Skip to content

Latest commit

 

History

History
3770 lines (2569 loc) · 152 KB

config.md

File metadata and controls

3770 lines (2569 loc) · 152 KB
Raw
description title
Config defines the v1alpha1.Config Talos machine configuration document.
Config

{{< highlight yaml >}} version: v1alpha1 machine: # ... cluster: # ... {{< /highlight >}}

Field Type Description Value(s)
version string Indicates the schema used to decode the contents. v1alpha1
debug bool
Enable verbose logging to the console.All system containers logs will flow into serial console.

Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
 true
yes
false
no
machine MachineConfig Provides machine specific configuration options.
cluster ClusterConfig Provides cluster specific configuration options.

machine {#Config.machine}

MachineConfig represents the machine-specific config values.

{{< highlight yaml >}} machine: type: controlplane # InstallConfig represents the installation options for preparing a node. install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time.

    # # Look up disk using disk attributes like model, size, serial and others.
    # diskSelector:
    #     size: 4GB # Disk size.
    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

    # # Allows for supplying additional system extension images to install on top of base Talos image.
    # extensions:
    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

{{< /highlight >}}

Field Type Description Value(s)
type string
Defines the role of the machine within the cluster.
Control Plane

Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.

Worker

Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.

This node type was previously known as "join"; that value is still supported but deprecated.
 controlplane
worker
token string
The token is used by a machine to join the PKI of the cluster.Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.
Show example(s){{< highlight yaml >}}
token: 328hom.uqjzh6jnn2eie9oi
{{< /highlight >}}
ca PEMEncodedCertificateAndKey
The root certificate authority of the PKI.It is composed of a base64 encoded crt and key.
Show example(s){{< highlight yaml >}}
ca: 
crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}} | | |certSANs |[]string |

Extra certificate subject alternative names for the machine's certificate.By default, all non-loopback interface IPs are automatically added to the certificate's SANs.
Show example(s){{< highlight yaml >}} certSANs: - 10.0.0.10 - 172.16.0.10 - 192.168.0.10 {{< /highlight >}}
| | |controlPlane |MachineControlPlaneConfig |Provides machine specific control plane configuration options.
Show example(s){{< highlight yaml >}} controlPlane: # Controller manager machine specific configuration options. controllerManager: disabled: false # Disable kube-controller-manager on the node. # Scheduler machine specific configuration options. scheduler: disabled: true # Disable kube-scheduler on the node. {{< /highlight >}}
| | |kubelet |KubeletConfig |Used to provide additional options to the kubelet.
Show example(s){{< highlight yaml >}} kubelet: image: ghcr.io/siderolabs/kubelet:v1.29.0-rc.2 # The image field is an optional reference to an alternative kubelet image. # The extraArgs field is used to provide additional flags to the kubelet. extraArgs: feature-gates: ServerSideApply=true

# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
#     - 10.96.0.10
#     - 169.254.2.53

# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
#     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
#       type: bind # Type specifies the mount kind.
#       source: /var/lib/example # Source specifies the source path of the mount.
#       # Options are fstab style mount options.
#       options:
#         - bind
#         - rshared
#         - rw

# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
#     serverTLSBootstrap: true

# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
# credentialProviderConfig:
#     apiVersion: kubelet.config.k8s.io/v1
#     kind: CredentialProviderConfig
#     providers:
#         - apiVersion: credentialprovider.kubelet.k8s.io/v1
#           defaultCacheDuration: 12h
#           matchImages:
#             - '*.dkr.ecr.*.amazonaws.com'
#             - '*.dkr.ecr.*.amazonaws.com.cn'
#             - '*.dkr.ecr-fips.*.amazonaws.com'
#             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
#             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
#           name: ecr-credential-provider

# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
#     # The `validSubnets` field configures the networks to pick kubelet node IP from.
#     validSubnets:
#         - 10.0.0.0/8
#         - '!10.0.0.3/32'
#         - fdc7::/16

{{< /highlight >}}

| | |pods |[]Unstructured |
Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.
Show example(s){{< highlight yaml >}} pods: - apiVersion: v1 kind: pod metadata: name: nginx spec: containers: - image: nginx name: nginx {{< /highlight >}}
| | |network |NetworkConfig |Provides machine specific network configuration options.
Show example(s){{< highlight yaml >}} network: hostname: worker-1 # Used to statically set the hostname for the machine. # interfaces is used to define the network interface configuration. interfaces: - interface: enp0s1 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.

      # # Picks a network device using the selector.

      # # select a device with bus prefix 00:*.
      # deviceSelector:
      #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
      # deviceSelector:
      #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #     driver: virtio # Kernel driver, supports matching by wildcard.
      # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
      # deviceSelector:
      #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #       driver: virtio # Kernel driver, supports matching by wildcard.

      # # Bond specific options.
      # bond:
      #     # The interfaces that make up the bond.
      #     interfaces:
      #         - enp2s0
      #         - enp2s1
      #     # Picks a network device using the selector.
      #     deviceSelectors:
      #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #           driver: virtio # Kernel driver, supports matching by wildcard.
      #     mode: 802.3ad # A bond option.
      #     lacpRate: fast # A bond option.

      # # Bridge specific options.
      # bridge:
      #     # The interfaces that make up the bridge.
      #     interfaces:
      #         - enxda4042ca9a51
      #         - enxae2a6774c259
      #     # A bridge option.
      #     stp:
      #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

      # # Indicates if DHCP should be used to configure the interface.
      # dhcp: true

      # # DHCP specific options.
      # dhcpOptions:
      #     routeMetric: 1024 # The priority of all routes received via DHCP.

      # # Wireguard specific configuration.

      # # wireguard server example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     listenPort: 51111 # Specifies a device's listening port.
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24
      # # wireguard peer example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
      #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24

      # # Virtual (shared) IP address configuration.

      # # layer2 vip example
      # vip:
      #     ip: 172.16.199.55 # Specifies the IP address to be used.
# Used to statically set the nameservers for the machine.
nameservers:
    - 9.8.7.6
    - 8.7.6.5

# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
#     - ip: 192.168.1.100 # The IP of the host.
#       # The host alias.
#       aliases:
#         - example
#         - example.domain.tld

# # Configures KubeSpan feature.
# kubespan:
#     enabled: true # Enable the KubeSpan feature.

{{< /highlight >}}

| | |disks |[]MachineDisk |
Used to partition, format and mount additional disks.Since the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.
Note that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.
If size: is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}} disks: - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition.

      # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

      # # Human readable representation.
      # size: 100 MB
      # # Precise value in bytes.
      # size: 1073741824

{{< /highlight >}}

| | |install |InstallConfig |
Used to provide instructions for installations.
Note that this configuration section gets silently ignored by Talos images that are considered pre-installed.
To make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.
Show example(s){{< highlight yaml >}} install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time.

# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
#     size: 4GB # Disk size.
#     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
#     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# # Allows for supplying additional system extension images to install on top of base Talos image.
# extensions:
#     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

{{< /highlight >}}

| | |files |[]MachineFile |
Allows the addition of user specified files.The value of op can be create, overwrite, or append.
In the case of create, path must not exist.
In the case of overwrite, and append, path must be a valid file.
If an op value of append is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Show example(s){{< highlight yaml >}} files: - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use {{< /highlight >}}
| | |env |Env |
The env field allows for the addition of environment variables.All environment variables are set on PID 1 in addition to every service.
Show example(s){{< highlight yaml >}} env: GRPC_GO_LOG_SEVERITY_LEVEL: info GRPC_GO_LOG_VERBOSITY_LEVEL: "99" https_proxy: http://SERVER:PORT/ {{< /highlight >}}{{< highlight yaml >}} env: GRPC_GO_LOG_SEVERITY_LEVEL: error https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ {{< /highlight >}}{{< highlight yaml >}} env: https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ {{< /highlight >}}
|GRPC_GO_LOG_VERBOSITY_LEVEL
GRPC_GO_LOG_SEVERITY_LEVEL
http_proxy
https_proxy
no_proxy
| |time |TimeConfig |Used to configure the machine's time settings.
Show example(s){{< highlight yaml >}} time: disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. {{< /highlight >}}
| | |sysctls |map[string]string |Used to configure the machine's sysctls.
Show example(s){{< highlight yaml >}} sysctls: kernel.domainname: talos.dev net.ipv4.ip_forward: "0" net/ipv6/conf/eth0.100/disable_ipv6: "1" {{< /highlight >}}
| | |sysfs |map[string]string |Used to configure the machine's sysfs.
Show example(s){{< highlight yaml >}} sysfs: devices.system.cpu.cpu0.cpufreq.scaling_governor: performance {{< /highlight >}}
| | |registries |RegistriesConfig |
Used to configure the machine's container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.

The mirrors section allows to redirect requests for images to a non-default registry,
which might be a local registry or a caching mirror.

The config section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in .docker/config.json.

See also matching configuration for CRI containerd plugin.
Show example(s){{< highlight yaml >}} registries: # Specifies mirror configuration for each registry host namespace. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}
| | |systemDiskEncryption |SystemDiskEncryptionConfig |
Machine system disk encryption configuration.Defines each system partition encryption parameters.
Show example(s){{< highlight yaml >}} systemDiskEncryption: # Ephemeral partition encryption. ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption.

          # # KMS managed encryption key.
          # kms:
          #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

    # # Cipher kind to use for the encryption. Depends on the encryption provider.
    # cipher: aes-xts-plain64

    # # Defines the encryption sector size.
    # blockSize: 4096

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue

{{< /highlight >}}

| | |features |FeaturesConfig |Features describe individual Talos features that can be switched on or off.
Show example(s){{< highlight yaml >}} features: rbac: true # Enable role-based access control (RBAC).

