}}
mirrors:
ghcr.io:
# List of endpoints (URLs) for registry mirrors to use.
endpoints:
- https://registry.insecure
- https://ghcr.io/v2/
{{< /highlight >}}
`config`	map[string]RegistryConfig	Specifies TLS & auth configuration for HTTPS image registries. Mutual TLS can be enabled with 'clientIdentity' option. TLS configuration can be skipped if registry has trusted server certificate. Show example(s) {{< highlight yaml >}}
config:
registry.insecure:
# The TLS configuration for the registry.
tls:
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

        # # Enable mutual TLS authentication with the registry.
        # clientIdentity:
        #     crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
        #     key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u

    # # The auth configuration for this registry.
    # auth:
    #     username: username # Optional registry authentication.
    #     password: password # Optional registry authentication.

{{< /highlight >}} | |

PodCheckpointer

PodCheckpointer represents the pod-checkpointer config values.

Field	Type	Description	Value(s)
`image`	string	The `image` field is an override to the default pod-checkpointer image.

CoreDNS

CoreDNS represents the CoreDNS config values.

Appears in:

ClusterConfig.coreDNS

{{< highlight yaml >}} image: docker.io/coredns/coredns:1.9.1 # The image field is an override to the default coredns image. {{< /highlight >}}

Field	Type	Description	Value(s)
`disabled`	bool	Disable coredns deployment on cluster bootstrap.
`image`	string	The `image` field is an override to the default coredns image.

Endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

Appears in:

ControlPlaneConfig.endpoint
LoggingDestination.endpoint

{{< highlight yaml >}} https://1.2.3.4:6443 {{< /highlight >}}

{{< highlight yaml >}} https://cluster1.internal:6443 {{< /highlight >}}

{{< highlight yaml >}} udp://127.0.0.1:12345 {{< /highlight >}}

{{< highlight yaml >}} tcp://1.2.3.4:12345 {{< /highlight >}}

ControlPlaneConfig

ControlPlaneConfig represents the control plane configuration options.

Appears in:

ClusterConfig.controlPlane

{{< highlight yaml >}} endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. {{< /highlight >}}

Field	Type	Description
`endpoint`	Endpoint	Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number. Show example(s) {{< highlight yaml >}}
endpoint: https://1.2.3.4:6443
{{< /highlight >}}{{< highlight yaml >}}
endpoint: https://cluster1.internal:6443
{{< /highlight >}}
`localAPIServerPort`	int	The port that the API server listens on internally. This may be different than the port portion listed in the endpoint field above. The default is `6443`.

APIServerConfig

APIServerConfig represents the kube apiserver configuration options.

Appears in:

ClusterConfig.apiServer

{{< highlight yaml >}} image: k8s.gcr.io/kube-apiserver:v1.24.0 # The container image used in the API server manifest.

Extra arguments to supply to the API server.

extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32"

Extra certificate subject alternative names for the API server's certificate.

certSANs: - 1.2.3.4 - 4.5.6.7

# Configure the API server admission plugins.

admissionControl:

- name: PodSecurity # Name is the name of the admission controller.

# Configuration is an embedded configuration object to be used as the plugin's

configuration:

apiVersion: pod-security.admission.config.k8s.io/v1alpha1

defaults:

audit: restricted

audit-version: latest

enforce: baseline

enforce-version: latest

warn: restricted

warn-version: latest

exemptions:

namespaces:

- kube-system

runtimeClasses: []

usernames: []

kind: PodSecurityConfiguration

Field	Type	Description
`image`	string	The container image used in the API server manifest. Show example(s) {{< highlight yaml >}}
image: k8s.gcr.io/kube-apiserver:v1.24.0
{{< /highlight >}}
`extraArgs`	map[string]string	Extra arguments to supply to the API server.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the API server static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.
`certSANs`	[]string	Extra certificate subject alternative names for the API server's certificate.
`disablePodSecurityPolicy`	bool	Disable PodSecurityPolicy in the API server and default manifests.
`admissionControl`	[]AdmissionPluginConfig	Configure the API server admission plugins. Show example(s) {{< highlight yaml >}}
admissionControl:
- name: PodSecurity # Name is the name of the admission controller.
# Configuration is an embedded configuration object to be used as the plugin's
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
defaults:
audit: restricted
audit-version: latest
enforce: baseline
enforce-version: latest
warn: restricted
warn-version: latest
exemptions:
namespaces:
- kube-system
runtimeClasses: []
usernames: []
kind: PodSecurityConfiguration
{{< /highlight >}}

AdmissionPluginConfig

AdmissionPluginConfig represents the API server admission plugin configuration.

Appears in:

APIServerConfig.admissionControl

name: PodSecurity # Name is the name of the admission controller.
Configuration is an embedded configuration object to be used as the plugin's
configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration {{< /highlight >}}

Field	Type	Description	Value(s)
`name`	string	Name is the name of the admission controller. It must match the registered admission plugin name.
`configuration`	Unstructured	Configuration is an embedded configuration object to be used as the plugin's configuration.

ControllerManagerConfig

ControllerManagerConfig represents the kube controller manager configuration options.

Appears in:

ClusterConfig.controllerManager

{{< highlight yaml >}} image: k8s.gcr.io/kube-controller-manager:v1.24.0 # The container image used in the controller manager manifest.

Extra arguments to supply to the controller manager.

extraArgs: feature-gates: ServerSideApply=true {{< /highlight >}}

Field	Type	Description
`image`	string	The container image used in the controller manager manifest. Show example(s) {{< highlight yaml >}}
image: k8s.gcr.io/kube-controller-manager:v1.24.0
{{< /highlight >}}
`extraArgs`	map[string]string	Extra arguments to supply to the controller manager.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the controller manager static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.

ProxyConfig

ProxyConfig represents the kube proxy configuration options.

Appears in:

ClusterConfig.proxy

{{< highlight yaml >}} image: k8s.gcr.io/kube-proxy:v1.24.0 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy.

Extra arguments to supply to kube-proxy.

extraArgs: proxy-mode: iptables {{< /highlight >}}

Field	Type	Description
`disabled`	bool	Disable kube-proxy deployment on cluster bootstrap. Show example(s) {{< highlight yaml >}}
disabled: false
{{< /highlight >}}
`image`	string	The container image used in the kube-proxy manifest. Show example(s) {{< highlight yaml >}}
image: k8s.gcr.io/kube-proxy:v1.24.0
{{< /highlight >}}
`mode`	string	proxy mode of kube-proxy. The default is 'iptables'.
`extraArgs`	map[string]string	Extra arguments to supply to kube-proxy.

SchedulerConfig

SchedulerConfig represents the kube scheduler configuration options.

Appears in:

ClusterConfig.scheduler

{{< highlight yaml >}} image: k8s.gcr.io/kube-scheduler:v1.24.0 # The container image used in the scheduler manifest.

Extra arguments to supply to the scheduler.

extraArgs: feature-gates: AllBeta=true {{< /highlight >}}

Field	Type	Description
`image`	string	The container image used in the scheduler manifest. Show example(s) {{< highlight yaml >}}
image: k8s.gcr.io/kube-scheduler:v1.24.0
{{< /highlight >}}
`extraArgs`	map[string]string	Extra arguments to supply to the scheduler.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the scheduler static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.

EtcdConfig

EtcdConfig represents the etcd configuration options.

Appears in:

ClusterConfig.etcd

{{< highlight yaml >}} image: gcr.io/etcd-development/etcd:v3.5.4 # The container image used to create the etcd service.

The `ca` is the root certificate authority of the PKI.

ca: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u

Extra arguments to supply to etcd.

extraArgs: election-timeout: "5000"

# The subnet from which the advertise URL should be.

subnet: 10.0.0.0/8

Field	Type	Description
`image`	string	The container image used to create the etcd service. Show example(s) {{< highlight yaml >}}
image: gcr.io/etcd-development/etcd:v3.5.4
{{< /highlight >}}
`ca`	PEMEncodedCertificateAndKey	The `ca` is the root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) {{< highlight yaml >}}
ca:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`extraArgs`	map[string]string	Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file`
`subnet`	string	The subnet from which the advertise URL should be. Show example(s) {{< highlight yaml >}}
subnet: 10.0.0.0/8
{{< /highlight >}}

ClusterNetworkConfig

ClusterNetworkConfig represents kube networking configuration options.

Appears in:

ClusterConfig.network

The CNI used.

cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS.