# # Configure Talos API access from Kubernetes pods.
# kubernetesTalosAPIAccess:
#     enabled: true # Enable Talos API access from Kubernetes pods.
#     # The list of Talos API roles which can be granted for access from Kubernetes pods.
#     allowedRoles:
#         - os:reader
#     # The list of Kubernetes namespaces Talos API access is available from.
#     allowedKubernetesNamespaces:
#         - kube-system

{{< /highlight >}}

| | |udev |UdevConfig |Configures the udev system.
Show example(s){{< highlight yaml >}} udev: # List of udev rules to apply to the udev system rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" {{< /highlight >}}
| | |logging |LoggingConfig |Configures the logging system.
Show example(s){{< highlight yaml >}} logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}
| | |kernel |KernelConfig |Configures the kernel.
Show example(s){{< highlight yaml >}} kernel: # Kernel modules to load. modules: - name: brtfs # Module name. {{< /highlight >}}
| | |seccompProfiles |[]MachineSeccompProfile |Configures the seccomp profiles for the machine.
Show example(s){{< highlight yaml >}} seccompProfiles: - name: audit.json # The name field is used to provide the file name of the seccomp profile. # The value field is used to provide the seccomp profile. value: defaultAction: SCMP_ACT_LOG {{< /highlight >}}
| | |nodeLabels |map[string]string |Configures the node labels for the machine.
Show example(s){{< highlight yaml >}} nodeLabels: exampleLabel: exampleLabelValue {{< /highlight >}}
| | |nodeTaints |map[string]string |Configures the node taints for the machine. Effect is optional.
Show example(s){{< highlight yaml >}} nodeTaints: exampleTaint: exampleTaintValue:NoSchedule {{< /highlight >}}
| |

controlPlane {#Config.machine.controlPlane}

MachineControlPlaneConfig machine specific configuration options.

{{< highlight yaml >}} machine: controlPlane: # Controller manager machine specific configuration options. controllerManager: disabled: false # Disable kube-controller-manager on the node. # Scheduler machine specific configuration options. scheduler: disabled: true # Disable kube-scheduler on the node. {{< /highlight >}}

Field Type Description Value(s)
controllerManager MachineControllerManagerConfig Controller manager machine specific configuration options.
scheduler MachineSchedulerConfig Scheduler machine specific configuration options.

controllerManager {#Config.machine.controlPlane.controllerManager}

MachineControllerManagerConfig represents the machine specific ControllerManager config values.

Field Type Description Value(s)
disabled bool Disable kube-controller-manager on the node.

scheduler {#Config.machine.controlPlane.scheduler}

MachineSchedulerConfig represents the machine specific Scheduler config values.

Field Type Description Value(s)
disabled bool Disable kube-scheduler on the node.

kubelet {#Config.machine.kubelet}

KubeletConfig represents the kubelet config values.

{{< highlight yaml >}} machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.29.0-rc.2 # The image field is an optional reference to an alternative kubelet image. # The extraArgs field is used to provide additional flags to the kubelet. extraArgs: feature-gates: ServerSideApply=true

    # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
    # clusterDNS:
    #     - 10.96.0.10
    #     - 169.254.2.53

    # # The `extraMounts` field is used to add additional mounts to the kubelet container.
    # extraMounts:
    #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
    #       type: bind # Type specifies the mount kind.
    #       source: /var/lib/example # Source specifies the source path of the mount.
    #       # Options are fstab style mount options.
    #       options:
    #         - bind
    #         - rshared
    #         - rw

    # # The `extraConfig` field is used to provide kubelet configuration overrides.
    # extraConfig:
    #     serverTLSBootstrap: true

    # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
    # credentialProviderConfig:
    #     apiVersion: kubelet.config.k8s.io/v1
    #     kind: CredentialProviderConfig
    #     providers:
    #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
    #           defaultCacheDuration: 12h
    #           matchImages:
    #             - '*.dkr.ecr.*.amazonaws.com'
    #             - '*.dkr.ecr.*.amazonaws.com.cn'
    #             - '*.dkr.ecr-fips.*.amazonaws.com'
    #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
    #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
    #           name: ecr-credential-provider

    # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
    # nodeIP:
    #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
    #     validSubnets:
    #         - 10.0.0.0/8
    #         - '!10.0.0.3/32'
    #         - fdc7::/16

{{< /highlight >}}

Field Type Description Value(s)
image string The image field is an optional reference to an alternative kubelet image.
Show example(s){{< highlight yaml >}}
image: ghcr.io/siderolabs/kubelet:v1.29.0-rc.2
{{< /highlight >}}
clusterDNS []string The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.
Show example(s){{< highlight yaml >}}
clusterDNS: 
- 10.96.0.10
- 169.254.2.53

{{< /highlight >}} | | |extraArgs |map[string]string |The extraArgs field is used to provide additional flags to the kubelet.

Show example(s){{< highlight yaml >}} extraArgs: key: value {{< /highlight >}}
| | |extraMounts |[]ExtraMount |
The extraMounts field is used to add additional mounts to the kubelet container.Note that either bind or rbind are required in the options.
Show example(s){{< highlight yaml >}} extraMounts: - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. type: bind # Type specifies the mount kind. source: /var/lib/example # Source specifies the source path of the mount. # Options are fstab style mount options. options: - bind - rshared - rw {{< /highlight >}}
| | |extraConfig |Unstructured |
The extraConfig field is used to provide kubelet configuration overrides.
Some fields are not allowed to be overridden: authentication and authorization, cgroups
configuration, ports, etc.
Show example(s){{< highlight yaml >}} extraConfig: serverTLSBootstrap: true {{< /highlight >}}
| | |credentialProviderConfig |Unstructured |The KubeletCredentialProviderConfig field is used to provide kubelet credential configuration.
Show example(s){{< highlight yaml >}} credentialProviderConfig: apiVersion: kubelet.config.k8s.io/v1 kind: CredentialProviderConfig providers: - apiVersion: credentialprovider.kubelet.k8s.io/v1 defaultCacheDuration: 12h matchImages: - '.dkr.ecr..amazonaws.com' - '.dkr.ecr..amazonaws.com.cn' - '.dkr.ecr-fips..amazonaws.com' - '.dkr.ecr.us-iso-east-1.c2s.ic.gov' - '.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' name: ecr-credential-provider {{< /highlight >}}
| | |defaultRuntimeSeccompProfileEnabled |bool |Enable container runtime default Seccomp profile. |true
yes
false
no
| |registerWithFQDN |bool |
The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.This is required in clouds like AWS.
|true
yes
false
no
| |nodeIP |KubeletNodeIPConfig |
The nodeIP field is used to configure --node-ip flag for the kubelet.This is used when a node has multiple addresses to choose from.
Show example(s){{< highlight yaml >}} nodeIP: # The validSubnets field configures the networks to pick kubelet node IP from. validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16 {{< /highlight >}}
| | |skipNodeRegistration |bool |
The skipNodeRegistration is used to run the kubelet without registering with the apiserver.This runs kubelet as standalone and only runs static pods.
|true
yes
false
no
| |disableManifestsDirectory |bool |
The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.It's recommended to configure static pods with the "pods" key instead.
|true
yes
false
no
|

extraMounts[] {#Config.machine.kubelet.extraMounts.}

ExtraMount wraps OCI Mount specification.

{{< highlight yaml >}} machine: kubelet: extraMounts: - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. type: bind # Type specifies the mount kind. source: /var/lib/example # Source specifies the source path of the mount. # Options are fstab style mount options. options: - bind - rshared - rw {{< /highlight >}}

Field Type Description Value(s)
destination string Destination is the absolute path where the mount will be placed in the container.
type string Type specifies the mount kind.
source string Source specifies the source path of the mount.
options []string Options are fstab style mount options.
uidMappings []LinuxIDMapping
UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.
gidMappings []LinuxIDMapping
UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
Every mount point could have its own mapping.
uidMappings[] {#Config.machine.kubelet.extraMounts..uidMappings.}

LinuxIDMapping represents the Linux ID mapping.

Field Type Description Value(s)
containerID uint32 ContainerID is the starting UID/GID in the container.
hostID uint32 HostID is the starting UID/GID on the host to be mapped to 'ContainerID'.
size uint32 Size is the number of IDs to be mapped.
gidMappings[] {#Config.machine.kubelet.extraMounts..gidMappings.}

LinuxIDMapping represents the Linux ID mapping.

Field Type Description Value(s)
containerID uint32 ContainerID is the starting UID/GID in the container.
hostID uint32 HostID is the starting UID/GID on the host to be mapped to 'ContainerID'.
size uint32 Size is the number of IDs to be mapped.

nodeIP {#Config.machine.kubelet.nodeIP}

KubeletNodeIPConfig represents the kubelet node IP configuration.

{{< highlight yaml >}} machine: kubelet: nodeIP: # The validSubnets field configures the networks to pick kubelet node IP from. validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16 {{< /highlight >}}

Field Type Description Value(s)
validSubnets []string
The validSubnets field configures the networks to pick kubelet node IP from.For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

network {#Config.machine.network}

NetworkConfig represents the machine's networking config values.

{{< highlight yaml >}} machine: network: hostname: worker-1 # Used to statically set the hostname for the machine. # interfaces is used to define the network interface configuration. interfaces: - interface: enp0s1 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.

          # # Picks a network device using the selector.

          # # select a device with bus prefix 00:*.
          # deviceSelector:
          #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #     driver: virtio # Kernel driver, supports matching by wildcard.
          # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #       driver: virtio # Kernel driver, supports matching by wildcard.

          # # Bond specific options.
          # bond:
          #     # The interfaces that make up the bond.
          #     interfaces:
          #         - enp2s0
          #         - enp2s1
          #     # Picks a network device using the selector.
          #     deviceSelectors:
          #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #           driver: virtio # Kernel driver, supports matching by wildcard.
          #     mode: 802.3ad # A bond option.
          #     lacpRate: fast # A bond option.

          # # Bridge specific options.
          # bridge:
          #     # The interfaces that make up the bridge.
          #     interfaces:
          #         - enxda4042ca9a51
          #         - enxae2a6774c259
          #     # A bridge option.
          #     stp:
          #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

          # # Indicates if DHCP should be used to configure the interface.
          # dhcp: true

          # # DHCP specific options.
          # dhcpOptions:
          #     routeMetric: 1024 # The priority of all routes received via DHCP.

          # # Wireguard specific configuration.

          # # wireguard server example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     listenPort: 51111 # Specifies a device's listening port.
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24
          # # wireguard peer example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
          #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24

          # # Virtual (shared) IP address configuration.

          # # layer2 vip example
          # vip:
          #     ip: 172.16.199.55 # Specifies the IP address to be used.
    # Used to statically set the nameservers for the machine.
    nameservers:
        - 9.8.7.6
        - 8.7.6.5

    # # Allows for extra entries to be added to the `/etc/hosts` file
    # extraHostEntries:
    #     - ip: 192.168.1.100 # The IP of the host.
    #       # The host alias.
    #       aliases:
    #         - example
    #         - example.domain.tld

    # # Configures KubeSpan feature.
    # kubespan:
    #     enabled: true # Enable the KubeSpan feature.

{{< /highlight >}}

Field Type Description Value(s)
hostname string Used to statically set the hostname for the machine.
interfaces []Device
interfaces is used to define the network interface configuration.By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Show example(s){{< highlight yaml >}}
interfaces: 
- interface: enp0s1 # The interface name.
  # Assigns static IP addresses to the interface.
  addresses:
    - 192.168.2.0/24
  # A list of routes associated with the interface.
  routes:
    - network: 0.0.0.0/0 # The route's network (destination).
      gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
      metric: 1024 # The optional metric for the route.
  mtu: 1500 # The interface's MTU.