The pod subnet CIDR.

podSubnets: - 10.244.0.0/16

The service subnet CIDR.

serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}

Field	Type	Description
`cni`	CNIConfig	The CNI used. Composed of "name" and "urls". The "name" key supports the following options: "flannel", "custom", and "none". "flannel" uses Talos-managed Flannel CNI, and that's the default option. "custom" uses custom manifests that should be provided in "urls". "none" indicates that Talos will not manage any CNI installation. Show example(s) {{< highlight yaml >}}
cni:
name: custom # Name of CNI to use.
# URLs containing manifests to apply for the CNI.
urls:
- https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
{{< /highlight >}}
`dnsDomain`	string	The domain used by Kubernetes DNS. The default is `cluster.local` Show example(s) {{< highlight yaml >}}
dnsDomain: cluser.local
{{< /highlight >}}
`podSubnets`	[]string	The pod subnet CIDR. Show example(s) {{< highlight yaml >}}
podSubnets:
- 10.244.0.0/16
{{< /highlight >}}
`serviceSubnets`	[]string	The service subnet CIDR. Show example(s) {{< highlight yaml >}}
serviceSubnets:
- 10.96.0.0/12
{{< /highlight >}}

CNIConfig

CNIConfig represents the CNI configuration options.

Appears in:

ClusterNetworkConfig.cni

{{< highlight yaml >}} name: custom # Name of CNI to use.

URLs containing manifests to apply for the CNI.

urls: - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml {{< /highlight >}}

Field	Type	Description	Value(s)
`name`	string	Name of CNI to use.	`flannel` `custom` `none`
`urls`	[]string	URLs containing manifests to apply for the CNI. Should be present for "custom", must be empty for "flannel" and "none".

ExternalCloudProviderConfig

ExternalCloudProviderConfig contains external cloud provider configuration.

Appears in:

ClusterConfig.externalCloudProvider

{{< highlight yaml >}} enabled: true # Enable external cloud provider.

A list of urls that point to additional manifests for an external cloud provider.

manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}

Field	Type	Description	Value(s)
`enabled`	bool	Enable external cloud provider.	`true` `yes` `false` `no`
`manifests`	[]string	A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap. Show example(s) {{< highlight yaml >}}
manifests:
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
{{< /highlight >}}

AdminKubeconfigConfig

AdminKubeconfigConfig contains admin kubeconfig settings.

Appears in:

ClusterConfig.adminKubeconfig

{{< highlight yaml >}} certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}

Field	Type	Description	Value(s)
`certLifetime`	Duration	Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).

MachineDisk

MachineDisk represents the options available for partitioning, formatting, and mounting extra disks.

Appears in:

MachineConfig.disks

device: /dev/sdb # The name of the disk to use.
A list of partitions to create on the disk.
partitions:
- mountpoint: /var/mnt/extra # Where to mount the partition.
  
  # The size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.
  
  # Human readable representation.
  
  size: 100 MB
  
  # Precise value in bytes.
  
  size: 1073741824

Field	Type	Description	Value(s)
`device`	string	The name of the disk to use.
`partitions`	[]DiskPartition	A list of partitions to create on the disk.

DiskPartition

DiskPartition represents the options for a disk partition.

Appears in:

MachineDisk.partitions

Field	Type	Description
`size`	DiskSize	The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. Show example(s) {{< highlight yaml >}}
size: 100 MB
{{< /highlight >}}{{< highlight yaml >}}
size: 1073741824
{{< /highlight >}}
`mountpoint`	string	Where to mount the partition.

EncryptionConfig

EncryptionConfig represents partition encryption settings.

Appears in:

SystemDiskEncryptionConfig.state
SystemDiskEncryptionConfig.ephemeral

Field	Type	Description
`provider`	string	Encryption provider to use for the encryption. Show example(s) {{< highlight yaml >}}
provider: luks2
{{< /highlight >}}
`keys`	[]EncryptionKey	Defines the encryption keys generation and storage method.
`cipher`	string	Cipher kind to use for the encryption. Depends on the encryption provider. Show example(s) {{< highlight yaml >}}
cipher: aes-xts-plain64
{{< /highlight >}}	`aes-xts-plain64` `xchacha12,aes-adiantum-plain64` `xchacha20,aes-adiantum-plain64`
`keySize`	uint	Defines the encryption key length.
`blockSize`	uint64	Defines the encryption sector size. Show example(s) {{< highlight yaml >}}
blockSize: 4096
{{< /highlight >}}
`options`	[]string	Additional --perf parameters for the LUKS2 encryption. Show example(s) {{< highlight yaml >}}
options:
- no_read_workqueue
- no_write_workqueue
{{< /highlight >}}	`no_read_workqueue` `no_write_workqueue` `same_cpu_crypt`

EncryptionKey

EncryptionKey represents configuration for disk encryption key.