  # # Picks a network device using the selector.

  # # select a device with bus prefix 00:*.
  # deviceSelector:
  #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
  # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
  # deviceSelector:
  #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
  #     driver: virtio # Kernel driver, supports matching by wildcard.
  # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
  # deviceSelector:
  #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
  #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
  #       driver: virtio # Kernel driver, supports matching by wildcard.

  # # Bond specific options.
  # bond:
  #     # The interfaces that make up the bond.
  #     interfaces:
  #         - enp2s0
  #         - enp2s1
  #     # Picks a network device using the selector.
  #     deviceSelectors:
  #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
  #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
  #           driver: virtio # Kernel driver, supports matching by wildcard.
  #     mode: 802.3ad # A bond option.
  #     lacpRate: fast # A bond option.

  # # Bridge specific options.
  # bridge:
  #     # The interfaces that make up the bridge.
  #     interfaces:
  #         - enxda4042ca9a51
  #         - enxae2a6774c259
  #     # A bridge option.
  #     stp:
  #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

  # # Indicates if DHCP should be used to configure the interface.
  # dhcp: true

  # # DHCP specific options.
  # dhcpOptions:
  #     routeMetric: 1024 # The priority of all routes received via DHCP.

  # # Wireguard specific configuration.

  # # wireguard server example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     listenPort: 51111 # Specifies a device's listening port.
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24
  # # wireguard peer example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
  #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24

  # # Virtual (shared) IP address configuration.

  # # layer2 vip example
  # vip:
  #     ip: 172.16.199.55 # Specifies the IP address to be used.

{{< /highlight >}} | | |nameservers |[]string |

Used to statically set the nameservers for the machine.Defaults to 1.1.1.1 and 8.8.8.8
Show example(s){{< highlight yaml >}} nameservers: - 8.8.8.8 - 1.1.1.1 {{< /highlight >}}
| | |extraHostEntries |[]ExtraHost |Allows for extra entries to be added to the /etc/hosts file
Show example(s){{< highlight yaml >}} extraHostEntries: - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld {{< /highlight >}}
| | |kubespan |NetworkKubeSpan |Configures KubeSpan feature.
Show example(s){{< highlight yaml >}} kubespan: enabled: true # Enable the KubeSpan feature. {{< /highlight >}}
| | |disableSearchDomain |bool |
Disable generating a default search domain in /etc/resolv.confbased on the machine hostname.
Defaults to false.
|true
yes
false
no
|

interfaces[] {#Config.machine.network.interfaces.}

Device represents a network interface.

{{< highlight yaml >}} machine: network: interfaces: - interface: enp0s1 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU.

          # # Picks a network device using the selector.

          # # select a device with bus prefix 00:*.
          # deviceSelector:
          #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #     driver: virtio # Kernel driver, supports matching by wildcard.
          # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
          # deviceSelector:
          #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #       driver: virtio # Kernel driver, supports matching by wildcard.

          # # Bond specific options.
          # bond:
          #     # The interfaces that make up the bond.
          #     interfaces:
          #         - enp2s0
          #         - enp2s1
          #     # Picks a network device using the selector.
          #     deviceSelectors:
          #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
          #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
          #           driver: virtio # Kernel driver, supports matching by wildcard.
          #     mode: 802.3ad # A bond option.
          #     lacpRate: fast # A bond option.

          # # Bridge specific options.
          # bridge:
          #     # The interfaces that make up the bridge.
          #     interfaces:
          #         - enxda4042ca9a51
          #         - enxae2a6774c259
          #     # A bridge option.
          #     stp:
          #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

          # # Indicates if DHCP should be used to configure the interface.
          # dhcp: true

          # # DHCP specific options.
          # dhcpOptions:
          #     routeMetric: 1024 # The priority of all routes received via DHCP.

          # # Wireguard specific configuration.

          # # wireguard server example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     listenPort: 51111 # Specifies a device's listening port.
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24
          # # wireguard peer example
          # wireguard:
          #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
          #     # Specifies a list of peer configurations to apply to a device.
          #     peers:
          #         - publicKey: ABCDEF... # Specifies the public key of this peer.
          #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
          #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
          #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
          #           allowedIPs:
          #             - 192.168.1.0/24

          # # Virtual (shared) IP address configuration.

          # # layer2 vip example
          # vip:
          #     ip: 172.16.199.55 # Specifies the IP address to be used.

{{< /highlight >}}

Field Type Description Value(s)
interface string
The interface name.Mutually exclusive with deviceSelector.
Show example(s){{< highlight yaml >}}
interface: enp0s3
{{< /highlight >}}
deviceSelector NetworkDeviceSelector
Picks a network device using the selector.Mutually exclusive with interface.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}}
deviceSelector: 
busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.

{{< /highlight >}}{{< highlight yaml >}} deviceSelector: hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard. {{< /highlight >}} | | |addresses |[]string |

Assigns static IP addresses to the interface.An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).
Show example(s){{< highlight yaml >}} addresses: - 10.5.0.0/16 - 192.168.3.7 {{< /highlight >}}
| | |routes |[]Route |
A list of routes associated with the interface.If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Show example(s){{< highlight yaml >}} routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). {{< /highlight >}}
| | |bond |Bond |Bond specific options.
Show example(s){{< highlight yaml >}} bond: # The interfaces that make up the bond. interfaces: - enp2s0 - enp2s1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option.

# # Picks a network device using the selector.

# # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# deviceSelectors:
#     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
#     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
#       driver: virtio # Kernel driver, supports matching by wildcard.

{{< /highlight >}}

| | |bridge |Bridge |Bridge specific options.
Show example(s){{< highlight yaml >}} bridge: # The interfaces that make up the bridge. interfaces: - enxda4042ca9a51 - enxae2a6774c259 # A bridge option. stp: enabled: true # Whether Spanning Tree Protocol (STP) is enabled. {{< /highlight >}}
| | |vlans |[]Vlan |VLAN specific options. | | |mtu |int |
The interface's MTU.If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
| | |dhcp |bool |
Indicates if DHCP should be used to configure the interface.The following DHCP options are supported:

- OptionClasslessStaticRoute
- OptionDomainNameServer
- OptionDNSDomainSearchList
- OptionHostName
Show example(s){{< highlight yaml >}} dhcp: true {{< /highlight >}}
| | |ignore |bool |Indicates if the interface should be ignored (skips configuration). | | |dummy |bool |
Indicates if the interface is a dummy interface.dummy is used to specify that this interface should be a virtual-only, dummy interface.
| | |dhcpOptions |DHCPOptions |
DHCP specific options.dhcp must be set to true for these to take effect.
Show example(s){{< highlight yaml >}} dhcpOptions: routeMetric: 1024 # The priority of all routes received via DHCP. {{< /highlight >}}
| | |wireguard |DeviceWireguardConfig |
Wireguard specific configuration.Includes things like private key, listen port, peers.
Show example(s){{< highlight yaml >}} wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port. # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}{{< highlight yaml >}} wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}
| | |vip |DeviceVIPConfig |Virtual (shared) IP address configuration.
Show example(s){{< highlight yaml >}} vip: ip: 172.16.199.55 # Specifies the IP address to be used. {{< /highlight >}}
| |

deviceSelector {#Config.machine.network.interfaces..deviceSelector}

NetworkDeviceSelector struct describes network device selector.

{{< highlight yaml >}} machine: network: interfaces: - deviceSelector: busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. {{< /highlight >}}

{{< highlight yaml >}} machine: network: interfaces: - deviceSelector: hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard. {{< /highlight >}}

{{< highlight yaml >}} machine: network: interfaces: - deviceSelector: - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard. {{< /highlight >}}

Field Type Description Value(s)
busPath string PCI, USB bus prefix, supports matching by wildcard.
hardwareAddr string Device hardware address, supports matching by wildcard.
pciID string PCI ID (vendor ID, product ID), supports matching by wildcard.
driver string Kernel driver, supports matching by wildcard.
routes[] {#Config.machine.network.interfaces..routes.}

Route represents a network route.

{{< highlight yaml >}} machine: network: interfaces: - routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). {{< /highlight >}}

Field Type Description Value(s)
network string The route's network (destination).
gateway string The route's gateway (if empty, creates link scope route).
source string The route's source address (optional).
metric uint32 The optional metric for the route.
mtu uint32 The optional MTU for the route.
bond {#Config.machine.network.interfaces..bond}

Bond contains the various options for configuring a bonded interface.

{{< highlight yaml >}} machine: network: interfaces: - bond: # The interfaces that make up the bond. interfaces: - enp2s0 - enp2s1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option.

            # # Picks a network device using the selector.

            # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
            # deviceSelectors:
            #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
            #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
            #       driver: virtio # Kernel driver, supports matching by wildcard.

{{< /highlight >}}

Field Type Description Value(s)
interfaces []string The interfaces that make up the bond.
deviceSelectors []NetworkDeviceSelector
Picks a network device using the selector.Mutually exclusive with interfaces.
Supports partial match using wildcard syntax.
Show example(s){{< highlight yaml >}}
deviceSelectors: 
- busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
- hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
  driver: virtio # Kernel driver, supports matching by wildcard.