Appears in:

EncryptionConfig.keys

Field	Type	Description
`static`	EncryptionKeyStatic	Key which value is stored in the configuration file.
`nodeID`	EncryptionKeyNodeID	Deterministically generated key from the node UUID and PartitionLabel.
`slot`	int	Key slot number for LUKS2 encryption.

EncryptionKeyStatic

EncryptionKeyStatic represents throw away key type.

Appears in:

EncryptionKey.static

Field	Type	Description	Value(s)
`passphrase`	string	Defines the static passphrase value.

EncryptionKeyNodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

Appears in:

EncryptionKey.nodeID

MachineFile

MachineFile represents a file to write to disk.

Appears in:

MachineConfig.files

content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use {{< /highlight >}}

Field	Type	Description	Value(s)
`content`	string	The contents of the file.
`permissions`	FileMode	The file's permissions in octal.
`path`	string	The path of the file.
`op`	string	The operation to use	`create` `append` `overwrite`

ExtraHost

ExtraHost represents a host entry in /etc/hosts.

Appears in:

NetworkConfig.extraHostEntries

ip: 192.168.1.100 # The IP of the host.
The host alias.
aliases:
- example
- example.domain.tld {{< /highlight >}}

Field	Type	Description	Value(s)
`ip`	string	The IP of the host.
`aliases`	[]string	The host alias.

Device

Device represents a network interface.

Appears in:

NetworkConfig.interfaces

interface: eth0 # The interface name.

Assigns static IP addresses to the interface.

addresses:
- 192.168.2.0/24
A list of routes associated with the interface.

routes:
- network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.
# Bond specific options.

bond:

# The interfaces that make up the bond.

interfaces:

- eth0

- eth1

mode: 802.3ad # A bond option.

lacpRate: fast # A bond option.

# Indicates if DHCP should be used to configure the interface.

dhcp: true

# DHCP specific options.

dhcpOptions:

routeMetric: 1024 # The priority of all routes received via DHCP.

# Wireguard specific configuration.

# wireguard server example

wireguard:

privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).

listenPort: 51111 # Specifies a device's listening port.

# Specifies a list of peer configurations to apply to a device.

peers:

- publicKey: ABCDEF... # Specifies the public key of this peer.

endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.

# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

allowedIPs:

- 192.168.1.0/24

# wireguard peer example

wireguard:

privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).

# Specifies a list of peer configurations to apply to a device.

peers:

- publicKey: ABCDEF... # Specifies the public key of this peer.

endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.

persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.

# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

allowedIPs:

- 192.168.1.0/24

# Virtual (shared) IP address configuration.

vip:

ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`interface`	string	The interface name. Show example(s) {{< highlight yaml >}}
interface: eth0
{{< /highlight >}}
`addresses`	[]string	Assigns static IP addresses to the interface. An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). Show example(s) {{< highlight yaml >}}
addresses:
- 10.5.0.0/16
- 192.168.3.7
{{< /highlight >}}
`routes`	[]Route	A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. Show example(s) {{< highlight yaml >}}
routes:
- network: 0.0.0.0/0 # The route's network (destination).
gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
- network: 10.2.0.0/16 # The route's network (destination).
gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
{{< /highlight >}}
`bond`	Bond	Bond specific options. Show example(s) {{< highlight yaml >}}
bond:
# The interfaces that make up the bond.
interfaces:
- eth0
- eth1
mode: 802.3ad # A bond option.
lacpRate: fast # A bond option.
{{< /highlight >}}
`vlans`	[]Vlan	VLAN specific options.
`mtu`	int	The interface's MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
`dhcp`	bool	Indicates if DHCP should be used to configure the interface. The following DHCP options are supported: - `OptionClasslessStaticRoute` - `OptionDomainNameServer` - `OptionDNSDomainSearchList` - `OptionHostName` Show example(s) {{< highlight yaml >}}
dhcp: true
{{< /highlight >}}
`ignore`	bool	Indicates if the interface should be ignored (skips configuration).
`dummy`	bool	Indicates if the interface is a dummy interface. `dummy` is used to specify that this interface should be a virtual-only, dummy interface.
`dhcpOptions`	DHCPOptions	DHCP specific options. `dhcp` must be set to true for these to take effect. Show example(s) {{< highlight yaml >}}
dhcpOptions:
routeMetric: 1024 # The priority of all routes received via DHCP.
{{< /highlight >}}
`wireguard`	DeviceWireguardConfig	Wireguard specific configuration. Includes things like private key, listen port, peers. Show example(s) {{< highlight yaml >}}
wireguard:
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
listenPort: 51111 # Specifies a device's listening port.
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
{{< /highlight >}}{{< highlight yaml >}}
wireguard:
privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# Specifies a list of peer configurations to apply to a device.
peers:
- publicKey: ABCDEF... # Specifies the public key of this peer.
endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
allowedIPs:
- 192.168.1.0/24
{{< /highlight >}}
`vip`	DeviceVIPConfig	Virtual (shared) IP address configuration. Show example(s) {{< highlight yaml >}}
vip:
ip: 172.16.199.55 # Specifies the IP address to be used.
{{< /highlight >}}

DHCPOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

Appears in:

Device.dhcpOptions

{{< highlight yaml >}} routeMetric: 1024 # The priority of all routes received via DHCP. {{< /highlight >}}

Field	Type	Description
`routeMetric`	uint32	The priority of all routes received via DHCP.
`ipv4`	bool	Enables DHCPv4 protocol for the interface (default is enabled).
`ipv6`	bool	Enables DHCPv6 protocol for the interface (default is disabled).
`duidv6`	string	Set client DUID (hex string).

DeviceWireguardConfig

DeviceWireguardConfig contains settings for configuring Wireguard network interface.

Appears in:

Device.wireguard

{{< highlight yaml >}} privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port.

Specifies a list of peer configurations to apply to a device.

peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}

{{< highlight yaml >}} privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).

Specifies a list of peer configurations to apply to a device.

peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}

Field	Type	Description
`privateKey`	string	Specifies a private key configuration (base64 encoded). Can be generated by `wg genkey`.
`listenPort`	int	Specifies a device's listening port.
`firewallMark`	int	Specifies a device's firewall mark.
`peers`	[]DeviceWireguardPeer	Specifies a list of peer configurations to apply to a device.

DeviceWireguardPeer

DeviceWireguardPeer a WireGuard device peer configuration.

Appears in:

DeviceWireguardConfig.peers

Field	Type	Description
`publicKey`	string	Specifies the public key of this peer. Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.
`endpoint`	string	Specifies the endpoint of this peer entry.
`persistentKeepaliveInterval`	Duration	Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
`allowedIPs`	[]string	AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

DeviceVIPConfig

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

Appears in:

Device.vip
Vlan.vip

{{< highlight yaml >}} ip: 172.16.199.55 # Specifies the IP address to be used. {{< /highlight >}}

Field	Type	Description
`ip`	string	Specifies the IP address to be used.
`equinixMetal`	VIPEquinixMetalConfig	Specifies the Equinix Metal API settings to assign VIP to the node.
`hcloud`	VIPHCloudConfig	Specifies the Hetzner Cloud API settings to assign VIP to the node.

VIPEquinixMetalConfig

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Appears in:

DeviceVIPConfig.equinixMetal

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Equinix Metal API Token.

VIPHCloudConfig

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Appears in:

DeviceVIPConfig.hcloud

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Hetzner Cloud API Token.

Bond

Bond contains the various options for configuring a bonded interface.

Appears in:

Device.bond

The interfaces that make up the bond.

interfaces: - eth0 - eth1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option. {{< /highlight >}}

Field	Type	Description
`interfaces`	[]string	The interfaces that make up the bond.
`arpIPTarget`	[]string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`mode`	string	A bond option. Please see the official kernel documentation.
`xmitHashPolicy`	string	A bond option. Please see the official kernel documentation.
`lacpRate`	string	A bond option. Please see the official kernel documentation.
`adActorSystem`	string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`arpValidate`	string	A bond option. Please see the official kernel documentation.
`arpAllTargets`	string	A bond option. Please see the official kernel documentation.
`primary`	string	A bond option. Please see the official kernel documentation.
`primaryReselect`	string	A bond option. Please see the official kernel documentation.
`failOverMac`	string	A bond option. Please see the official kernel documentation.
`adSelect`	string	A bond option. Please see the official kernel documentation.
`miimon`	uint32	A bond option. Please see the official kernel documentation.
`updelay`	uint32	A bond option. Please see the official kernel documentation.
`downdelay`	uint32	A bond option. Please see the official kernel documentation.
`arpInterval`	uint32	A bond option. Please see the official kernel documentation.
`resendIgmp`	uint32	A bond option. Please see the official kernel documentation.
`minLinks`	uint32	A bond option. Please see the official kernel documentation.
`lpInterval`	uint32	A bond option. Please see the official kernel documentation.
`packetsPerSlave`	uint32	A bond option. Please see the official kernel documentation.
`numPeerNotif`	uint8	A bond option. Please see the official kernel documentation.
`tlbDynamicLb`	uint8	A bond option. Please see the official kernel documentation.
`allSlavesActive`	uint8	A bond option. Please see the official kernel documentation.
`useCarrier`	bool	A bond option. Please see the official kernel documentation.
`adActorSysPrio`	uint16	A bond option. Please see the official kernel documentation.
`adUserPortKey`	uint16	A bond option. Please see the official kernel documentation.
`peerNotifyDelay`	uint32	A bond option. Please see the official kernel documentation.