{{< /highlight >}} | | |arpIPTarget |[]string |

A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | |mode |string |
A bond option.Please see the official kernel documentation.
| | |xmitHashPolicy |string |
A bond option.Please see the official kernel documentation.
| | |lacpRate |string |
A bond option.Please see the official kernel documentation.
| | |adActorSystem |string |
A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | |arpValidate |string |
A bond option.Please see the official kernel documentation.
| | |arpAllTargets |string |
A bond option.Please see the official kernel documentation.
| | |primary |string |
A bond option.Please see the official kernel documentation.
| | |primaryReselect |string |
A bond option.Please see the official kernel documentation.
| | |failOverMac |string |
A bond option.Please see the official kernel documentation.
| | |adSelect |string |
A bond option.Please see the official kernel documentation.
| | |miimon |uint32 |
A bond option.Please see the official kernel documentation.
| | |updelay |uint32 |
A bond option.Please see the official kernel documentation.
| | |downdelay |uint32 |
A bond option.Please see the official kernel documentation.
| | |arpInterval |uint32 |
A bond option.Please see the official kernel documentation.
| | |resendIgmp |uint32 |
A bond option.Please see the official kernel documentation.
| | |minLinks |uint32 |
A bond option.Please see the official kernel documentation.
| | |lpInterval |uint32 |
A bond option.Please see the official kernel documentation.
| | |packetsPerSlave |uint32 |
A bond option.Please see the official kernel documentation.
| | |numPeerNotif |uint8 |
A bond option.Please see the official kernel documentation.
| | |tlbDynamicLb |uint8 |
A bond option.Please see the official kernel documentation.
| | |allSlavesActive |uint8 |
A bond option.Please see the official kernel documentation.
| | |useCarrier |bool |
A bond option.Please see the official kernel documentation.
| | |adActorSysPrio |uint16 |
A bond option.Please see the official kernel documentation.
| | |adUserPortKey |uint16 |
A bond option.Please see the official kernel documentation.
| | |peerNotifyDelay |uint32 |
A bond option.Please see the official kernel documentation.
| |

deviceSelectors[] {#Config.machine.network.interfaces..bond.deviceSelectors.}

NetworkDeviceSelector struct describes network device selector.

{{< highlight yaml >}} machine: network: interfaces: - bond: deviceSelectors: busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. {{< /highlight >}}

{{< highlight yaml >}} machine: network: interfaces: - bond: deviceSelectors: hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard. {{< /highlight >}}

{{< highlight yaml >}} machine: network: interfaces: - bond: deviceSelectors: - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard. {{< /highlight >}}

Field Type Description Value(s)
busPath string PCI, USB bus prefix, supports matching by wildcard.
hardwareAddr string Device hardware address, supports matching by wildcard.
pciID string PCI ID (vendor ID, product ID), supports matching by wildcard.
driver string Kernel driver, supports matching by wildcard.
bridge {#Config.machine.network.interfaces..bridge}

Bridge contains the various options for configuring a bridge interface.

{{< highlight yaml >}} machine: network: interfaces: - bridge: # The interfaces that make up the bridge. interfaces: - enxda4042ca9a51 - enxae2a6774c259 # A bridge option. stp: enabled: true # Whether Spanning Tree Protocol (STP) is enabled. {{< /highlight >}}

Field Type Description Value(s)
interfaces []string The interfaces that make up the bridge.
stp STP
A bridge option.Please see the official kernel documentation.
stp {#Config.machine.network.interfaces..bridge.stp}

STP contains the various options for configuring the STP properties of a bridge interface.

Field Type Description Value(s)
enabled bool Whether Spanning Tree Protocol (STP) is enabled.
vlans[] {#Config.machine.network.interfaces..vlans.}

Vlan represents vlan settings for a device.

Field Type Description Value(s)
addresses []string The addresses in CIDR notation or as plain IPs to use.
routes []Route A list of routes associated with the VLAN.
dhcp bool Indicates if DHCP should be used.
vlanId uint16 The VLAN's ID.
mtu uint32 The VLAN's MTU.
vip DeviceVIPConfig The VLAN's virtual IP address configuration.
dhcpOptions DHCPOptions
DHCP specific options.dhcp must be set to true for these to take effect.
routes[] {#Config.machine.network.interfaces..vlans..routes.}

Route represents a network route.

{{< highlight yaml >}} machine: network: interfaces: - vlans: - routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). {{< /highlight >}}

Field Type Description Value(s)
network string The route's network (destination).
gateway string The route's gateway (if empty, creates link scope route).
source string The route's source address (optional).
metric uint32 The optional metric for the route.
mtu uint32 The optional MTU for the route.
vip {#Config.machine.network.interfaces..vlans..vip}

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

{{< highlight yaml >}} machine: network: interfaces: - vlans: - vip: ip: 172.16.199.55 # Specifies the IP address to be used. {{< /highlight >}}

Field Type Description Value(s)
ip string Specifies the IP address to be used.
equinixMetal VIPEquinixMetalConfig Specifies the Equinix Metal API settings to assign VIP to the node.
hcloud VIPHCloudConfig Specifies the Hetzner Cloud API settings to assign VIP to the node.

####### equinixMetal {#Config.machine.network.interfaces..vlans..vip.equinixMetal}

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Field Type Description Value(s)
apiToken string Specifies the Equinix Metal API Token.

####### hcloud {#Config.machine.network.interfaces..vlans..vip.hcloud}

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Field Type Description Value(s)
apiToken string Specifies the Hetzner Cloud API Token.
dhcpOptions {#Config.machine.network.interfaces..vlans..dhcpOptions}

DHCPOptions contains options for configuring the DHCP settings for a given interface.

{{< highlight yaml >}} machine: network: interfaces: - vlans: - dhcpOptions: routeMetric: 1024 # The priority of all routes received via DHCP. {{< /highlight >}}

Field Type Description Value(s)
routeMetric uint32 The priority of all routes received via DHCP.
ipv4 bool Enables DHCPv4 protocol for the interface (default is enabled).
ipv6 bool Enables DHCPv6 protocol for the interface (default is disabled).
duidv6 string Set client DUID (hex string).
dhcpOptions {#Config.machine.network.interfaces..dhcpOptions}

DHCPOptions contains options for configuring the DHCP settings for a given interface.

{{< highlight yaml >}} machine: network: interfaces: - dhcpOptions: routeMetric: 1024 # The priority of all routes received via DHCP. {{< /highlight >}}

Field Type Description Value(s)
routeMetric uint32 The priority of all routes received via DHCP.
ipv4 bool Enables DHCPv4 protocol for the interface (default is enabled).
ipv6 bool Enables DHCPv6 protocol for the interface (default is disabled).
duidv6 string Set client DUID (hex string).
wireguard {#Config.machine.network.interfaces..wireguard}

DeviceWireguardConfig contains settings for configuring Wireguard network interface.

{{< highlight yaml >}} machine: network: interfaces: - wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port. # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}

{{< highlight yaml >}} machine: network: interfaces: - wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24 {{< /highlight >}}

Field Type Description Value(s)
privateKey string
Specifies a private key configuration (base64 encoded).Can be generated by wg genkey.
listenPort int Specifies a device's listening port.
firewallMark int Specifies a device's firewall mark.
peers []DeviceWireguardPeer Specifies a list of peer configurations to apply to a device.
peers[] {#Config.machine.network.interfaces..wireguard.peers.}

DeviceWireguardPeer a WireGuard device peer configuration.

Field Type Description Value(s)
publicKey string
Specifies the public key of this peer.Can be extracted from private key by running wg pubkey < private.key > public.key && cat public.key.
endpoint string Specifies the endpoint of this peer entry.
persistentKeepaliveInterval Duration
Specifies the persistent keepalive interval for this peer.Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
allowedIPs []string AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
vip {#Config.machine.network.interfaces..vip}

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

{{< highlight yaml >}} machine: network: interfaces: - vip: ip: 172.16.199.55 # Specifies the IP address to be used. {{< /highlight >}}

Field Type Description Value(s)
ip string Specifies the IP address to be used.
equinixMetal VIPEquinixMetalConfig Specifies the Equinix Metal API settings to assign VIP to the node.
hcloud VIPHCloudConfig Specifies the Hetzner Cloud API settings to assign VIP to the node.
equinixMetal {#Config.machine.network.interfaces..vip.equinixMetal}

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Field Type Description Value(s)
apiToken string Specifies the Equinix Metal API Token.
hcloud {#Config.machine.network.interfaces..vip.hcloud}

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Field Type Description Value(s)
apiToken string Specifies the Hetzner Cloud API Token.

extraHostEntries[] {#Config.machine.network.extraHostEntries.}

ExtraHost represents a host entry in /etc/hosts.

{{< highlight yaml >}} machine: network: extraHostEntries: - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld {{< /highlight >}}

Field Type Description Value(s)
ip string The IP of the host.
aliases []string The host alias.

kubespan {#Config.machine.network.kubespan}

NetworkKubeSpan struct describes KubeSpan configuration.

{{< highlight yaml >}} machine: network: kubespan: enabled: true # Enable the KubeSpan feature. {{< /highlight >}}

Field Type Description Value(s)
enabled bool
Enable the KubeSpan feature.Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
advertiseKubernetesNetworks bool
Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,
and KubeSpan handles the node-to-node traffic.
If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.
When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which
is not always the case with CNIs not relying on Kubernetes for IPAM.
allowDownPeerBypass bool
Skip sending traffic via KubeSpan if the peer connection state is not up.This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can't be established.
mtu uint32
KubeSpan link MTU size.Default value is 1420.
filters KubeSpanFilters
KubeSpan advanced filtering of network addresses .
Settings in this section are optional, and settings apply only to the node.
filters {#Config.machine.network.kubespan.filters}

KubeSpanFilters struct describes KubeSpan advanced network addresses filtering.

Field Type Description Value(s)
endpoints []string
Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.
By default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.

Default value: no filtering.
Show example(s){{< highlight yaml >}}
endpoints: 
- 0.0.0.0/0
- '!192.168.0.0/16'
- ::/0

{{< /highlight >}} | |

disks[] {#Config.machine.disks.}

MachineDisk represents the options available for partitioning, formatting, and mounting extra disks.

{{< highlight yaml >}} machine: disks: - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition.

          # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

          # # Human readable representation.
          # size: 100 MB
          # # Precise value in bytes.
          # size: 1073741824

{{< /highlight >}}

Field Type Description Value(s)
device string The name of the disk to use.
partitions []DiskPartition A list of partitions to create on the disk.

partitions[] {#Config.machine.disks..partitions.}

DiskPartition represents the options for a disk partition.

Field Type Description Value(s)
size DiskSize The size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}}
size: 100 MB
{{< /highlight >}}{{< highlight yaml >}}
size: 1073741824
{{< /highlight >}}
mountpoint string Where to mount the partition.

install {#Config.machine.install}

InstallConfig represents the installation options for preparing a node.

{{< highlight yaml >}} machine: install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time.