Vlan

Vlan represents vlan settings for a device.

Appears in:

Device.vlans

Field	Type	Description
`addresses`	[]string	The addresses in CIDR notation or as plain IPs to use.
`routes`	[]Route	A list of routes associated with the VLAN.
`dhcp`	bool	Indicates if DHCP should be used.
`vlanId`	uint16	The VLAN's ID.
`mtu`	uint32	The VLAN's MTU.
`vip`	DeviceVIPConfig	The VLAN's virtual IP address configuration.

Route

Route represents a network route.

Appears in:

Device.routes
Vlan.routes

network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). {{< /highlight >}}

Field	Type	Description
`network`	string	The route's network (destination).
`gateway`	string	The route's gateway (if empty, creates link scope route).
`source`	string	The route's source address (optional).
`metric`	uint32	The optional metric for the route.

RegistryMirrorConfig

RegistryMirrorConfig represents mirror configuration for a registry.

Appears in:

RegistriesConfig.mirrors

{{< highlight yaml >}} ghcr.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.insecure - https://ghcr.io/v2/ {{< /highlight >}}

Field	Type	Description	Value(s)
`endpoints`	[]string	List of endpoints (URLs) for registry mirrors to use. Endpoint configures HTTP/HTTPS access mode, host name, port and path (if path is not set, it defaults to `/v2`).

RegistryConfig

RegistryConfig specifies auth & TLS config per registry.

Appears in:

RegistriesConfig.config

{{< highlight yaml >}} registry.insecure: # The TLS configuration for the registry. tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

    # # Enable mutual TLS authentication with the registry.
    # clientIdentity:
    #     crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
    #     key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u

# # The auth configuration for this registry.
# auth:
#     username: username # Optional registry authentication.
#     password: password # Optional registry authentication.

Field	Type	Description
`tls`	RegistryTLSConfig	The TLS configuration for the registry. Show example(s) {{< highlight yaml >}}
tls:
# Enable mutual TLS authentication with the registry.
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}{{< highlight yaml >}}
tls:
insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

# # Enable mutual TLS authentication with the registry.
# clientIdentity:
#     crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
#     key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u

{{< /highlight >}} | | |auth |RegistryAuthConfig |

The auth configuration for this registry.

Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.

Show example(s)

{{< highlight yaml >}} auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

| |

RegistryAuthConfig

RegistryAuthConfig specifies authentication configuration for a registry.

Appears in:

RegistryConfig.auth

{{< highlight yaml >}} username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

Field	Type	Description
`username`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`password`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`auth`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`identityToken`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.

RegistryTLSConfig

RegistryTLSConfig specifies TLS config for HTTPS registries.

Appears in:

RegistryConfig.tls

Enable mutual TLS authentication with the registry.

clientIdentity: crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u {{< /highlight >}}

{{< highlight yaml >}} insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

# Enable mutual TLS authentication with the registry.

clientIdentity:

crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u

key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u

Field	Type	Description
`clientIdentity`	PEMEncodedCertificateAndKey	Enable mutual TLS authentication with the registry. Client certificate and key should be base64-encoded. Show example(s) {{< highlight yaml >}}
clientIdentity:
crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u
key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u
{{< /highlight >}}
`ca`	Base64Bytes	CA registry certificate to add the list of trusted certificates. Certificate should be base64-encoded.
`insecureSkipVerify`	bool	Skip TLS server certificate verification (not recommended).

SystemDiskEncryptionConfig

SystemDiskEncryptionConfig specifies system disk partitions encryption settings.

Appears in:

MachineConfig.systemDiskEncryption

Ephemeral partition encryption.

ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption.

# # Cipher kind to use for the encryption. Depends on the encryption provider.
# cipher: aes-xts-plain64

# # Defines the encryption sector size.
# blockSize: 4096

# # Additional --perf parameters for the LUKS2 encryption.
# options:
#     - no_read_workqueue
#     - no_write_workqueue

Field	Type	Description	Value(s)
`state`	EncryptionConfig	State partition encryption.
`ephemeral`	EncryptionConfig	Ephemeral partition encryption.

FeaturesConfig

FeaturesConfig describe individual Talos features that can be switched on or off.

Appears in:

MachineConfig.features

{{< highlight yaml >}} rbac: true # Enable role-based access control (RBAC). {{< /highlight >}}

Field	Type	Description	Value(s)
`rbac`	bool	Enable role-based access control (RBAC).

VolumeMountConfig

VolumeMountConfig struct describes extra volume mount for the static pods.

Appears in:

APIServerConfig.extraVolumes
ControllerManagerConfig.extraVolumes
SchedulerConfig.extraVolumes

Field	Type	Description
`hostPath`	string	Path on the host. Show example(s) {{< highlight yaml >}}
hostPath: /var/lib/auth
{{< /highlight >}}
`mountPath`	string	Path in the container. Show example(s) {{< highlight yaml >}}
mountPath: /etc/kubernetes/auth
{{< /highlight >}}
`readonly`	bool	Mount the volume read only. Show example(s) {{< highlight yaml >}}
readonly: true
{{< /highlight >}}

ClusterInlineManifest

ClusterInlineManifest struct describes inline bootstrap manifests for the user.

Field	Type	Description
`name`	string	Name of the manifest. Name should be unique. Show example(s) {{< highlight yaml >}}
name: csi
{{< /highlight >}}
`contents`	string	Manifest contents as a string. Show example(s) {{< highlight yaml >}}
contents: /etc/kubernetes/auth
{{< /highlight >}}

NetworkKubeSpan

NetworkKubeSpan struct describes KubeSpan configuration.

Appears in:

NetworkConfig.kubespan

{{< highlight yaml >}} enabled: true # Enable the KubeSpan feature. {{< /highlight >}}

Field	Type	Description	Value(s)
`enabled`	bool	Enable the KubeSpan feature. Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
`allowDownPeerBypass`	bool	Skip sending traffic via KubeSpan if the peer connection state is not up. This provides configurable choice between connectivity and security: either traffic is always forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly to the peer if Wireguard connection can't be established.

ClusterDiscoveryConfig

ClusterDiscoveryConfig struct configures cluster membership discovery.

Appears in:

ClusterConfig.discovery

{{< highlight yaml >}} enabled: true # Enable the cluster membership discovery feature.

Configure registries used for cluster member discovery.

registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint. {{< /highlight >}}

Field	Type	Description	Value(s)
`enabled`	bool	Enable the cluster membership discovery feature. Cluster discovery is based on individual registries which are configured under the registries field.
`registries`	DiscoveryRegistriesConfig	Configure registries used for cluster member discovery.

DiscoveryRegistriesConfig

DiscoveryRegistriesConfig struct configures cluster membership discovery.

Appears in:

ClusterDiscoveryConfig.registries

Field	Type	Description	Value(s)
`kubernetes`	RegistryKubernetesConfig	Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information as annotations on the Node resources.
`service`	RegistryServiceConfig	Service registry is using an external service to push and pull information about cluster members.

RegistryKubernetesConfig

RegistryKubernetesConfig struct configures Kubernetes discovery registry.

Appears in:

DiscoveryRegistriesConfig.kubernetes

Field	Type	Description	Value(s)
`disabled`	bool	Disable Kubernetes discovery registry.

RegistryServiceConfig

RegistryServiceConfig struct configures Kubernetes discovery registry.

Appears in:

DiscoveryRegistriesConfig.service

Field	Type	Description
`disabled`	bool	Disable external service discovery registry.
`endpoint`	string	External service endpoint. Show example(s) {{< highlight yaml >}}
endpoint: https://discovery.talos.dev/
{{< /highlight >}}

UdevConfig

UdevConfig describes how the udev system should be configured.

Appears in:

MachineConfig.udev

List of udev rules to apply to the udev system

rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" {{< /highlight >}}

Field	Type	Description	Value(s)
`rules`	[]string	List of udev rules to apply to the udev system

LoggingConfig

LoggingConfig struct configures Talos logging.

Appears in:

MachineConfig.logging

Logging destination.

destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}

Field	Type	Description	Value(s)
`destinations`	[]LoggingDestination	Logging destination.

LoggingDestination

LoggingDestination struct configures Talos logging destination.

Appears in:

LoggingConfig.destinations

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Where to send logs. Supported protocols are "tcp" and "udp". Show example(s) {{< highlight yaml >}}
endpoint: udp://127.0.0.1:12345
{{< /highlight >}}{{< highlight yaml >}}
endpoint: tcp://1.2.3.4:12345
{{< /highlight >}}
`format`	string	Logs format.	`json_lines`

KernelConfig

KernelConfig struct configures Talos Linux kernel.

Appears in:

MachineConfig.kernel

Kernel modules to load.

modules: - name: brtfs # Module name. {{< /highlight >}}

Field	Type	Description	Value(s)
`modules`	[]KernelModuleConfig	Kernel modules to load.

KernelModuleConfig

KernelModuleConfig struct configures Linux kernel modules to load.

Appears in:

KernelConfig.modules

Field	Type	Description	Value(s)
`name`	string	Module name.

106 KiB Raw Blame History

Config

MachineConfig

InstallConfig represents the installation options for preparing a node.

ClusterConfig

ControlPlaneConfig represents the control plane configuration options.

ClusterNetworkConfig represents kube networking configuration options.

ExtraMount

MachineControlPlaneConfig

Controller manager machine specific configuration options.

Scheduler machine specific configuration options.

MachineControllerManagerConfig

MachineSchedulerConfig

KubeletConfig

The extraArgs field is used to provide additional flags to the kubelet.

# The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.

clusterDNS:

- 10.96.0.10

- 169.254.2.53

# The extraMounts field is used to add additional mounts to the kubelet container.

extraMounts:

- destination: /var/lib/example

type: bind

source: /var/lib/example

options:

- bind

- rshared

- rw

# The extraConfig field is used to provide kubelet configuration overrides.

extraConfig:

serverTLSBootstrap: true

# The nodeIP field is used to configure --node-ip flag for the kubelet.

nodeIP:

# The validSubnets field configures the networks to pick kubelet node IP from.

validSubnets:

- 10.0.0.0/8

- '!10.0.0.3/32'

- fdc7::/16

KubeletNodeIPConfig

The validSubnets field configures the networks to pick kubelet node IP from.

NetworkConfig

interfaces is used to define the network interface configuration.

Used to statically set the nameservers for the machine.

# Allows for extra entries to be added to the /etc/hosts file

extraHostEntries:

- ip: 192.168.1.100 # The IP of the host.

# The host alias.

aliases:

- example

- example.domain.tld

# Configures KubeSpan feature.

kubespan:

enabled: true # Enable the KubeSpan feature.

InstallConfig

Allows for supplying extra kernel args via the bootloader.

# Look up disk using disk attributes like model, size, serial and others.

diskSelector:

size: 4GB # Disk size.

model: WDC* # Disk model /sys/block/<dev>/device/model.

busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# Allows for supplying additional system extension images to install on top of base Talos image.

extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0

InstallDiskSelector

InstallExtensionConfig

TimeConfig

Specifies time (NTP) servers to use for setting the system time.

RegistriesConfig

Specifies mirror configuration for each registry.

Specifies TLS & auth configuration for HTTPS image registries.

PodCheckpointer

CoreDNS

Endpoint

ControlPlaneConfig

APIServerConfig

Extra arguments to supply to the API server.

Extra certificate subject alternative names for the API server's certificate.

# Configure the API server admission plugins.

admissionControl:

- name: PodSecurity # Name is the name of the admission controller.

# Configuration is an embedded configuration object to be used as the plugin's

106 KiB

Raw Blame History

The `extraArgs` field is used to provide additional flags to the kubelet.

# The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.

# The `extraMounts` field is used to add additional mounts to the kubelet container.

# The `extraConfig` field is used to provide kubelet configuration overrides.

# The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.

# The `validSubnets` field configures the networks to pick kubelet node IP from.

The `validSubnets` field configures the networks to pick kubelet node IP from.

`interfaces` is used to define the network interface configuration.

# Allows for extra entries to be added to the `/etc/hosts` file

model: WDC* # Disk model `/sys/block/<dev>/device/model`.

The `ca` is the root certificate authority of the PKI.

# The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.