    # # Look up disk using disk attributes like model, size, serial and others.
    # diskSelector:
    #     size: 4GB # Disk size.
    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

    # # Allows for supplying additional system extension images to install on top of base Talos image.
    # extensions:
    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

{{< /highlight >}}

Field Type Description Value(s)
disk string The disk used for installations.
Show example(s){{< highlight yaml >}}
disk: /dev/sda
{{< /highlight >}}{{< highlight yaml >}}
disk: /dev/nvme0
{{< /highlight >}}
diskSelector InstallDiskSelector
Look up disk using disk attributes like model, size, serial and others.Always has priority over disk.
Show example(s){{< highlight yaml >}}
diskSelector: 
size: '>= 1TB' # Disk size.
model: WDC* # Disk model `/sys/block/<dev>/device/model`.

# # Disk bus path.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
# busPath: /pci0000:00/*

{{< /highlight >}} | | |extraKernelArgs |[]string |

Allows for supplying extra kernel args via the bootloader.Existing kernel args can be removed by prefixing the argument with a -.
For example -console removes all console=<value> arguments, whereas -console=tty0 removes the console=tty0 default argument.
Show example(s){{< highlight yaml >}} extraKernelArgs: - talos.platform=metal - reboot=k {{< /highlight >}}
| | |image |string |
Allows for supplying the image used to perform the installation.Image reference for each Talos release can be found on
GitHub releases page.
Show example(s){{< highlight yaml >}} image: ghcr.io/siderolabs/installer:latest {{< /highlight >}}
| | |extensions |[]InstallExtensionConfig |Allows for supplying additional system extension images to install on top of base Talos image.
Show example(s){{< highlight yaml >}} extensions: - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. {{< /highlight >}}
| | |wipe |bool |
Indicates if the installation disk should be wiped at installation time.Defaults to true.
|true
yes
false
no
| |legacyBIOSSupport |bool |
Indicates if MBR partition should be marked as bootable (active).Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.
| |

diskSelector {#Config.machine.install.diskSelector}

InstallDiskSelector represents a disk query parameters for the install disk lookup.

{{< highlight yaml >}} machine: install: diskSelector: size: '>= 1TB' # Disk size. model: WDC* # Disk model /sys/block/<dev>/device/model.

        # # Disk bus path.
        # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
        # busPath: /pci0000:00/*

{{< /highlight >}}

Field Type Description Value(s)
size InstallDiskSizeMatcher Disk size.
Show example(s){{< highlight yaml >}}
size: 4GB
{{< /highlight >}}{{< highlight yaml >}}
size: '> 1TB'
{{< /highlight >}}{{< highlight yaml >}}
size: <= 2TB
{{< /highlight >}}
name string Disk name /sys/block/<dev>/device/name.
model string Disk model /sys/block/<dev>/device/model.
serial string Disk serial number /sys/block/<dev>/serial.
modalias string Disk modalias /sys/block/<dev>/device/modalias.
uuid string Disk UUID /sys/block/<dev>/uuid.
wwid string Disk WWID /sys/block/<dev>/wwid.
type InstallDiskType Disk Type. ssd
hdd
nvme
sd
busPath string Disk bus path.
Show example(s){{< highlight yaml >}}
busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0
{{< /highlight >}}{{< highlight yaml >}}
busPath: /pci0000:00/*
{{< /highlight >}}

extensions[] {#Config.machine.install.extensions.}

InstallExtensionConfig represents a configuration for a system extension.

{{< highlight yaml >}} machine: install: extensions: - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image. {{< /highlight >}}

Field Type Description Value(s)
image string System extension image.

files[] {#Config.machine.files.}

MachineFile represents a file to write to disk.

{{< highlight yaml >}} machine: files: - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use {{< /highlight >}}

Field Type Description Value(s)
content string The contents of the file.
permissions FileMode The file's permissions in octal.
path string The path of the file.
op string The operation to use create
append
overwrite

time {#Config.machine.time}

TimeConfig represents the options for configuring time on a machine.

{{< highlight yaml >}} machine: time: disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. {{< /highlight >}}

Field Type Description Value(s)
disabled bool
Indicates if the time service is disabled for the machine.Defaults to false.
servers []string
Specifies time (NTP) servers to use for setting the system time.Defaults to pool.ntp.org
bootTimeout Duration
Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.NTP sync will be still running in the background.
Defaults to "infinity" (waiting forever for time sync)

registries {#Config.machine.registries}

RegistriesConfig represents the image pull options.

{{< highlight yaml >}} machine: registries: # Specifies mirror configuration for each registry host namespace. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

Field Type Description Value(s)
mirrors map[string]RegistryMirrorConfig
Specifies mirror configuration for each registry host namespace.This setting allows to configure local pull-through caching registires,
air-gapped installations, etc.

For example, when pulling an image with the reference example.com:123/image:v1,
the example.com:123 key will be used to lookup the mirror configuration.

Optionally the * key can be used to configure a fallback mirror.

Registry name is the first segment of image identifier, with 'docker.io'
being default one.
Show example(s){{< highlight yaml >}}
mirrors: 
ghcr.io:
    # List of endpoints (URLs) for registry mirrors to use.
    endpoints:
        - https://registry.insecure
        - https://ghcr.io/v2/

{{< /highlight >}} | | |config |map[string]RegistryConfig |

Specifies TLS & auth configuration for HTTPS image registries.Mutual TLS can be enabled with 'clientIdentity' option.

The full hostname and port (if not using a default port 443)
should be used as the key.
The fallback key * can't be used for TLS configuration.

TLS configuration can be skipped if registry has trusted
server certificate.
Show example(s){{< highlight yaml >}} config: registry.insecure: # The TLS configuration for the registry. tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

        # # Enable mutual TLS authentication with the registry.
        # clientIdentity:
        #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
        #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

    # # The auth configuration for this registry.
    # auth:
    #     username: username # Optional registry authentication.
    #     password: password # Optional registry authentication.

{{< /highlight >}}

| |

mirrors.* {#Config.machine.registries.mirrors.-}

RegistryMirrorConfig represents mirror configuration for a registry.

{{< highlight yaml >}} machine: registries: mirrors: ghcr.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.insecure - https://ghcr.io/v2/ {{< /highlight >}}

Field Type Description Value(s)
endpoints []string
List of endpoints (URLs) for registry mirrors to use.Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to /v2).
overridePath bool
Use the exact path specified for the endpoint (don't append /v2/).This setting is often required for setting up multiple mirrors
on a single instance of a registry.

config.* {#Config.machine.registries.config.-}

RegistryConfig specifies auth & TLS config per registry.

{{< highlight yaml >}} machine: registries: config: registry.insecure: # The TLS configuration for the registry. tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                # # Enable mutual TLS authentication with the registry.
                # clientIdentity:
                #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

            # # The auth configuration for this registry.
            # auth:
            #     username: username # Optional registry authentication.
            #     password: password # Optional registry authentication.

{{< /highlight >}}

Field Type Description Value(s)
tls RegistryTLSConfig The TLS configuration for the registry.
Show example(s){{< highlight yaml >}}
tls: 
# Enable mutual TLS authentication with the registry.
clientIdentity:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}}{{< highlight yaml >}} tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

# # Enable mutual TLS authentication with the registry.
# clientIdentity:
#     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
#     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}} | | |auth |RegistryAuthConfig |

The auth configuration for this registry.Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.
Show example(s){{< highlight yaml >}} auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}
| |

tls {#Config.machine.registries.config.-.tls}

RegistryTLSConfig specifies TLS config for HTTPS registries.

{{< highlight yaml >}} machine: registries: config: example.com: tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== {{< /highlight >}}

{{< highlight yaml >}} machine: registries: config: example.com: tls: insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

                # # Enable mutual TLS authentication with the registry.
                # clientIdentity:
                #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}}

Field Type Description Value(s)
clientIdentity PEMEncodedCertificateAndKey
Enable mutual TLS authentication with the registry.Client certificate and key should be base64-encoded.
Show example(s){{< highlight yaml >}}
clientIdentity: 
crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}} | | |ca |Base64Bytes |

CA registry certificate to add the list of trusted certificates.Certificate should be base64-encoded.
| | |insecureSkipVerify |bool |Skip TLS server certificate verification (not recommended). | |

auth {#Config.machine.registries.config.-.auth}

RegistryAuthConfig specifies authentication configuration for a registry.

{{< highlight yaml >}} machine: registries: config: example.com: auth: username: username # Optional registry authentication. password: password # Optional registry authentication. {{< /highlight >}}

Field Type Description Value(s)
username string
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
password string
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
auth string
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
identityToken string
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.

systemDiskEncryption {#Config.machine.systemDiskEncryption}

SystemDiskEncryptionConfig specifies system disk partitions encryption settings.

{{< highlight yaml >}} machine: systemDiskEncryption: # Ephemeral partition encryption. ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption.

              # # KMS managed encryption key.
              # kms:
              #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

        # # Cipher kind to use for the encryption. Depends on the encryption provider.
        # cipher: aes-xts-plain64

        # # Defines the encryption sector size.
        # blockSize: 4096

        # # Additional --perf parameters for the LUKS2 encryption.
        # options:
        #     - no_read_workqueue
        #     - no_write_workqueue

{{< /highlight >}}

Field Type Description Value(s)
state EncryptionConfig State partition encryption.
ephemeral EncryptionConfig Ephemeral partition encryption.

state {#Config.machine.systemDiskEncryption.state}

EncryptionConfig represents partition encryption settings.

Field Type Description Value(s)
provider string Encryption provider to use for the encryption.
Show example(s){{< highlight yaml >}}
provider: luks2
{{< /highlight >}}
keys []EncryptionKey Defines the encryption keys generation and storage method.
cipher string Cipher kind to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}}
cipher: aes-xts-plain64
{{< /highlight >}} aes-xts-plain64
xchacha12,aes-adiantum-plain64
xchacha20,aes-adiantum-plain64
keySize uint Defines the encryption key length.
blockSize uint64 Defines the encryption sector size.
Show example(s){{< highlight yaml >}}
blockSize: 4096
{{< /highlight >}}
options []string Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}}
options: 
- no_read_workqueue
- no_write_workqueue

{{< /highlight >}} |no_read_workqueue
no_write_workqueue
same_cpu_crypt
|

keys[] {#Config.machine.systemDiskEncryption.state.keys.}

EncryptionKey represents configuration for disk encryption key.

Field Type Description Value(s)
static EncryptionKeyStatic Key which value is stored in the configuration file.
nodeID EncryptionKeyNodeID Deterministically generated key from the node UUID and PartitionLabel.
kms EncryptionKeyKMS KMS managed encryption key.
Show example(s){{< highlight yaml >}}
kms: 
endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

{{< /highlight >}} | | |slot |int |Key slot number for LUKS2 encryption. | | |tpm |EncryptionKeyTPM |Enable TPM based disk encryption. | |

static {#Config.machine.systemDiskEncryption.state.keys..static}

EncryptionKeyStatic represents throw away key type.

Field Type Description Value(s)
passphrase string Defines the static passphrase value.
nodeID {#Config.machine.systemDiskEncryption.state.keys..nodeID}

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms {#Config.machine.systemDiskEncryption.state.keys..kms}

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

{{< highlight yaml >}} machine: systemDiskEncryption: state: keys: - kms: endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. {{< /highlight >}}

Field Type Description Value(s)
endpoint string KMS endpoint to Seal/Unseal the key.
tpm {#Config.machine.systemDiskEncryption.state.keys..tpm}

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

ephemeral {#Config.machine.systemDiskEncryption.ephemeral}

EncryptionConfig represents partition encryption settings.

Field Type Description Value(s)
provider string Encryption provider to use for the encryption.
Show example(s){{< highlight yaml >}}
provider: luks2
{{< /highlight >}}
keys []EncryptionKey Defines the encryption keys generation and storage method.
cipher string Cipher kind to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}}
cipher: aes-xts-plain64
{{< /highlight >}} aes-xts-plain64
xchacha12,aes-adiantum-plain64
xchacha20,aes-adiantum-plain64
keySize uint Defines the encryption key length.
blockSize uint64 Defines the encryption sector size.
Show example(s){{< highlight yaml >}}
blockSize: 4096
{{< /highlight >}}
options []string Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}}
options: 
- no_read_workqueue
- no_write_workqueue

{{< /highlight >}} |no_read_workqueue
no_write_workqueue
same_cpu_crypt
|

keys[] {#Config.machine.systemDiskEncryption.ephemeral.keys.}

EncryptionKey represents configuration for disk encryption key.

Field Type Description Value(s)
static EncryptionKeyStatic Key which value is stored in the configuration file.
nodeID EncryptionKeyNodeID Deterministically generated key from the node UUID and PartitionLabel.
kms EncryptionKeyKMS KMS managed encryption key.
Show example(s){{< highlight yaml >}}
kms: 
endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.

{{< /highlight >}} | | |slot |int |Key slot number for LUKS2 encryption. | | |tpm |EncryptionKeyTPM |Enable TPM based disk encryption. | |

static {#Config.machine.systemDiskEncryption.ephemeral.keys..static}

EncryptionKeyStatic represents throw away key type.

Field Type Description Value(s)
passphrase string Defines the static passphrase value.
nodeID {#Config.machine.systemDiskEncryption.ephemeral.keys..nodeID}

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

kms {#Config.machine.systemDiskEncryption.ephemeral.keys..kms}

EncryptionKeyKMS represents a key that is generated and then sealed/unsealed by the KMS server.

{{< highlight yaml >}} machine: systemDiskEncryption: ephemeral: keys: - kms: endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. {{< /highlight >}}

Field Type Description Value(s)
endpoint string KMS endpoint to Seal/Unseal the key.
tpm {#Config.machine.systemDiskEncryption.ephemeral.keys..tpm}

EncryptionKeyTPM represents a key that is generated and then sealed/unsealed by the TPM.

features {#Config.machine.features}

FeaturesConfig describes individual Talos features that can be switched on or off.

{{< highlight yaml >}} machine: features: rbac: true # Enable role-based access control (RBAC).

    # # Configure Talos API access from Kubernetes pods.
    # kubernetesTalosAPIAccess:
    #     enabled: true # Enable Talos API access from Kubernetes pods.
    #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
    #     allowedRoles:
    #         - os:reader
    #     # The list of Kubernetes namespaces Talos API access is available from.
    #     allowedKubernetesNamespaces:
    #         - kube-system

{{< /highlight >}}

Field Type Description Value(s)
rbac bool Enable role-based access control (RBAC).
stableHostname bool Enable stable default hostname.
kubernetesTalosAPIAccess KubernetesTalosAPIAccessConfig
Configure Talos API access from Kubernetes pods.
This feature is disabled if the feature config is not specified.
Show example(s){{< highlight yaml >}}
kubernetesTalosAPIAccess: 
enabled: true # Enable Talos API access from Kubernetes pods.
# The list of Talos API roles which can be granted for access from Kubernetes pods.
allowedRoles:
    - os:reader
# The list of Kubernetes namespaces Talos API access is available from.
allowedKubernetesNamespaces:
    - kube-system

{{< /highlight >}} | | |apidCheckExtKeyUsage |bool |Enable checks for extended key usage of client certificates in apid. | | |diskQuotaSupport |bool |

Enable XFS project quota support for EPHEMERAL partition and user disks.Also enables kubelet tracking of ephemeral disk usage in the kubelet via quota.
| | |kubePrism |KubePrism |
KubePrism - local proxy/load balancer on defined port that will distributerequests to all API servers in the cluster.
| |

kubernetesTalosAPIAccess {#Config.machine.features.kubernetesTalosAPIAccess}

KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods.

{{< highlight yaml >}} machine: features: kubernetesTalosAPIAccess: enabled: true # Enable Talos API access from Kubernetes pods. # The list of Talos API roles which can be granted for access from Kubernetes pods. allowedRoles: - os:reader # The list of Kubernetes namespaces Talos API access is available from. allowedKubernetesNamespaces: - kube-system {{< /highlight >}}

Field Type Description Value(s)
enabled bool Enable Talos API access from Kubernetes pods.
allowedRoles []string
The list of Talos API roles which can be granted for access from Kubernetes pods.
Empty list means that no roles can be granted, so access is blocked.
allowedKubernetesNamespaces []string The list of Kubernetes namespaces Talos API access is available from.

kubePrism {#Config.machine.features.kubePrism}

KubePrism describes the configuration for the KubePrism load balancer.

Field Type Description Value(s)
enabled bool Enable KubePrism support - will start local load balacing proxy.
port int KubePrism port.

udev {#Config.machine.udev}

UdevConfig describes how the udev system should be configured.

{{< highlight yaml >}} machine: udev: # List of udev rules to apply to the udev system rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" {{< /highlight >}}

Field Type Description Value(s)
rules []string List of udev rules to apply to the udev system

logging {#Config.machine.logging}

LoggingConfig struct configures Talos logging.

{{< highlight yaml >}} machine: logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format. {{< /highlight >}}

Field Type Description Value(s)
destinations []LoggingDestination Logging destination.

destinations[] {#Config.machine.logging.destinations.}

LoggingDestination struct configures Talos logging destination.

Field Type Description Value(s)
endpoint Endpoint Where to send logs. Supported protocols are "tcp" and "udp".
Show example(s){{< highlight yaml >}}
endpoint: udp://127.0.0.1:12345
{{< /highlight >}}{{< highlight yaml >}}
endpoint: tcp://1.2.3.4:12345
{{< /highlight >}}
format string Logs format. json_lines
endpoint {#Config.machine.logging.destinations..endpoint}

Endpoint represents the endpoint URL parsed out of the machine config.

{{< highlight yaml >}} machine: logging: destinations: - endpoint: https://1.2.3.4:6443 {{< /highlight >}}

{{< highlight yaml >}} machine: logging: destinations: - endpoint: https://cluster1.internal:6443 {{< /highlight >}}

{{< highlight yaml >}} machine: logging: destinations: - endpoint: udp://127.0.0.1:12345 {{< /highlight >}}

{{< highlight yaml >}} machine: logging: destinations: - endpoint: tcp://1.2.3.4:12345 {{< /highlight >}}

Field Type Description Value(s)

kernel {#Config.machine.kernel}

KernelConfig struct configures Talos Linux kernel.

{{< highlight yaml >}} machine: kernel: # Kernel modules to load. modules: - name: brtfs # Module name. {{< /highlight >}}

Field Type Description Value(s)
modules []KernelModuleConfig Kernel modules to load.

modules[] {#Config.machine.kernel.modules.}

KernelModuleConfig struct configures Linux kernel modules to load.

Field Type Description Value(s)
name string Module name.
parameters []string Module parameters, changes applied after reboot.

seccompProfiles[] {#Config.machine.seccompProfiles.}

MachineSeccompProfile defines seccomp profiles for the machine.

{{< highlight yaml >}} machine: seccompProfiles: - name: audit.json # The name field is used to provide the file name of the seccomp profile. # The value field is used to provide the seccomp profile. value: defaultAction: SCMP_ACT_LOG {{< /highlight >}}

Field Type Description Value(s)
name string The name field is used to provide the file name of the seccomp profile.
value Unstructured The value field is used to provide the seccomp profile.

cluster {#Config.cluster}

ClusterConfig represents the cluster-wide config values.

{{< highlight yaml >}} cluster: # ControlPlaneConfig represents the control plane configuration options. controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. clusterName: talos.local # ClusterNetworkConfig represents kube networking configuration options. network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}

Field Type Description Value(s)
id string Globally unique identifier for this cluster (base64 encoded random 32 bytes).
secret string
Shared secret of cluster (base64 encoded random 32 bytes).This secret is shared among cluster members but should never be sent over the network.
controlPlane ControlPlaneConfig Provides control plane specific configuration options.
Show example(s){{< highlight yaml >}}
controlPlane: 
endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.

{{< /highlight >}} | | |clusterName |string |Configures the cluster's name. | | |network |ClusterNetworkConfig |Provides cluster specific network configuration options.

Show example(s){{< highlight yaml >}} network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}
| | |token |string |The bootstrap token used to join the cluster.
Show example(s){{< highlight yaml >}} token: wlzjyw.bei2zfylhs2by0wd {{< /highlight >}}
| | |aescbcEncryptionSecret |string |
A key used for the encryption of secret data at rest.Enables encryption with AESCBC.
Show example(s){{< highlight yaml >}} aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= {{< /highlight >}}
| | |secretboxEncryptionSecret |string |
A key used for the encryption of secret data at rest.Enables encryption with secretbox.
Secretbox has precedence over AESCBC.
Show example(s){{< highlight yaml >}} secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= {{< /highlight >}}
| | |ca |PEMEncodedCertificateAndKey |The base64 encoded root certificate authority used by Kubernetes.
Show example(s){{< highlight yaml >}} ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== {{< /highlight >}}
| | |aggregatorCA |PEMEncodedCertificateAndKey |
The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.
Show example(s){{< highlight yaml >}} aggregatorCA: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== {{< /highlight >}}
| | |serviceAccount |PEMEncodedKey |The base64 encoded private key for service account token generation.
Show example(s){{< highlight yaml >}} serviceAccount: key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== {{< /highlight >}}
| | |apiServer |APIServerConfig |API server specific configuration options.
Show example(s){{< highlight yaml >}} apiServer: image: registry.k8s.io/kube-apiserver:v1.29.0-rc.2 # The container image used in the API server manifest. # Extra arguments to supply to the API server. extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32" # Extra certificate subject alternative names for the API server's certificate. certSANs: - 1.2.3.4 - 4.5.6.7

# # Configure the API server admission plugins.
# admissionControl:
#     - name: PodSecurity # Name is the name of the admission controller.
#       # Configuration is an embedded configuration object to be used as the plugin's
#       configuration:
#         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
#         defaults:
#             audit: restricted
#             audit-version: latest
#             enforce: baseline
#             enforce-version: latest
#             warn: restricted
#             warn-version: latest
#         exemptions:
#             namespaces:
#                 - kube-system
#             runtimeClasses: []
#             usernames: []
#         kind: PodSecurityConfiguration

# # Configure the API server audit policy.
# auditPolicy:
#     apiVersion: audit.k8s.io/v1
#     kind: Policy
#     rules:
#         - level: Metadata

{{< /highlight >}}

| | |controllerManager |ControllerManagerConfig |Controller manager server specific configuration options.
Show example(s){{< highlight yaml >}} controllerManager: image: registry.k8s.io/kube-controller-manager:v1.29.0-rc.2 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true {{< /highlight >}}
| | |proxy |ProxyConfig |Kube-proxy server-specific configuration options
Show example(s){{< highlight yaml >}} proxy: image: registry.k8s.io/kube-proxy:v1.29.0-rc.2 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables

# # Disable kube-proxy deployment on cluster bootstrap.
# disabled: false

{{< /highlight >}}

| | |scheduler |SchedulerConfig |Scheduler server specific configuration options.
Show example(s){{< highlight yaml >}} scheduler: image: registry.k8s.io/kube-scheduler:v1.29.0-rc.2 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true {{< /highlight >}}
| | |discovery |ClusterDiscoveryConfig |Configures cluster member discovery.
Show example(s){{< highlight yaml >}} discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint. {{< /highlight >}}
| | |etcd |EtcdConfig |Etcd specific configuration options.
Show example(s){{< highlight yaml >}} etcd: image: gcr.io/etcd-development/etcd:v3.5.11 # The container image used to create the etcd service. # The ca is the root certificate authority of the PKI. ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000"

# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
#     - 10.0.0.0/8

{{< /highlight >}}

| | |coreDNS |CoreDNS |Core DNS specific configuration options.
Show example(s){{< highlight yaml >}} coreDNS: image: registry.k8s.io/coredns/coredns:v1.11.1 # The image field is an override to the default coredns image. {{< /highlight >}}
| | |externalCloudProvider |ExternalCloudProviderConfig |External cloud provider configuration.
Show example(s){{< highlight yaml >}} externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}
| | |extraManifests |[]string |
A list of urls that point to additional manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} extraManifests: - https://www.example.com/manifest1.yaml - https://www.example.com/manifest2.yaml {{< /highlight >}}
| | |extraManifestHeaders |map[string]string |A map of key value pairs that will be added while fetching the extraManifests.
Show example(s){{< highlight yaml >}} extraManifestHeaders: Token: "1234567" X-ExtraInfo: info {{< /highlight >}}
| | |inlineManifests |[]ClusterInlineManifest |
A list of inline Kubernetes manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} inlineManifests: - name: namespace-ci # Name of the manifest. contents: |- # Manifest contents as a string. apiVersion: v1 kind: Namespace metadata: name: ci {{< /highlight >}}
| | |adminKubeconfig |AdminKubeconfigConfig |
Settings for admin kubeconfig generation.Certificate lifetime can be configured.
Show example(s){{< highlight yaml >}} adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}
| | |allowSchedulingOnControlPlanes |bool |Allows running workload on control-plane nodes.
Show example(s){{< highlight yaml >}} allowSchedulingOnControlPlanes: true {{< /highlight >}}
|true
yes
false
no
|

controlPlane {#Config.cluster.controlPlane}

ControlPlaneConfig represents the control plane configuration options.

{{< highlight yaml >}} cluster: controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally. {{< /highlight >}}

Field Type Description Value(s)
endpoint Endpoint
Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.It is single-valued, and may optionally include a port number.
Show example(s){{< highlight yaml >}}
endpoint: https://1.2.3.4:6443
{{< /highlight >}}{{< highlight yaml >}}
endpoint: https://cluster1.internal:6443
{{< /highlight >}}
localAPIServerPort int
The port that the API server listens on internally.This may be different than the port portion listed in the endpoint field above.
The default is 6443.

endpoint {#Config.cluster.controlPlane.endpoint}

Endpoint represents the endpoint URL parsed out of the machine config.

{{< highlight yaml >}} cluster: controlPlane: endpoint: https://1.2.3.4:6443 {{< /highlight >}}

{{< highlight yaml >}} cluster: controlPlane: endpoint: https://cluster1.internal:6443 {{< /highlight >}}

{{< highlight yaml >}} cluster: controlPlane: endpoint: udp://127.0.0.1:12345 {{< /highlight >}}

{{< highlight yaml >}} cluster: controlPlane: endpoint: tcp://1.2.3.4:12345 {{< /highlight >}}

Field Type Description Value(s)

network {#Config.cluster.network}

ClusterNetworkConfig represents kube networking configuration options.

{{< highlight yaml >}} cluster: network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}

Field Type Description Value(s)
cni CNIConfig
The CNI used.Composed of "name" and "urls".
The "name" key supports the following options: "flannel", "custom", and "none".
"flannel" uses Talos-managed Flannel CNI, and that's the default option.
"custom" uses custom manifests that should be provided in "urls".
"none" indicates that Talos will not manage any CNI installation.
Show example(s){{< highlight yaml >}}
cni: 
name: custom # Name of CNI to use.
# URLs containing manifests to apply for the CNI.
urls:
    - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml

{{< /highlight >}} | | |dnsDomain |string |

The domain used by Kubernetes DNS.The default is cluster.local
Show example(s){{< highlight yaml >}} dnsDomain: cluser.local {{< /highlight >}}
| | |podSubnets |[]string |The pod subnet CIDR.
Show example(s){{< highlight yaml >}} podSubnets: - 10.244.0.0/16 {{< /highlight >}}
| | |serviceSubnets |[]string |The service subnet CIDR.
Show example(s){{< highlight yaml >}} serviceSubnets: - 10.96.0.0/12 {{< /highlight >}}
| |

cni {#Config.cluster.network.cni}

CNIConfig represents the CNI configuration options.

{{< highlight yaml >}} cluster: network: cni: name: custom # Name of CNI to use. # URLs containing manifests to apply for the CNI. urls: - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml {{< /highlight >}}

Field Type Description Value(s)
name string Name of CNI to use. flannel
custom
none
urls []string
URLs containing manifests to apply for the CNI.Should be present for "custom", must be empty for "flannel" and "none".
flannel FlannelCNIConfig
description:
 Flannel configuration options.
flannel {#Config.cluster.network.cni.flannel}

FlannelCNIConfig represents the Flannel CNI configuration options.

Field Type Description Value(s)
extraArgs []string Extra arguments for 'flanneld'.
Show example(s){{< highlight yaml >}}
extraArgs: 
- --iface-can-reach=192.168.1.1

{{< /highlight >}} | |

apiServer {#Config.cluster.apiServer}

APIServerConfig represents the kube apiserver configuration options.

{{< highlight yaml >}} cluster: apiServer: image: registry.k8s.io/kube-apiserver:v1.29.0-rc.2 # The container image used in the API server manifest. # Extra arguments to supply to the API server. extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32" # Extra certificate subject alternative names for the API server's certificate. certSANs: - 1.2.3.4 - 4.5.6.7

    # # Configure the API server admission plugins.
    # admissionControl:
    #     - name: PodSecurity # Name is the name of the admission controller.
    #       # Configuration is an embedded configuration object to be used as the plugin's
    #       configuration:
    #         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
    #         defaults:
    #             audit: restricted
    #             audit-version: latest
    #             enforce: baseline
    #             enforce-version: latest
    #             warn: restricted
    #             warn-version: latest
    #         exemptions:
    #             namespaces:
    #                 - kube-system
    #             runtimeClasses: []
    #             usernames: []
    #         kind: PodSecurityConfiguration

    # # Configure the API server audit policy.
    # auditPolicy:
    #     apiVersion: audit.k8s.io/v1
    #     kind: Policy
    #     rules:
    #         - level: Metadata

{{< /highlight >}}

Field Type Description Value(s)
image string The container image used in the API server manifest.
Show example(s){{< highlight yaml >}}
image: registry.k8s.io/kube-apiserver:v1.29.0-rc.2
{{< /highlight >}}
extraArgs map[string]string Extra arguments to supply to the API server.
extraVolumes []VolumeMountConfig Extra volumes to mount to the API server static pod.
env Env The env field allows for the addition of environment variables for the control plane component.
certSANs []string Extra certificate subject alternative names for the API server's certificate.
disablePodSecurityPolicy bool Disable PodSecurityPolicy in the API server and default manifests.
admissionControl []AdmissionPluginConfig Configure the API server admission plugins.
Show example(s){{< highlight yaml >}}
admissionControl: 
- name: PodSecurity # Name is the name of the admission controller.
  # Configuration is an embedded configuration object to be used as the plugin's
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1alpha1
    defaults:
        audit: restricted
        audit-version: latest
        enforce: baseline
        enforce-version: latest
        warn: restricted
        warn-version: latest
    exemptions:
        namespaces:
            - kube-system
        runtimeClasses: []
        usernames: []
    kind: PodSecurityConfiguration

{{< /highlight >}} | | |auditPolicy |Unstructured |Configure the API server audit policy.

Show example(s){{< highlight yaml >}} auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata {{< /highlight >}}
| | |resources |ResourcesConfig |Configure the API server resources. | |

extraVolumes[] {#Config.cluster.apiServer.extraVolumes.}

VolumeMountConfig struct describes extra volume mount for the static pods.

Field Type Description Value(s)
hostPath string Path on the host.
Show example(s){{< highlight yaml >}}
hostPath: /var/lib/auth
{{< /highlight >}}
mountPath string Path in the container.
Show example(s){{< highlight yaml >}}
mountPath: /etc/kubernetes/auth
{{< /highlight >}}
readonly bool Mount the volume read only.
Show example(s){{< highlight yaml >}}
readonly: true
{{< /highlight >}}

admissionControl[] {#Config.cluster.apiServer.admissionControl.}

AdmissionPluginConfig represents the API server admission plugin configuration.

{{< highlight yaml >}} cluster: apiServer: admissionControl: - name: PodSecurity # Name is the name of the admission controller. # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration {{< /highlight >}}

Field Type Description Value(s)
name string
Name is the name of the admission controller.It must match the registered admission plugin name.
configuration Unstructured
Configuration is an embedded configuration object to be used as the plugin'sconfiguration.

resources {#Config.cluster.apiServer.resources}

ResourcesConfig represents the pod resources.

Field Type Description Value(s)
requests Unstructured Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}}
requests: 
cpu: 1
memory: 1Gi

{{< /highlight >}} | | |limits |Unstructured |Limits configures the maximum cpu/memory resources a container can use.

Show example(s){{< highlight yaml >}} limits: cpu: 2 memory: 2500Mi {{< /highlight >}}
| |

controllerManager {#Config.cluster.controllerManager}

ControllerManagerConfig represents the kube controller manager configuration options.

{{< highlight yaml >}} cluster: controllerManager: image: registry.k8s.io/kube-controller-manager:v1.29.0-rc.2 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true {{< /highlight >}}

Field Type Description Value(s)
image string The container image used in the controller manager manifest.
Show example(s){{< highlight yaml >}}
image: registry.k8s.io/kube-controller-manager:v1.29.0-rc.2
{{< /highlight >}}
extraArgs map[string]string Extra arguments to supply to the controller manager.
extraVolumes []VolumeMountConfig Extra volumes to mount to the controller manager static pod.
env Env The env field allows for the addition of environment variables for the control plane component.
resources ResourcesConfig Configure the controller manager resources.

extraVolumes[] {#Config.cluster.controllerManager.extraVolumes.}

VolumeMountConfig struct describes extra volume mount for the static pods.

Field Type Description Value(s)
hostPath string Path on the host.
Show example(s){{< highlight yaml >}}
hostPath: /var/lib/auth
{{< /highlight >}}
mountPath string Path in the container.
Show example(s){{< highlight yaml >}}
mountPath: /etc/kubernetes/auth
{{< /highlight >}}
readonly bool Mount the volume read only.
Show example(s){{< highlight yaml >}}
readonly: true
{{< /highlight >}}

resources {#Config.cluster.controllerManager.resources}

ResourcesConfig represents the pod resources.

Field Type Description Value(s)
requests Unstructured Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}}
requests: 
cpu: 1
memory: 1Gi

{{< /highlight >}} | | |limits |Unstructured |Limits configures the maximum cpu/memory resources a container can use.

Show example(s){{< highlight yaml >}} limits: cpu: 2 memory: 2500Mi {{< /highlight >}}
| |

proxy {#Config.cluster.proxy}

ProxyConfig represents the kube proxy configuration options.

{{< highlight yaml >}} cluster: proxy: image: registry.k8s.io/kube-proxy:v1.29.0-rc.2 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables

    # # Disable kube-proxy deployment on cluster bootstrap.
    # disabled: false

{{< /highlight >}}

Field Type Description Value(s)
disabled bool Disable kube-proxy deployment on cluster bootstrap.
Show example(s){{< highlight yaml >}}
disabled: false
{{< /highlight >}}
image string The container image used in the kube-proxy manifest.
Show example(s){{< highlight yaml >}}
image: registry.k8s.io/kube-proxy:v1.29.0-rc.2
{{< /highlight >}}
mode string
proxy mode of kube-proxy.The default is 'iptables'.
extraArgs map[string]string Extra arguments to supply to kube-proxy.

scheduler {#Config.cluster.scheduler}

SchedulerConfig represents the kube scheduler configuration options.

{{< highlight yaml >}} cluster: scheduler: image: registry.k8s.io/kube-scheduler:v1.29.0-rc.2 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true {{< /highlight >}}

Field Type Description Value(s)
image string The container image used in the scheduler manifest.
Show example(s){{< highlight yaml >}}
image: registry.k8s.io/kube-scheduler:v1.29.0-rc.2
{{< /highlight >}}
extraArgs map[string]string Extra arguments to supply to the scheduler.
extraVolumes []VolumeMountConfig Extra volumes to mount to the scheduler static pod.
env Env The env field allows for the addition of environment variables for the control plane component.
resources ResourcesConfig Configure the scheduler resources.
config Unstructured Specify custom kube-scheduler configuration.

extraVolumes[] {#Config.cluster.scheduler.extraVolumes.}

VolumeMountConfig struct describes extra volume mount for the static pods.

Field Type Description Value(s)
hostPath string Path on the host.
Show example(s){{< highlight yaml >}}
hostPath: /var/lib/auth
{{< /highlight >}}
mountPath string Path in the container.
Show example(s){{< highlight yaml >}}
mountPath: /etc/kubernetes/auth
{{< /highlight >}}
readonly bool Mount the volume read only.
Show example(s){{< highlight yaml >}}
readonly: true
{{< /highlight >}}

resources {#Config.cluster.scheduler.resources}

ResourcesConfig represents the pod resources.

Field Type Description Value(s)
requests Unstructured Requests configures the reserved cpu/memory resources.
Show example(s){{< highlight yaml >}}
requests: 
cpu: 1
memory: 1Gi

{{< /highlight >}} | | |limits |Unstructured |Limits configures the maximum cpu/memory resources a container can use.

Show example(s){{< highlight yaml >}} limits: cpu: 2 memory: 2500Mi {{< /highlight >}}
| |

discovery {#Config.cluster.discovery}

ClusterDiscoveryConfig struct configures cluster membership discovery.

{{< highlight yaml >}} cluster: discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint. {{< /highlight >}}

Field Type Description Value(s)
enabled bool
Enable the cluster membership discovery feature.Cluster discovery is based on individual registries which are configured under the registries field.
registries DiscoveryRegistriesConfig Configure registries used for cluster member discovery.

registries {#Config.cluster.discovery.registries}

DiscoveryRegistriesConfig struct configures cluster membership discovery.

Field Type Description Value(s)
kubernetes RegistryKubernetesConfig
Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional informationas annotations on the Node resources.
service RegistryServiceConfig Service registry is using an external service to push and pull information about cluster members.
kubernetes {#Config.cluster.discovery.registries.kubernetes}

RegistryKubernetesConfig struct configures Kubernetes discovery registry.

Field Type Description Value(s)
disabled bool Disable Kubernetes discovery registry.
service {#Config.cluster.discovery.registries.service}

RegistryServiceConfig struct configures Kubernetes discovery registry.

Field Type Description Value(s)
disabled bool Disable external service discovery registry.
endpoint string External service endpoint.
Show example(s){{< highlight yaml >}}
endpoint: https://discovery.talos.dev/
{{< /highlight >}}

etcd {#Config.cluster.etcd}

EtcdConfig represents the etcd configuration options.

{{< highlight yaml >}} cluster: etcd: image: gcr.io/etcd-development/etcd:v3.5.11 # The container image used to create the etcd service. # The ca is the root certificate authority of the PKI. ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000"

    # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
    # advertisedSubnets:
    #     - 10.0.0.0/8

{{< /highlight >}}

Field Type Description Value(s)
image string The container image used to create the etcd service.
Show example(s){{< highlight yaml >}}
image: gcr.io/etcd-development/etcd:v3.5.11
{{< /highlight >}}
ca PEMEncodedCertificateAndKey
The ca is the root certificate authority of the PKI.It is composed of a base64 encoded crt and key.
Show example(s){{< highlight yaml >}}
ca: 
crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

{{< /highlight >}} | | |extraArgs |map[string]string |

Extra arguments to supply to etcd.Note that the following args are not allowed:

- name
- data-dir
- initial-cluster-state
- listen-peer-urls
- listen-client-urls
- cert-file
- key-file
- trusted-ca-file
- peer-client-cert-auth
- peer-cert-file
- peer-trusted-ca-file
- peer-key-file
| | |advertisedSubnets |[]string |
The advertisedSubnets field configures the networks to pick etcd advertised IP from.
IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
Show example(s){{< highlight yaml >}} advertisedSubnets: - 10.0.0.0/8 {{< /highlight >}}
| | |listenSubnets |[]string |
The listenSubnets field configures the networks for the etcd to listen for peer and client connections.
If listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to
advertisedSubnets.

If neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.

IPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, advertised IP is selected as the first routable address of the node.
| |

coreDNS {#Config.cluster.coreDNS}

CoreDNS represents the CoreDNS config values.

{{< highlight yaml >}} cluster: coreDNS: image: registry.k8s.io/coredns/coredns:v1.11.1 # The image field is an override to the default coredns image. {{< /highlight >}}

Field Type Description Value(s)
disabled bool Disable coredns deployment on cluster bootstrap.
image string The image field is an override to the default coredns image.

externalCloudProvider {#Config.cluster.externalCloudProvider}

ExternalCloudProviderConfig contains external cloud provider configuration.

{{< highlight yaml >}} cluster: externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml {{< /highlight >}}

Field Type Description Value(s)
enabled bool Enable external cloud provider. true
yes
false
no
manifests []string
A list of urls that point to additional manifests for an external cloud provider.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}}
manifests: 
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
- https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

{{< /highlight >}} | |

inlineManifests[] {#Config.cluster.inlineManifests.}

ClusterInlineManifest struct describes inline bootstrap manifests for the user.

{{< highlight yaml >}} cluster: inlineManifests: - name: namespace-ci # Name of the manifest. contents: |- # Manifest contents as a string. apiVersion: v1 kind: Namespace metadata: name: ci {{< /highlight >}}

Field Type Description Value(s)
name string
Name of the manifest.Name should be unique.
Show example(s){{< highlight yaml >}}
name: csi
{{< /highlight >}}
contents string Manifest contents as a string.
Show example(s){{< highlight yaml >}}
contents: /etc/kubernetes/auth
{{< /highlight >}}

adminKubeconfig {#Config.cluster.adminKubeconfig}

AdminKubeconfigConfig contains admin kubeconfig settings.

{{< highlight yaml >}} cluster: adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). {{< /highlight >}}

Field Type Description Value(s)
certLifetime Duration
Admin kubeconfig certificate lifetime (default is 1 year).Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).